#SpringSecurity
LightNews LightNews
webcraftukraine.bsky.social
🔐 JWT та OAuth 2.0: як виникають уразливості та як їх закрити?

У новій статті WebCraft:
• JWT attacks та Algorithm Confusion
• XSS, CSRF і захист токенів
• OAuth, PKCE та refresh token rotation
• Практичні security-тести на Spring Boot

🔗 webscraft.org/blog/jwt-i-o...

#JWT #OAuth2 #SpringSecurity
Безпека JWT і OAuth 2.0: атаки, які ламають ваш API
JWT і OAuth ламають не криптографією, а конфігурацією. Атаки, захист за RFC 9700 і тести на Spring Boot, які очікують 401.
webscraft.org
November 6, 2026 at 5:46 PM
ali-hassaan.bsky.social
A small but thoughtful improvement to the developer experience.

Spring Security 7 lets you customize the default security filter chain through a Customizer bean, rather than redefining the entire SecurityFilterChain for a single change.

#SpringSecurity #Java #SpringBoot
October 26, 2026 at 9:18 AM
infoq.com
Spring Authorization Server ships inside Spring Security 7. This server-side guide covers enabling DPoP and RFC 8693 Token Exchange, the silent .dPoP() opt-in change in 7.1, and combining both safely.

🔗 Read now: buff.ly/ZF9bhjC

#SpringSecurity #Java #Security #InfoQ
October 17, 2026 at 5:45 PM
dashaun.com
Scope swapping attacks work because OAuth requests pass through the browser. PAR pushes them over the back channel instead. Here's how it works. #OAuth2 #SpringSecurity #AppSec
October 11, 2026 at 11:23 PM
dashaun.com
Spring Authorization Server is now part of Spring Security 7. Why? It matured, has a full feature set, and one unified release cycle changes everything. #SpringSecurity #OAuth2 #Java
October 5, 2026 at 12:37 AM
dashaun.com
A stolen access token is useless with DPoP. RFC 9449 stops token replay attacks, now in Spring Authorization Server 1.5 and Spring Security 7. #SpringSecurity #DPoP #OAuth2
October 5, 2026 at 3:37 AM
habuma.com
Securing an MCP server with an API key is easy, but sometimes you need something more robust. In this recipe, we’ll put OAuth 2.0 to work with Spring AI to secure an MCP server.

medium.com/@thetalkinga...

#SpringAI #MCP #OAuth2 #SpringSecurity #Java #AgenticAI
September 14, 2026 at 4:02 PM
intellijidea.com
Trying to debug controller logic, but @SpringSecurity returns 403 before your breakpoint? @IntelliJIDEA's security inlay shows which roles are required and lets you unlock it – keep debugging without touching `SecurityConfig` or restarting. More in 👉 jb.gg/l37xwl
September 8, 2026 at 4:01 PM
eamagician.bsky.social
新着記事書きました。ログイン認証まわりで毎回「なんとなく」で済ませてたSpring Security。CSRFトークンって結局何を守ってるのか、JWT認証をどう組み込むのかを設定コード付きでまとめました。入門の最初の一歩にどうぞ。
https://code-rebuild.com/java-for-beginners/spring-security-getting-started/ #SpringSecurity
August 30, 2026 at 12:00 AM
stackflag.bsky.social
CVE-2026-59354 - spring security (oauth2 authorization server module)
Versions 7.0.0 to 7.0.4 of the Spring Security OAuth server allow a sign‑up feature to accept unsafe information from a new app. If an…

Too many irrelevant or confusing CVEs? Use stackflag.com

#springsecurity #CVE #infosec
CVE-2026-59354: Spring Security OAuth server can let attackers add harmful apps
Versions 7.0.0 to 7.0.4 of the Spring Security OAuth server allow a sign‑up feature to accept unsafe information from a new app.
stackflag.com
August 28, 2026 at 6:00 AM
starbuxman.joshlong.com
Spring Security 7 brings big upgrades: Spring Authorization Server is now part of Spring Security, with DPoP for replay-proof tokens and PAR for safer auth requests. Hear from Spring Security legend Joe Grandja. #SpringSecurity #OAuth #Java #Security https://www.podbean.com/ew/pb-4ns7t-1b454e0
Joe Grandja on Spring Authorization Server, OAuth, and so much more
Hi, Spring fans! In this episode, I talk Spring Security’s Joe Grandja about Spring Authorization Server’s graduation into Spring Security 7, and the new security heavyweights DPoP and PAR.
www.podbean.com
August 27, 2026 at 8:12 AM
stackflag.bsky.social
CVE-2026-59270 - spring security
The built‑in LDAP service in Spring Security automatically creates an admin account and makes it reachable from any network address. This can let anyone on the network…

Too many irrelevant or confusing CVEs? Use stackflag.com

#springsecurity #spring #CVE #infosec
CVE-2026-59270: Spring Security LDAP server leaks admin login on all interfaces
The built‑in LDAP service in Spring Security automatically creates an admin account and makes it reachable from any network address.
stackflag.com
August 27, 2026 at 11:30 AM
thedailytechfeed.com
91 Spring CVEs hit 209K+ components. Spring AI & GraphQL flaws require urgent patch work. #SpringSecurity #OpenSource #Vulnerability #AI #GraphQL #DevSecOps https://thedailytechfeed.com/91-spring-flaws-shake-209000-components-in-open-source-ecosystem/
August 25, 2026 at 1:15 PM
thedailytechfeed.com
Spring Security CVE-2026-59270 lets attackers get full admin over LDAP without login. #SpringSecurity #LDAP #Vulnerability #CVESecurity #Cybersecurity #DevSecOps https://thedailytechfeed.com/critical-spring-security-flaw-opens-ldap-servers-to-admin-takeover/
August 21, 2026 at 8:48 AM
blackhatnews.tokyo
SpringSecurityの重大なLDAP脆弱性、リモート攻撃者によるディレクトリデータの読み取り・改ざんが可能に

Spring Securityに組み込まれたUnboundID LDAPサーバーに、重大な脆弱性が確認されました。ゼロデイ脆弱性アラート この脆弱性を悪用すると、リモート攻撃者が広く知られた管理者用bind DNを使って認証を突破し、アプリケーションのインメモリLDAPディレクトリに保存されたデータを読み取ったり改ざ...
SpringSecurityの重大なLDAP脆弱性、リモート攻撃者によるディレクトリデータの読み取り・改ざんが可能に
Spring Securityに組み込まれたUnboundID LDAPサーバーに、重大な脆弱性が確認されました。ゼロデイ脆弱性アラート この脆弱性を悪用すると、リモート攻撃者が広く知られた管理者用bind DNを使って認証を突破し、アプリケーションのインメモリLDAPディレクトリに保存されたデータを読み取ったり改ざ
blackhatnews.tokyo
August 21, 2026 at 9:56 AM
securityonline.bsky.social
Four Spring Security vulnerabilities were disclosed, led by CVE-2026-59270 (CVSS 9.4). Attackers can read or modify entries in the in-memory directory.

#SpringSecurity #CVE202659270 #LDAP #WebAuthn #DPoP #AppSec
CVE-2026-59270: Spring Security LDAP Flaw Lets Attackers Read or Modify Directory Entries
TL;DR VMware disclosed four Spring Security vulnerabilities. The most severe, CVE-2026-59270, rates CVSS 9.4 (CRITICAL). Its embedded LDAP server exposes an admin bind DN on all interfaces, letting an attacker read or modify entries in the in-memory directory. No exploitation in the wild or public proof-of-concept has been confirmed. Why These Spring Security Vulnerabilities Matter Spring Security guards authentication for countless Java applications.
securityonline.info
August 21, 2026 at 2:11 AM
infoq.com
Check out what's new in the #Spring community 👉 bit.ly/3MXPcnD

The 2nd milestone releases of: Spring Boot, Spring Security, Spring Integration, Spring Modulith and Spring AMQP; Spring for Apache Kafka & Spring LDAP; and more.

#Java #SpringBoot #SpringData #SpringSecurity #SpringAMQP #ApacheKafka
February 25, 2026 at 7:33 AM
infoq.com
This #InfoQ article explores a solution for Registering & Authenticating users through a client-side JavaScript application using the #SpringSecurity infrastructure, access and refresh tokens.

🎯 The goal: Clear, step-by-step #FlowDiagrams make the process easy to follow!

👉 bit.ly/3PJ3YMA

#Java
January 12, 2026 at 2:11 PM
infoq.com
Dive into the latest releases from #Spring 👉 bit.ly/4pyyubY

GA releases of Spring Boot, Spring Security, Spring for GraphQL, Spring Integration, Spring Modulith, Spring REST Docs and Spring Batch.

#Java #SpringBoot #SpringSecurity #SpringFramework #ApacheKafka #AMQP #GraphQL
November 27, 2025 at 8:02 AM
infoq.com
Check out what's new in the #Spring community 👉 bit.ly/3HW4Q0a

The second milestone releases of Spring Boot, Spring Security, Spring Authorization Server, Spring for GraphQL, Spring Session, Spring Integration, Spring REST Docs, and more.

#Java #SpringBoot #SpringSecurity #SpringFramework
August 28, 2025 at 12:02 PM
infoq.com
Dive into the latest releases from #Spring 👉 bit.ly/4jGq7rP

GA releases of Spring Boot, Spring Security, Spring Authorization Server, Spring Session, Spring Integration, Spring for GraphQL, Spring AI and Spring Web Services.

#Java #SpringBoot #SpringSecurity #SpringAI
May 28, 2025 at 6:30 AM
infoq.com
Dive into the latest releases from #Spring 👉 bit.ly/449pt1L

First release candidates of Spring Boot, Spring Data 2025.0.0, Spring Security, Spring Authorization Server, Spring Session, Spring Integration, Spring Modulith & Spring Web Services.

#Java #SpringBoot #SpringData #SpringSecurity
April 29, 2025 at 9:33 AM
infoq.com
This #InfoQ article provides a detailed solution for registering & authenticating a user through a client-side #JavaScript application using the #SpringSecurity infrastructure, access & refresh tokens.

We explore the process in detail with helpful flow diagrams!

🔗 bit.ly/3PJ3YMA

#Java #Spring
April 22, 2025 at 5:36 AM
infoq.com
Dive into the latest releases from #Spring 👉 bit.ly/3QKfxUy

Spring Boot, Spring Security, Spring Authorization Server, Spring for GraphQL, Spring Integration, Spring AMQP, Spring for Apache Kafka & Spring Web Services.

#Java #SpringBoot #SpringFramework #SpringSecurity #SpringBatch #SpringModulith
March 26, 2025 at 7:27 AM
infoq.com
Dive into the latest releases from Spring 👉 bit.ly/3EqpbbK

Milestone releases of: Spring Boot, Spring Framework, Spring Data, Spring Security, Spring Integration and Spring Modulith.

#Java #SpringBoot #SpringFramework #SpringSecurity #SpringAI #SpringModulith
January 28, 2025 at 8:03 AM