# All Classes and Interfaces

Class
Description
AbstractAuthenticationProcessingFilter
Abstract processor of browser-based HTTP-based authentication requests.
AbstractAuthenticationTargetUrlRequestHandler
Base class containing the logic used by strategies which handle redirection to a URL and are passed an `Authentication` object as part of the contract.
AbstractPreAuthenticatedProcessingFilter
Base class for processing filters that handle pre-authenticated authentication requests, where it is assumed that the principal has already been authenticated by an external system.
AbstractRememberMeServices
Base class for RememberMeServices implementations.
AbstractRequestParameterAllowFromStrategy
Deprecated.
ALLOW-FROM is an obsolete directive that no longer works in modern browsers.
AbstractRetryEntryPoint
AbstractSecurityWebApplicationInitializer
Registers the `DelegatingFilterProxy` to use the springSecurityFilterChain before any other registered `Filter`.
AbstractSessionFixationProtectionStrategy
A base class for performing session fixation protection.
AbstractSessionFixationProtectionStrategy.NullEventPublisher
AccessDeniedHandler
Used by `ExceptionTranslationFilter` to handle an `AccessDeniedException`.
AccessDeniedHandlerImpl
Base implementation of `AccessDeniedHandler`.
AllowFromStrategy
Deprecated.
ALLOW-FROM is an obsolete directive that no longer works in modern browsers.
AndRequestMatcher
`RequestMatcher` that will return true if all of the passed in `RequestMatcher` instances match.
AndServerWebExchangeMatcher
Matches if all the provided `ServerWebExchangeMatcher` match
AnonymousAuthenticationFilter
Detects if there is no `Authentication` object in the `SecurityContextHolder`, and populates it with one if needed.
AnonymousAuthenticationWebFilter
Detects if there is no `Authentication` object in the `ReactiveSecurityContextHolder`, and populates it with one if needed.
AntPathRequestMatcher
Matcher which compares a pre-defined ant-style pattern against the URL ( `servletPath + pathInfo`) of an `HttpServletRequest`.
AnyRequestMatcher
Matches any supplied request.
AttestationConveyancePreference
WebAuthn Relying Parties may use AttestationConveyancePreference to specify their preference regarding attestation conveyance during credential generation.
AuthenticationConverter
A strategy used for converting from a `HttpServletRequest` to an `Authentication` of particular type.
AuthenticationConverterServerWebExchangeMatcher
Matches if the `ServerAuthenticationConverter` can convert a `ServerWebExchange` to an `Authentication`.
AuthenticationEntryPoint
Used by `ExceptionTranslationFilter` to commence an authentication scheme.
AuthenticationEntryPointFailureHandler
Adapts a `AuthenticationEntryPoint` into a `AuthenticationFailureHandler`
AuthenticationExtensionsClientInput<T>
A client extension input entry in the `AuthenticationExtensionsClientInputs`.
AuthenticationExtensionsClientInputs
AuthenticationExtensionsClientInputs is a dictionary containing the client extension input values for zero or more WebAuthn Extensions.
AuthenticationExtensionsClientOutput<T>
A client extension output entry in `AuthenticationExtensionsClientOutputs`.
AuthenticationExtensionsClientOutputs
AuthenticationExtensionsClientOutputs is a dictionary containing the client extension output values for zero or more WebAuthn Extensions.
AuthenticationFailureHandler
Strategy used to handle a failed authentication attempt.
AuthenticationFilter
A `Filter` that performs authentication of a particular request.
AuthenticationPrincipal
Deprecated.
Use `AuthenticationPrincipal` instead.
AuthenticationPrincipalArgumentResolver
Deprecated.
Use `AuthenticationPrincipalArgumentResolver` instead.
AuthenticationPrincipalArgumentResolver
Allows resolving the `Authentication.getPrincipal()` using the `AuthenticationPrincipal` annotation.
AuthenticationPrincipalArgumentResolver
Resolves the Authentication
AuthenticationSuccessHandler
Strategy used to handle a successful user authentication.
AuthenticationSwitchUserEvent
Application event which indicates that a user context switch.
AuthenticationWebFilter
A `WebFilter` that performs authentication of a particular request.
AuthenticatorAssertionResponse
The AuthenticatorAssertionResponse interface represents an authenticator's response to a client's request for generation of a new authentication assertion given the WebAuthn Relying Party's challenge and OPTIONAL list of credentials it is aware of.
AuthenticatorAssertionResponse.AuthenticatorAssertionResponseBuilder
Builds a `AuthenticatorAssertionResponse`.
AuthenticatorAttachment
The AuthenticatorAttachment.
AuthenticatorAttestationResponse
AuthenticatorAttestationResponse represents the authenticator's response to a client's request for the creation of a new public key credential.
AuthenticatorAttestationResponse.AuthenticatorAttestationResponseBuilder
Builds `AuthenticatorAssertionResponse`.
AuthenticatorResponse
The AuthenticatorResponse represents Authenticators respond to Relying Party requests.
AuthenticatorSelectionCriteria
AuthenticatorAttachment can be used by WebAuthn Relying Parties to specify their requirements regarding authenticator attributes.
AuthenticatorSelectionCriteria.AuthenticatorSelectionCriteriaBuilder
Creates a `AuthenticatorSelectionCriteria`
AuthenticatorTransport
AuthenticatorTransport defines hints as to how clients might communicate with a particular authenticator in order to obtain an assertion for a specific credential.
AuthorizationContext
AuthorizationFilter
An authorization filter that restricts access to the URL using `AuthorizationManager`.
AuthorizationManagerWebInvocationPrivilegeEvaluator
An implementation of `WebInvocationPrivilegeEvaluator` which delegates the checks to an instance of `AuthorizationManager`
AuthorizationManagerWebInvocationPrivilegeEvaluator.HttpServletRequestTransformer
Used to transform the `HttpServletRequest` prior to passing it into the `AuthorizationManager`.
AuthorizationWebFilter
BasicAuthenticationConverter
Converts from a HttpServletRequest to `UsernamePasswordAuthenticationToken` that can be authenticated.
BasicAuthenticationEntryPoint
Used by the `ExceptionTranslationFilter` to commence authentication via the `BasicAuthenticationFilter`.
BasicAuthenticationFilter
Processes a HTTP request's BASIC authorization headers, putting the result into the `SecurityContextHolder`.
Bytes
An object representation of byte[].
CacheControlHeadersWriter
Inserts headers to prevent caching if no cache control headers have been specified.
CacheControlServerHttpHeadersWriter
Writes cache control related headers.
ChangeSessionIdAuthenticationStrategy
Uses `HttpServletRequest.changeSessionId()` to protect against session fixation attacks.
ChannelDecisionManager
Decides whether a web channel provides sufficient security.
ChannelDecisionManagerImpl
Implementation of `ChannelDecisionManager`.
ChannelEntryPoint
May be used by a `ChannelProcessor` to launch a web channel.
ChannelProcessingFilter
Ensures a web request is delivered over the required channel.
ChannelProcessor
Decides whether a web channel meets a specific security condition.
ClearSiteDataHeaderWriter
Provides support for Clear Site Data.
ClearSiteDataHeaderWriter.Directive
Represents the directive values expected by the `ClearSiteDataHeaderWriter`.
ClearSiteDataServerHttpHeadersWriter
Writes the `Clear-Site-Data` response header when the request is secure.
ClearSiteDataServerHttpHeadersWriter.Directive
Represents the directive values expected by the `ClearSiteDataServerHttpHeadersWriter`
CompositeAccessDeniedHandler
CompositeHeaderWriter
A `HeaderWriter` that delegates to several other `HeaderWriter`s.
CompositeLogoutHandler
Performs a logout through all the `LogoutHandler` implementations.
CompositeRequestRejectedHandler
A `RequestRejectedHandler` that delegates to several other `RequestRejectedHandler`s.
CompositeServerHttpHeadersWriter
Combines multiple `ServerHttpHeadersWriter` instances into a single instance.
CompositeSessionAuthenticationStrategy
A `SessionAuthenticationStrategy` that accepts multiple `SessionAuthenticationStrategy` implementations to delegate to.
ConcurrentSessionControlAuthenticationStrategy
Strategy which handles concurrent session-control.
ConcurrentSessionControlServerAuthenticationSuccessHandler
Controls the number of sessions a user can have concurrently authenticated in an application.
ConcurrentSessionFilter
Filter required by concurrent session handling package.
ContentSecurityPolicyHeaderWriter
Provides support for Content Security Policy (CSP) Level 2.
ContentSecurityPolicyServerHttpHeadersWriter
Writes the `Content-Security-Policy` response header with configured policy directives.
ContentTypeOptionsServerHttpHeadersWriter
Adds X-Content-Type-Options: nosniff
CookieClearingLogoutHandler
A logout handler which clears either - A defined list of cookie names, using the context path as the cookie path OR - A given list of Cookies
CookieCsrfTokenRepository
A `CsrfTokenRepository` that persists the CSRF token in a cookie named "XSRF-TOKEN" and reads from the header "X-XSRF-TOKEN" following the conventions of AngularJS.
CookieRequestCache
An Implementation of `RequestCache` which saves the original request URI in a cookie.
CookieServerCsrfTokenRepository
A `ServerCsrfTokenRepository` that persists the CSRF token in a cookie named "XSRF-TOKEN" and reads from the header "X-XSRF-TOKEN" following the conventions of AngularJS.
CookieServerRequestCache
An implementation of `ServerRequestCache` that saves the requested URI in a cookie.
CookieTheftException
COSEAlgorithmIdentifier
COSEAlgorithmIdentifier is used to identify a cryptographic algorithm.
CredentialPropertiesOutput
CredentialPropertiesOutput is the Client extension output.
CredentialPropertiesOutput.ExtensionOutput
The output for `CredentialPropertiesOutput`
CredentialRecord
Represents a Credential Record that is stored by the Relying Party after successful registration.
CredProtectAuthenticationExtensionsClientInput
Implements Credential Protection (credProtect).
CredProtectAuthenticationExtensionsClientInput.CredProtect
CredProtectAuthenticationExtensionsClientInput.CredProtect.ProtectionPolicy
CrossOriginEmbedderPolicyHeaderWriter
Inserts Cross-Origin-Embedder-Policy header.
CrossOriginEmbedderPolicyHeaderWriter.CrossOriginEmbedderPolicy
CrossOriginEmbedderPolicyServerHttpHeadersWriter
Inserts Cross-Origin-Embedder-Policy headers.
CrossOriginEmbedderPolicyServerHttpHeadersWriter.CrossOriginEmbedderPolicy
CrossOriginOpenerPolicyHeaderWriter
Inserts the Cross-Origin-Opener-Policy header
CrossOriginOpenerPolicyHeaderWriter.CrossOriginOpenerPolicy
CrossOriginOpenerPolicyServerHttpHeadersWriter
Inserts Cross-Origin-Opener-Policy header.
CrossOriginOpenerPolicyServerHttpHeadersWriter.CrossOriginOpenerPolicy
CrossOriginResourcePolicyHeaderWriter
Inserts Cross-Origin-Resource-Policy header
CrossOriginResourcePolicyHeaderWriter.CrossOriginResourcePolicy
CrossOriginResourcePolicyServerHttpHeadersWriter
Inserts Cross-Origin-Resource-Policy headers.
CrossOriginResourcePolicyServerHttpHeadersWriter.CrossOriginResourcePolicy
CsrfAuthenticationStrategy
`CsrfAuthenticationStrategy` is in charge of removing the `CsrfToken` upon authenticating.
CsrfException
Thrown when an invalid or missing `CsrfToken` is found in the HttpServletRequest
CsrfException
Thrown when an invalid or missing `CsrfToken` is found in the HttpServletRequest
CsrfFilter
Applies CSRF protection using a synchronizer token pattern.
CsrfLogoutHandler
`CsrfLogoutHandler` is in charge of removing the `CsrfToken` upon logout.
CsrfRequestDataValueProcessor
CsrfRequestDataValueProcessor
Integration with Spring Web MVC that automatically adds the `CsrfToken` into forms with hidden inputs when using Spring tag libraries.
CsrfServerLogoutHandler
`CsrfServerLogoutHandler` is in charge of removing the `CsrfToken` upon logout.
CsrfToken
Provides the information about an expected CSRF token.
CsrfToken
CsrfTokenArgumentResolver
Allows resolving the current `CsrfToken`.
CsrfTokenRepository
An API to allow changing the method in which the expected `CsrfToken` is associated to the `HttpServletRequest`.
CsrfTokenRequestAttributeHandler
An implementation of the `CsrfTokenRequestHandler` interface that is capable of making the `CsrfToken` available as a request attribute and resolving the token value as either a header or parameter value of the request.
CsrfTokenRequestHandler
A callback interface that is used to make the `CsrfToken` created by the `CsrfTokenRepository` available as a request attribute.
CsrfTokenRequestResolver
Implementations of this interface are capable of resolving the token value of a `CsrfToken` from the provided `HttpServletRequest`.
CsrfWebFilter
Applies CSRF protection using a synchronizer token pattern.
CurrentSecurityContextArgumentResolver
Allows resolving the `SecurityContext` using the `CurrentSecurityContext` annotation.
CurrentSecurityContextArgumentResolver
Resolves the `SecurityContext`
DebugFilter
Spring Security debugging filter.
DefaultCsrfToken
A CSRF token that is used to protect against CSRF attacks.
DefaultCsrfToken
A CSRF token that is used to protect against CSRF attacks.
DefaultFilterInvocationSecurityMetadataSource
Default implementation of `FilterInvocationDefinitionSource`.
DefaultHttpFirewall
User's should consider using `StrictHttpFirewall` because rather than trying to sanitize a malicious URL it rejects the malicious URL providing better security guarantees.
DefaultHttpSecurityExpressionHandler
A `SecurityExpressionHandler` that uses a `RequestAuthorizationContext` to create a `WebSecurityExpressionRoot`.
DefaultLoginPageGeneratingFilter
For internal use with namespace configuration in the case where a user doesn't configure a login page.
DefaultLogoutPageGeneratingFilter
Generates a default log out page.
DefaultOneTimeTokenSubmitPageGeneratingFilter
Creates a default one-time token submit page.
DefaultRedirectStrategy
Simple implementation of `RedirectStrategy` which is the default used throughout the framework.
DefaultRequestRejectedHandler
Default implementation of `RequestRejectedHandler` that simply rethrows the exception.
DefaultResourcesFilter
Serve common static assets used in default UIs, such as CSS or Javascript files.
DefaultResourcesWebFilter
Serve common static assets used in default UIs, such as CSS or Javascript files.
DefaultSavedRequest
Represents central information from a `HttpServletRequest`.
DefaultSavedRequest.Builder
DefaultSecurityFilterChain
Standard implementation of `SecurityFilterChain`.
DefaultServerRedirectStrategy
The default `ServerRedirectStrategy` to use.
DefaultWebAuthnRegistrationPageGeneratingFilter
A `Filter` that renders a default WebAuthn registration page.
DefaultWebInvocationPrivilegeEvaluator
Deprecated.
Use `AuthorizationManagerWebInvocationPrivilegeEvaluator` instead
DefaultWebSecurityExpressionHandler
DeferredCsrfToken
An interface that allows delayed access to a `CsrfToken` that may be generated.
DelegatingAccessDeniedHandler
An `AccessDeniedHandler` that delegates to other `AccessDeniedHandler` instances based upon the type of `AccessDeniedException` passed into `DelegatingAccessDeniedHandler.handle(HttpServletRequest, HttpServletResponse, AccessDeniedException)`.
DelegatingAuthenticationConverter
A `AuthenticationConverter`, that iterates over multiple `AuthenticationConverter`.
DelegatingAuthenticationEntryPoint
An `AuthenticationEntryPoint` which selects a concrete `AuthenticationEntryPoint` based on a `RequestMatcher` evaluation.
DelegatingAuthenticationFailureHandler
An `AuthenticationFailureHandler` that delegates to other `AuthenticationFailureHandler` instances based upon the type of `AuthenticationException` passed into `DelegatingAuthenticationFailureHandler.onAuthenticationFailure(HttpServletRequest, HttpServletResponse, AuthenticationException)` .
DelegatingLogoutSuccessHandler
Delegates to logout handlers based on matched request matchers
DelegatingReactiveAuthorizationManager
DelegatingReactiveAuthorizationManager.Builder
DelegatingRequestMatcherHeaderWriter
Delegates to the provided `HeaderWriter` when `RequestMatcher.matches(HttpServletRequest)` returns true.
DelegatingSecurityContextRepository
DelegatingServerAuthenticationConverter
A `ServerAuthenticationConverter` that delegates to other `ServerAuthenticationConverter` instances.
DelegatingServerAuthenticationEntryPoint
A `ServerAuthenticationEntryPoint` which delegates to multiple `ServerAuthenticationEntryPoint` based on a `ServerWebExchangeMatcher`
DelegatingServerAuthenticationEntryPoint.DelegateEntry
DelegatingServerAuthenticationSuccessHandler
Delegates to a collection of `ServerAuthenticationSuccessHandler` implementations.
DelegatingServerLogoutHandler
Delegates to a collection of `ServerLogoutHandler` implementations.
DigestAuthenticationEntryPoint
Used by the `SecurityEnforcementFilter` to commence authentication via the `DigestAuthenticationFilter`.
DigestAuthenticationFilter
Processes a HTTP request's Digest authorization headers, putting the result into the `SecurityContextHolder`.
DisableEncodeUrlFilter
Disables encoding URLs using the `HttpServletResponse` to prevent including the session id in URLs which is not considered URL because the session id can be leaked in things like HTTP access logs.
DispatcherTypeRequestMatcher
Checks the `DispatcherType` to decide whether to match a given request.
ELRequestMatcher
A RequestMatcher implementation which uses a SpEL expression
Enumerator<T>
Adapter that wraps an `Enumeration` around a Java 2 collection `Iterator`.
ExceptionMappingAuthenticationFailureHandler
Uses the internal map of exceptions types to URLs to determine the destination on authentication failure.
ExceptionTranslationFilter
Handles any `AccessDeniedException` and `AuthenticationException` thrown within the filter chain.
ExceptionTranslationWebFilter
ExchangeMatcherRedirectWebFilter
Web filter that redirects requests that match `ServerWebExchangeMatcher` to the specified URL.
ExpressionBasedFilterInvocationSecurityMetadataSource
Expression-based `FilterInvocationSecurityMetadataSource`.
FastHttpDateFormat
Utility class to generate HTTP dates.
FeaturePolicyHeaderWriter
Provides support for Feature Policy.
FeaturePolicyServerHttpHeadersWriter
Writes the `Feature-Policy` response header with configured policy directives.
FilterChainProxy
Delegates `Filter` requests to a list of Spring-managed filter beans.
FilterChainProxy.FilterChainDecorator
A strategy for decorating the provided filter chain with one that accounts for the `SecurityFilterChain` for a given request.
FilterChainProxy.FilterChainValidator
FilterChainProxy.VirtualFilterChainDecorator
A `FilterChainProxy.FilterChainDecorator` that uses the `FilterChainProxy.VirtualFilterChain`
FilterInvocation
Holds objects associated with a HTTP filter.
FilterInvocationSecurityMetadataSource
Marker interface for `SecurityMetadataSource` implementations that are designed to perform lookups keyed on `FilterInvocation`s.
FilterSecurityInterceptor
Deprecated.
Use `AuthorizationFilter` instead
FirewalledRequest
Request wrapper which is returned by the `HttpFirewall` interface.
ForceEagerSessionCreationFilter
Eagerly creates `HttpSession` if it does not already exist.
ForwardAuthenticationFailureHandler
Forward Authentication Failure Handler
ForwardAuthenticationSuccessHandler
Forward Authentication Success Handler
ForwardLogoutSuccessHandler
`LogoutSuccessHandler` implementation that will perform a request dispatcher "forward" to the specified target URL.
GenerateOneTimeTokenFilter
Filter that process a One-Time Token generation request.
GenerateOneTimeTokenWebFilter
`WebFilter` implementation that process a One-Time Token generation request.
HandlerMappingIntrospectorRequestTransformer
Transforms by passing it into `HandlerMappingIntrospector.setCache(HttpServletRequest)`.
HaveIBeenPwnedRestApiPasswordChecker
Checks if the provided password was leaked by relying on Have I Been Pwned REST API.
HaveIBeenPwnedRestApiReactivePasswordChecker
Checks if the provided password was leaked by relying on Have I Been Pwned REST API.
Header
Represents a Header to be added to the `HttpServletResponse`
HeaderWriter
Contract for writing headers to a `HttpServletResponse`
HeaderWriterFilter
Filter implementation to add headers to the current response.
HeaderWriterLogoutHandler
HeaderWriterServerLogoutHandler
A `ServerLogoutHandler` implementation which writes HTTP headers during logout.
HpkpHeaderWriter
Deprecated.
see Certificate and Public Key Pinning for more context
HstsHeaderWriter
Provides support for HTTP Strict Transport Security (HSTS).
Http403ForbiddenEntryPoint
In the pre-authenticated authentication case (unlike CAS, for example) the user will already have been identified through some external mechanism and a secure context established by the time the security-enforcement filter is invoked.
HttpBasicServerAuthenticationEntryPoint
Prompts a user for HTTP Basic authentication.
HttpFirewall
Interface which can be used to reject potentially dangerous requests and/or wrap them to control their behaviour.
HttpHeaderWriterWebFilter
Invokes a `ServerHttpHeadersWriter` on `ReactiveHttpOutputMessage.beforeCommit(java.util.function.Supplier)`.
HttpMessageConverterAuthenticationSuccessHandler
An `AuthenticationSuccessHandler` that writes a JSON response with the redirect URL and an authenticated status similar to: `{ "redirectUrl": "/user/profile", "authenticated": true }`
HttpMessageConverterAuthenticationSuccessHandler.AuthenticationSuccess
A response object used to write the JSON response for successful authentication.
HttpRequestResponseHolder
Deprecated.
Use `SecurityContextRepository.loadDeferredContext(HttpServletRequest)`
HttpSessionCreatedEvent
Published by the `HttpSessionEventPublisher` when an `HttpSession` is created by the container
HttpSessionCsrfTokenRepository
A `CsrfTokenRepository` that stores the `CsrfToken` in the `HttpSession`.
HttpSessionDestroyedEvent
Published by the `HttpSessionEventPublisher` when a HttpSession is removed from the container
HttpSessionEventPublisher
Declared in web.xml as
HttpSessionIdChangedEvent
Published by the `HttpSessionEventPublisher` when an `HttpSession` ID is changed.
HttpSessionPublicKeyCredentialCreationOptionsRepository
HttpSessionPublicKeyCredentialRequestOptionsRepository
A `PublicKeyCredentialRequestOptionsRepository` that stores the `PublicKeyCredentialRequestOptions` in the `HttpSession`.
HttpSessionRequestCache
`RequestCache` which stores the `SavedRequest` in the HttpSession.
HttpSessionSecurityContextRepository
A `SecurityContextRepository` implementation which stores the security context in the `HttpSession` between requests.
HttpsRedirectWebFilter
Redirects any non-HTTPS request to its HTTPS equivalent.
HttpStatusEntryPoint
An `AuthenticationEntryPoint` that sends a generic `HttpStatus` as a response.
HttpStatusExchangeRejectedHandler
A simple implementation of `ServerExchangeRejectedHandler` that sends an error with configurable status code.
HttpStatusRequestRejectedHandler
A simple implementation of `RequestRejectedHandler` that sends an error with configurable status code.
HttpStatusReturningLogoutSuccessHandler
Implementation of the `LogoutSuccessHandler`.
HttpStatusReturningServerLogoutSuccessHandler
Implementation of the `ServerLogoutSuccessHandler`.
HttpStatusServerAccessDeniedHandler
Sets the provided HTTP Status when access is denied.
HttpStatusServerEntryPoint
A `ServerAuthenticationEntryPoint` that sends a generic `HttpStatus` as a response.
ImmutableAuthenticationExtensionsClientInput<T>
An immutable `AuthenticationExtensionsClientInput`.
ImmutableAuthenticationExtensionsClientInputs
An immutable implementation of `AuthenticationExtensionsClientInputs`.
ImmutableAuthenticationExtensionsClientOutputs
An immutable implementation of `AuthenticationExtensionsClientOutputs`.
ImmutableCredentialRecord
An immutable `CredentialRecord`.
ImmutableCredentialRecord.ImmutableCredentialRecordBuilder
ImmutablePublicKeyCose
An immutable `PublicKeyCose`
ImmutablePublicKeyCredentialCreationOptionsRequest
An immutable implementation of `PublicKeyCredentialCreationOptionsRequest`.
ImmutablePublicKeyCredentialRequestOptionsRequest
ImmutablePublicKeyCredentialUserEntity
PublicKeyCredentialUserEntity is used to supply additional user account attributes when creating a new credential.
ImmutablePublicKeyCredentialUserEntity.PublicKeyCredentialUserEntityBuilder
Used to build `PublicKeyCredentialUserEntity`.
ImmutableRelyingPartyRegistrationRequest
Contains the information necessary to register a new Credential.
InMemoryTokenRepositoryImpl
Simple `PersistentTokenRepository` implementation backed by a Map.
InsecureChannelProcessor
Ensures channel security is inactive by review of `HttpServletRequest.isSecure()` responses.
InvalidateLeastUsedServerMaximumSessionsExceededHandler
Implementation of `ServerMaximumSessionsExceededHandler` that invalidates the least recently used `ReactiveSessionInformation` and removes the related sessions from the `WebSessionStore`.
InvalidCookieException
Exception thrown by a RememberMeServices implementation to indicate that a submitted cookie is of an invalid format or has expired.
InvalidCsrfTokenException
Thrown when an expected `CsrfToken` exists, but it does not match the value present on the `HttpServletRequest`
InvalidSessionAccessDeniedHandler
An adapter of `InvalidSessionStrategy` to `AccessDeniedHandler`
InvalidSessionStrategy
Determines the behaviour of the `SessionManagementFilter` when an invalid session Id is submitted and detected in the `SessionManagementFilter`.
IpAddressAuthorizationManager
A `AuthorizationManager`, that determines if the current request contains the specified address or range of addresses
IpAddressMatcher
Matches a request based on IP Address or subnet mask matching against the remote address.
IpAddressReactiveAuthorizationManager
A `ReactiveAuthorizationManager`, that determines if the current request contains the specified address or range of addresses
IpAddressServerWebExchangeMatcher
Matches a request based on IP Address or subnet mask matching against the remote address.
J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource
Implementation of AuthenticationDetailsSource which converts the user's J2EE roles (as obtained by calling `HttpServletRequest.isUserInRole(String)`) into `GrantedAuthority`s and stores these in the authentication details object.
J2eePreAuthenticatedProcessingFilter
This AbstractPreAuthenticatedProcessingFilter implementation is based on the J2EE container-based authentication mechanism.
JaasApiIntegrationFilter
A `Filter` which attempts to obtain a JAAS `Subject` and continue the `FilterChain` running as that `Subject`.
JdbcTokenRepositoryImpl
JDBC based persistent login token repository implementation.
LazyCsrfTokenRepository
Deprecated.
Use `CsrfTokenRepository.loadDeferredToken(HttpServletRequest, HttpServletResponse)` which returns a `DeferredCsrfToken`
LoginPageGeneratingWebFilter
Generates a default log in page used for authenticating users.
LoginUrlAuthenticationEntryPoint
Used by the `ExceptionTranslationFilter` to commence a form login authentication via the `UsernamePasswordAuthenticationFilter`.
LogoutFilter
Logs a principal out.
LogoutHandler
Indicates a class that is able to participate in logout handling.
LogoutPageGeneratingWebFilter
Generates a default log out page.
LogoutSuccessEventPublishingLogoutHandler
A logout handler which publishes `LogoutSuccessEvent`
LogoutSuccessHandler
Strategy that is called after a successful logout by the `LogoutFilter`, to handle redirection or forwarding to the appropriate destination.
LogoutWebFilter
If the request matches, logs an authenticated user out by delegating to a `ServerLogoutHandler`.
MapPublicKeyCredentialUserEntityRepository
A `Map` based implementation of `PublicKeyCredentialUserEntityRepository`.
MapUserCredentialRepository
A `Map` based implementation of `UserCredentialRepository`.
MatcherSecurityWebFilterChain
A `SecurityWebFilterChain` that leverages a `ServerWebExchangeMatcher` to determine which `WebFilter` to execute.
MaximumSessionsContext
MediaTypeRequestMatcher
Allows matching `HttpServletRequest` based upon the `MediaType`'s resolved from a `ContentNegotiationStrategy`.
MediaTypeServerWebExchangeMatcher
Matches based upon the accept headers.
MissingCsrfTokenException
Thrown when no expected `CsrfToken` is found but is required.
MvcRequestMatcher
A `RequestMatcher` that uses Spring MVC's `HandlerMappingIntrospector` to match the path and extract variables.
MvcRequestMatcher.Builder
A builder for `MvcRequestMatcher`
NegatedRequestMatcher
A `RequestMatcher` that will negate the `RequestMatcher` passed in.
NegatedServerWebExchangeMatcher
Negates the provided matcher.
NonceExpiredException
Thrown if an authentication request is rejected because the digest nonce has expired.
NoOpAccessDeniedHandler
An `AccessDeniedHandler` implementation that does nothing.
NoOpAuthenticationEntryPoint
An `AuthenticationEntryPoint` implementation that does nothing.
NoOpServerRequestCache
An implementation of `ServerRequestCache` that does nothing.
NoOpServerSecurityContextRepository
A do nothing implementation of `ServerSecurityContextRepository`.
NullAuthenticatedSessionStrategy
NullRememberMeServices
Implementation of `NullRememberMeServices` that does nothing.
NullRequestCache
Null implementation of `RequestCache`.
NullSecurityContextRepository
ObservationFilterChainDecorator
A `FilterChainProxy.FilterChainDecorator` that wraps the chain in before and after observations
ObservationMarkingAccessDeniedHandler
ObservationMarkingRequestRejectedHandler
ObservationWebFilterChainDecorator
A `WebFilterChainProxy.WebFilterChainDecorator` that wraps the chain in before and after observations
OnCommittedResponseWrapper
Base class for response wrappers which encapsulate the logic for handling an event when the `HttpServletResponse` is committed.
OneTimeTokenAuthenticationConverter
An implementation of `AuthenticationConverter` that detects if the request contains a `token` parameter and constructs a `OneTimeTokenAuthenticationToken` with it.
OneTimeTokenGenerationSuccessHandler
Defines a strategy to handle generated one-time tokens.
OneTimeTokenSubmitPageGeneratingWebFilter
Creates a default one-time token submit page.
OrRequestMatcher
`RequestMatcher` that will return true if any of the passed in `RequestMatcher` instances match.
OrServerWebExchangeMatcher
Matches if any of the provided `ServerWebExchangeMatcher` match
ParameterRequestMatcher
A `RequestMatcher` for matching on a request parameter and its value.
PathPatternParserServerWebExchangeMatcher
Matches if the `PathPattern` matches the path within the application.
PermissionsPolicyHeaderWriter
Provides support for Permisisons Policy.
PermissionsPolicyServerHttpHeadersWriter
Writes the `Permissions-Policy` response header with configured policy directives.
PersistentRememberMeToken
PersistentTokenBasedRememberMeServices
`RememberMeServices` implementation based on Barry Jaspan's Improved Persistent Login Cookie Best Practice.
PersistentTokenRepository
The abstraction used by `PersistentTokenBasedRememberMeServices` to store the persistent login tokens for a user.
PortMapper
`PortMapper` implementations provide callers with information about which HTTP ports are associated with which HTTPS ports on the system, and vice versa.
PortMapperImpl
Concrete implementation of `PortMapper` that obtains HTTP:HTTPS pairs from the application context.
PortResolver
A `PortResolver` determines the port a web request was received on.
PortResolverImpl
Concrete implementation of `PortResolver` that obtains the port from `ServletRequest.getServerPort()`.
PreAuthenticatedAuthenticationProvider
Processes a pre-authenticated authentication request.
PreAuthenticatedAuthenticationToken
`Authentication` implementation for pre-authenticated authentication.
PreAuthenticatedCredentialsNotFoundException
PreAuthenticatedGrantedAuthoritiesUserDetailsService
This AuthenticationUserDetailsService implementation creates a UserDetails object based solely on the information contained in the given PreAuthenticatedAuthenticationToken.
PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails
This WebAuthenticationDetails implementation allows for storing a list of pre-authenticated Granted Authorities.
PreventLoginServerMaximumSessionsExceededHandler
Returns a `Mono` that terminates with `SessionAuthenticationException` when the maximum number of sessions for a user has been reached.
PublicKeyCose
A COSE encoded public key.
PublicKeyCredential<R extends AuthenticatorResponse>
PublicKeyCredential contains the attributes that are returned to the caller when a new credential is created, or a new assertion is requested.
PublicKeyCredential.PublicKeyCredentialBuilder<R extends AuthenticatorResponse>
The `PublicKeyCredential.PublicKeyCredentialBuilder`
PublicKeyCredentialCreationOptions
Represents the PublicKeyCredentialCreationOptions which is an argument to creating a new credential.
PublicKeyCredentialCreationOptions.PublicKeyCredentialCreationOptionsBuilder
Used to build `PublicKeyCredentialCreationOptions`.
PublicKeyCredentialCreationOptionsFilter
A `Filter` that renders the `PublicKeyCredentialCreationOptions` for creating a new credential.
PublicKeyCredentialCreationOptionsRepository
Saves `PublicKeyCredentialCreationOptions` between a request to generate an assertion and the validation of the assertion.
PublicKeyCredentialCreationOptionsRequest
A request to create a new `PublicKeyCredentialCreationOptions`.
PublicKeyCredentialDescriptor
PublicKeyCredentialDescriptor identifies a specific public key credential.
PublicKeyCredentialDescriptor.PublicKeyCredentialDescriptorBuilder
Used to create `PublicKeyCredentialDescriptor`
PublicKeyCredentialParameters
The PublicKeyCredentialParameters is used to supply additional parameters when creating a new credential.
PublicKeyCredentialRequestOptions
PublicKeyCredentialRequestOptions contains the information to create an assertion used for authentication.
PublicKeyCredentialRequestOptions.PublicKeyCredentialRequestOptionsBuilder
Used to build a `PublicKeyCredentialCreationOptions`.
PublicKeyCredentialRequestOptionsFilter
A `Filter` that renders the `PublicKeyCredentialRequestOptions` in order to get a credential.
PublicKeyCredentialRequestOptionsRepository
Saves `PublicKeyCredentialRequestOptions` between a request to generate an assertion and the validation of the assertion.
PublicKeyCredentialRequestOptionsRequest
PublicKeyCredentialRpEntity
The PublicKeyCredentialRpEntity dictionary is used to supply additional Relying Party attributes when creating a new credential.
PublicKeyCredentialRpEntity.PublicKeyCredentialRpEntityBuilder
Used to create a `PublicKeyCredentialRpEntity`.
PublicKeyCredentialType
The PublicKeyCredentialType defines the credential types.
PublicKeyCredentialUserEntity
PublicKeyCredentialUserEntity is used to supply additional user account attributes when creating a new credential.
PublicKeyCredentialUserEntityRepository
A repository for managing `PublicKeyCredentialUserEntity` instances.
ReactivePreAuthenticatedAuthenticationManager
Reactive version of `PreAuthenticatedAuthenticationProvider` This manager receives a `PreAuthenticatedAuthenticationToken`, checks that associated account is not disabled, expired, or blocked, and returns new authenticated `PreAuthenticatedAuthenticationToken`.
ReactorContextWebFilter
Uses a `ServerSecurityContextRepository` to provide the `SecurityContext` to initialize the `ReactiveSecurityContextHolder`.
RedirectOneTimeTokenGenerationSuccessHandler
A `OneTimeTokenGenerationSuccessHandler` that performs a redirect to a specific location
RedirectServerAuthenticationEntryPoint
Performs a redirect to a specified location.
RedirectServerAuthenticationFailureHandler
Performs a redirect to a specified location.
RedirectServerAuthenticationSuccessHandler
Performs a redirect on authentication success.
RedirectServerLogoutSuccessHandler
Performs a redirect on log out success.
RedirectStrategy
Encapsulates the redirection logic for all classes in the framework which perform redirects.
RedirectUrlBuilder
Internal class for building redirect URLs.
ReferrerPolicyHeaderWriter
Provides support for Referrer Policy.
ReferrerPolicyHeaderWriter.ReferrerPolicy
ReferrerPolicyServerHttpHeadersWriter
Writes the `Referrer-Policy` response header.
ReferrerPolicyServerHttpHeadersWriter.ReferrerPolicy
RegExpAllowFromStrategy
Deprecated.
ALLOW-FROM is an obsolete directive that no longer works in modern browsers.
RegexRequestMatcher
Uses a regular expression to decide whether a supplied the URL of a supplied `HttpServletRequest`.
RegisterSessionAuthenticationStrategy
Strategy used to register a user with the `SessionRegistry` after successful `Authentication`.
RegisterSessionServerAuthenticationSuccessHandler
An implementation of `ServerAuthenticationSuccessHandler` that will register a `ReactiveSessionInformation` with the provided `ReactiveSessionRegistry`.
RelyingPartyAuthenticationRequest
The data object used to provide the information necessary to authenticate a user with WebAuthn.
RelyingPartyPublicKey
Submitted by a client to request registration of a new credential.
RelyingPartyRegistrationRequest
RememberMeAuthenticationException
This exception is thrown when an `Authentication` exception occurs while using the remember-me authentication.
RememberMeAuthenticationFilter
Detects if there is no `Authentication` object in the `SecurityContext`, and populates the context with a remember-me authentication token if a `RememberMeServices` implementation so requests.
RememberMeServices
Implement by a class that is capable of providing a remember-me service.
RequestAttributeAuthenticationFilter
A simple pre-authenticated filter which obtains the username from request attributes, for use with SSO systems such as Stanford WebAuth or Shibboleth.
RequestAttributeSecurityContextRepository
Stores the `SecurityContext` on a `ServletRequest.setAttribute(String, Object)` so that it can be restored when different dispatch types occur.
RequestAuthorizationContext
An `HttpServletRequest` authorization context.
RequestCache
Implements "saved request" logic, allowing a single request to be retrieved and restarted after redirecting to an authentication mechanism.
RequestCacheAwareFilter
Responsible for reconstituting the saved request if one is cached and it matches the current request.
RequestedUrlRedirectInvalidSessionStrategy
Performs a redirect to the original request URL when an invalid requested session is detected by the `SessionManagementFilter`.
RequestHeaderAuthenticationFilter
A simple pre-authenticated filter which obtains the username from a request header, for use with systems such as CA Siteminder.
RequestHeaderRequestMatcher
A `RequestMatcher` that can be used to match request that contain a header with an expected header name and an expected value.
RequestKey
RequestMatcher
Simple strategy to match an `HttpServletRequest`.
RequestMatcher.MatchResult
The result of matching against an HttpServletRequest Contains the status, true or false, of the match and if present, any variables extracted from the match
RequestMatcherDelegatingAccessDeniedHandler
An `AccessDeniedHandler` that delegates to other `AccessDeniedHandler` instances based upon the type of `HttpServletRequest` passed into `RequestMatcherDelegatingAccessDeniedHandler.handle(HttpServletRequest, HttpServletResponse, AccessDeniedException)`.
RequestMatcherDelegatingAuthenticationManagerResolver
An `AuthenticationManagerResolver` that returns a `AuthenticationManager` instances based upon the type of `HttpServletRequest` passed into `RequestMatcherDelegatingAuthenticationManagerResolver.resolve(HttpServletRequest)`.
RequestMatcherDelegatingAuthenticationManagerResolver.Builder
A builder for `RequestMatcherDelegatingAuthenticationManagerResolver`.
RequestMatcherDelegatingAuthorizationManager
An `AuthorizationManager` which delegates to a specific `AuthorizationManager` based on a `RequestMatcher` evaluation.
RequestMatcherDelegatingAuthorizationManager.Builder
A builder for `RequestMatcherDelegatingAuthorizationManager`.
RequestMatcherDelegatingWebInvocationPrivilegeEvaluator
A `WebInvocationPrivilegeEvaluator` which delegates to a list of `WebInvocationPrivilegeEvaluator` based on a `RequestMatcher` evaluation
RequestMatcherEditor
PropertyEditor which creates ELRequestMatcher instances from Strings This allows to use a String in a BeanDefinition instead of an (inner) bean if a RequestMatcher is required, e.g.
RequestMatcherEntry<T>
A rich object for associating a `RequestMatcher` to another object.
RequestMatcherRedirectFilter
Filter that redirects requests that match `RequestMatcher` to the specified URL.
RequestMatchers
A factory class to create `RequestMatcher` instances.
RequestRejectedException
RequestRejectedHandler
Used by `FilterChainProxy` to handle an `RequestRejectedException`.
RequestVariablesExtractor
Deprecated.
use `RequestMatcher.MatchResult` from `RequestMatcher.matcher(HttpServletRequest)`
ResidentKeyRequirement
The ResidentKeyRequirement describes the Relying Partys requirements for client-side discoverable credentials.
RetryWithHttpEntryPoint
Commences an insecure channel by retrying the original request using HTTP.
RetryWithHttpsEntryPoint
Commences a secure channel by retrying the original request using HTTPS.
SaveContextOnUpdateOrErrorResponseWrapper
Deprecated.
Use `SecurityContextRepository.loadDeferredContext(HttpServletRequest)` instead.
SavedCookie
Stores off the values of a cookie in a serializable holder
SavedRequest
Encapsulates the functionality required of a cached request for both an authentication mechanism (typically form-based login) to redirect to the original URL and for a `RequestCache` to build a wrapped request, reproducing the original request data.
SavedRequestAwareAuthenticationSuccessHandler
An authentication success strategy which can make use of the `DefaultSavedRequest` which may have been stored in the session by the `ExceptionTranslationFilter`.
SecureChannelProcessor
Ensures channel security is active by review of `HttpServletRequest.isSecure()` responses.
SecurityContextCallableProcessingInterceptor
Allows for integration with Spring MVC's `Callable` support.
SecurityContextHolderAwareRequestFilter
A `Filter` which populates the `ServletRequest` with a request wrapper which implements the servlet API security methods.
SecurityContextHolderAwareRequestWrapper
A Spring Security-aware `HttpServletRequestWrapper`, which uses the `SecurityContext`-defined `Authentication` object to implement the servlet API security methods: `SecurityContextHolderAwareRequestWrapper.getUserPrincipal()` `SecurityContextHolderAwareRequestWrapper.isUserInRole(String)` `HttpServletRequestWrapper.getRemoteUser()`.
SecurityContextHolderFilter
A `Filter` that uses the `SecurityContextRepository` to obtain the `SecurityContext` and set it on the `SecurityContextHolder`.
SecurityContextLogoutHandler
Performs a logout by modifying the `SecurityContextHolder`.
SecurityContextPersistenceFilter
Deprecated.
Use `SecurityContextHolderFilter`
SecurityContextRepository
Strategy used for persisting a `SecurityContext` between requests.
SecurityContextServerLogoutHandler
A `ServerLogoutHandler` which removes the SecurityContext using the provided `ServerSecurityContextRepository`
SecurityContextServerWebExchange
Overrides the `ServerWebExchange.getPrincipal()` with the provided SecurityContext
SecurityContextServerWebExchangeWebFilter
Override the `ServerWebExchange.getPrincipal()` to be looked up using `ReactiveSecurityContextHolder`.
SecurityFilterChain
Defines a filter chain which is capable of being matched against an `HttpServletRequest`.
SecurityHeaders
Utilities for interacting with `HttpHeaders`
SecurityWebApplicationContextUtils
Spring Security extension to Spring's `WebApplicationContextUtils`.
SecurityWebFilterChain
Defines a filter chain which is capable of being matched against a `ServerWebExchange` in order to decide whether it applies to that request.
ServerAccessDeniedHandler
ServerAuthenticationConverter
A strategy used for converting from a `ServerWebExchange` to an `Authentication` used for authenticating with a provided `ReactiveAuthenticationManager`.
ServerAuthenticationEntryPoint
Used to request authentication
ServerAuthenticationEntryPointFailureHandler
Adapts a `ServerAuthenticationEntryPoint` into a `ServerAuthenticationFailureHandler`
ServerAuthenticationFailureHandler
Handles authentication failure
ServerAuthenticationSuccessHandler
Handles authentication success
ServerCsrfTokenRepository
An API to allow changing the method in which the expected `CsrfToken` is associated to the `ServerWebExchange`.
ServerCsrfTokenRequestAttributeHandler
An implementation of the `ServerCsrfTokenRequestHandler` interface that is capable of making the `CsrfToken` available as an exchange attribute and resolving the token value as either a form data value or header of the request.
ServerCsrfTokenRequestHandler
A callback interface that is used to make the `CsrfToken` created by the `ServerCsrfTokenRepository` available as an exchange attribute.
ServerCsrfTokenRequestResolver
Implementations of this interface are capable of resolving the token value of a `CsrfToken` from the provided `ServerWebExchange`.
ServerExchangeRejectedException
Thrown when a `ServerWebExchange` is rejected.
ServerExchangeRejectedHandler
Handles `ServerExchangeRejectedException` thrown by `ServerWebExchangeFirewall`.
ServerFormLoginAuthenticationConverter
Converts a ServerWebExchange into a UsernamePasswordAuthenticationToken from the form data HTTP parameters.
ServerFormLoginAuthenticationConverter
Deprecated.
use `ServerFormLoginAuthenticationConverter` instead.
ServerHttpBasicAuthenticationConverter
Converts from a `ServerWebExchange` to an `Authentication` that can be authenticated.
ServerHttpBasicAuthenticationConverter
Deprecated.
Use `ServerHttpBasicAuthenticationConverter` instead.
ServerHttpHeadersWriter
Interface for writing headers just before the response is committed.
ServerLogoutHandler
Handles log out
ServerLogoutSuccessHandler
Strategy for when log out was successfully performed (typically after `ServerLogoutHandler` is invoked).
ServerMaximumSessionsExceededHandler
Strategy for handling the scenario when the maximum number of sessions for a user has been reached.
ServerOneTimeTokenAuthenticationConverter
An implementation of `ServerAuthenticationConverter` for resolving `OneTimeTokenAuthenticationToken` from token parameter.
ServerOneTimeTokenGenerationSuccessHandler
Defines a reactive strategy to handle generated one-time tokens.
ServerRedirectOneTimeTokenGenerationSuccessHandler
A `ServerOneTimeTokenGenerationSuccessHandler` that performs a redirect to a specific location
ServerRedirectStrategy
A strategy for performing redirects.
ServerRequestCache
Saves a `ServerHttpRequest` so it can be "replayed" later.
ServerRequestCacheWebFilter
A `WebFilter` that replays any matching request in `ServerRequestCache`
ServerSecurityContextRepository
Strategy used for persisting a `SecurityContext` between requests.
ServerWebExchangeDelegatingReactiveAuthenticationManagerResolver
A `ReactiveAuthenticationManagerResolver` that returns a `ReactiveAuthenticationManager` instances based upon the type of `ServerWebExchange` passed into `ServerWebExchangeDelegatingReactiveAuthenticationManagerResolver.resolve(ServerWebExchange)`.
ServerWebExchangeDelegatingReactiveAuthenticationManagerResolver.Builder
A builder for `ServerWebExchangeDelegatingReactiveAuthenticationManagerResolver`.
ServerWebExchangeDelegatingServerAccessDeniedHandler
A `ServerAccessDeniedHandler` which delegates to multiple `ServerAccessDeniedHandler`s based on a `ServerWebExchangeMatcher`
ServerWebExchangeDelegatingServerAccessDeniedHandler.DelegateEntry
ServerWebExchangeDelegatingServerHttpHeadersWriter
Delegates to a provided `ServerHttpHeadersWriter` if `ServerWebExchangeMatcher.matches(ServerWebExchange)` returns a match.
ServerWebExchangeFirewall
Interface which can be used to reject potentially dangerous requests and/or wrap them to control their behaviour.
ServerWebExchangeMatcher
An interface for determining if a `ServerWebExchangeMatcher` matches.
ServerWebExchangeMatcher.MatchResult
The result of matching
ServerWebExchangeMatcherEntry<T>
A rich object for associating a `ServerWebExchangeMatcher` to another object.
ServerWebExchangeMatchers
Provides factory methods for creating common `ServerWebExchangeMatcher`
ServerX509AuthenticationConverter
Converts from a `SslInfo` provided by a request to an `PreAuthenticatedAuthenticationToken` that can be authenticated.
SessionAuthenticationException
Thrown by an `SessionAuthenticationStrategy` or `ServerSessionAuthenticationStrategy` to indicate that an authentication object is not valid for the current session, typically because the same user has exceeded the number of sessions they are allowed to have concurrently.
SessionAuthenticationStrategy
Allows pluggable support for HttpSession-related behaviour when an authentication occurs.
SessionFixationProtectionEvent
Indicates a session ID was changed for the purposes of session fixation protection.
SessionFixationProtectionStrategy
Uses `HttpServletRequest.invalidate()` to protect against session fixation attacks.
SessionInformationExpiredEvent
An event for when a `SessionInformation` is expired.
SessionInformationExpiredStrategy
Determines the behaviour of the `ConcurrentSessionFilter` when an expired session is detected in the `ConcurrentSessionFilter`.
SessionLimit
Represents the maximum number of sessions allowed.
SessionManagementFilter
Detects that a user has been authenticated since the start of the request and, if they have, calls the configured `SessionAuthenticationStrategy` to perform any session-related activity such as activating session-fixation protection mechanisms or checking for multiple concurrent logins.
SimpleRedirectInvalidSessionStrategy
Performs a redirect to a fixed URL when an invalid requested session is detected by the `SessionManagementFilter`.
SimpleRedirectSessionInformationExpiredStrategy
Performs a redirect to a fixed URL when an expired session is detected by the `ConcurrentSessionFilter`.
SimpleSavedRequest
A Bean implementation of SavedRequest
SimpleUrlAuthenticationFailureHandler
`AuthenticationFailureHandler` which performs a redirect to the value of the `defaultFailureUrl` property when the `onAuthenticationFailure` method is called.
SimpleUrlAuthenticationSuccessHandler
`AuthenticationSuccessHandler` which can be configured with a default URL which users should be sent to upon successful authentication.
SimpleUrlLogoutSuccessHandler
Handles the navigation on logout by delegating to the `AbstractAuthenticationTargetUrlRequestHandler` base class logic.
StaticAllowFromStrategy
Deprecated.
ALLOW-FROM is an obsolete directive that no longer works in modern browsers.
StaticHeadersWriter
`HeaderWriter` implementation which writes the same `Header` instance.
StaticServerHttpHeadersWriter
Allows specifying `HttpHeaders` that should be written to the response.
StaticServerHttpHeadersWriter.Builder
StrictHttpFirewall
A strict implementation of `HttpFirewall` that rejects any suspicious requests with a `RequestRejectedException`.
StrictServerWebExchangeFirewall
A strict implementation of `ServerWebExchangeFirewall` that rejects any suspicious requests with a `ServerExchangeRejectedException`.
StrictTransportSecurityServerHttpHeadersWriter
Writes the Strict-Transport-Security if the request is secure.
SubjectDnX509PrincipalExtractor
Obtains the principal from a certificate using a regular expression match against the Subject (as returned by a call to `X509Certificate.getSubjectDN()`).
SwitchUserAuthorityChanger
Allows subclasses to modify the `GrantedAuthority` list that will be assigned to the principal when they assume the identity of a different principal.
SwitchUserFilter
Switch User processing filter responsible for user context switching.
SwitchUserGrantedAuthority
Custom `GrantedAuthority` used by `SwitchUserFilter`
SwitchUserWebFilter
Switch User processing filter responsible for user context switching.
TextEscapeUtils
Internal utility for escaping characters in HTML strings.
ThrowableAnalyzer
Handler for analyzing `Throwable` instances.
ThrowableCauseExtractor
Interface for handlers extracting the cause out of a specific `Throwable` type.
TokenBasedRememberMeServices
Identifies previously remembered users by a Base-64 encoded cookie.
TokenBasedRememberMeServices.RememberMeTokenAlgorithm
UrlUtils
Provides static methods for composing URLs.
UserCredentialRepository
A repository for managing `CredentialRecord`s associated to a user.
UsernamePasswordAuthenticationFilter
Processes an authentication form submission.
UserVerificationRequirement
UserVerificationRequirement is used by the Relying Party to indicate if user verification is needed.
WebAsyncManagerIntegrationFilter
Provides integration between the `SecurityContext` and Spring Web's `WebAsyncManager` by using the `SecurityContextCallableProcessingInterceptor.beforeConcurrentHandling(org.springframework.web.context.request.NativeWebRequest, Callable)` to populate the `SecurityContext` on the `Callable`.
WebAttributes
Well-known keys which are used to store Spring Security information in request or session scope.
WebAuthenticationDetails
A holder of selected HTTP details related to a web authentication request.
WebAuthenticationDetailsSource
Implementation of `AuthenticationDetailsSource` which builds the details object from an `HttpServletRequest` object, creating a `WebAuthenticationDetails` .
Webauthn4JRelyingPartyOperations
A WebAuthn4j implementation of `WebAuthnRelyingPartyOperations`.
WebAuthnAuthentication
A `WebAuthnAuthentication` is used to represent successful authentication with WebAuthn.
WebAuthnAuthenticationFilter
Authenticates `PublicKeyCredential<AuthenticatorAssertionResponse>` that is parsed from the body of the `HttpServletRequest` using the `WebAuthnAuthenticationFilter.setConverter(GenericHttpMessageConverter)`.
WebAuthnAuthenticationProvider
An `AuthenticationProvider` that uses `WebAuthnRelyingPartyOperations` for authentication using an `WebAuthnAuthenticationRequestToken`.
WebAuthnAuthenticationRequestToken
An `Authentication` used in `WebAuthnAuthenticationProvider` for authenticating via WebAuthn.
WebauthnJackson2Module
Adds Jackson support for Spring Security WebAuthn.
WebAuthnRegistrationFilter
Authenticates `PublicKeyCredential<AuthenticatorAssertionResponse>` that is parsed from the body of the `HttpServletRequest` using the `WebAuthnRegistrationFilter.setConverter(HttpMessageConverter)`.
WebAuthnRegistrationFilter.SuccessfulUserRegistrationResponse
WebAuthnRelyingPartyOperations
An API for WebAuthn Relying Party Operations
WebExpressionAuthorizationManager
An expression-based `AuthorizationManager` that determines the access by evaluating the provided expression.
WebExpressionVoter
Deprecated.
Use `WebExpressionAuthorizationManager` instead
WebFilterChainProxy
Used to delegate to a List of `SecurityWebFilterChain` instances.
WebFilterChainProxy.DefaultWebFilterChainDecorator
A `WebFilterChainProxy.WebFilterChainDecorator` that uses the `DefaultWebFilterChain`
WebFilterChainProxy.WebFilterChainDecorator
A strategy for decorating the provided filter chain with one that accounts for the `SecurityFilterChain` for a given request.
WebFilterChainServerAuthenticationSuccessHandler
Success handler that continues the filter chain after authentication success.
WebFilterExchange
A composite of the `ServerWebExchange` and the `WebFilterChain`.
WebInvocationPrivilegeEvaluator
Allows users to determine whether they have privileges for a given web URI.
WebJackson2Module
Jackson module for spring-security-web.
WebSecurityExpressionRoot
WebServerJackson2Module
Jackson module for spring-security-web-flux.
WebServletJackson2Module
Jackson module for spring-security-web related to servlet.
WebSessionServerCsrfTokenRepository
A `ServerCsrfTokenRepository` that stores the `CsrfToken` in the `HttpSession`.
WebSessionServerLogoutHandler
A `ServerLogoutHandler` which invalidates the active `WebSession`.
WebSessionServerRequestCache
An implementation of `ServerRequestCache` that saves the `ServerHttpRequest` in the `WebSession`.
WebSessionServerSecurityContextRepository
Stores the `SecurityContext` in the `WebSession`.
WebSpherePreAuthenticatedProcessingFilter
This AbstractPreAuthenticatedProcessingFilter implementation is based on WebSphere authentication.
WebSpherePreAuthenticatedWebAuthenticationDetailsSource
This AuthenticationDetailsSource implementation will set the pre-authenticated granted authorities based on the WebSphere groups for the current WebSphere user, mapped using the configured Attributes2GrantedAuthoritiesMapper.
WebXmlMappableAttributesRetriever
This `MappableAttributesRetriever` implementation reads the list of defined J2EE roles from a `web.xml` file and returns these from { `WebXmlMappableAttributesRetriever.getMappableAttributes()`.
WhiteListedAllowFromStrategy
Deprecated.
ALLOW-FROM is an obsolete directive that no longer works in modern browsers.
X509AuthenticationFilter
X509PrincipalExtractor
Obtains the principal from an X509Certificate for use within the framework.
XContentTypeOptionsHeaderWriter
A `StaticHeadersWriter` that inserts headers to prevent content sniffing.
XContentTypeOptionsServerHttpHeadersWriter
Adds X-Content-Type-Options: nosniff
XFrameOptionsHeaderWriter
`HeaderWriter` implementation for the X-Frame-Options headers.
XFrameOptionsHeaderWriter.XFrameOptionsMode
The possible values for the X-Frame-Options header.
XFrameOptionsServerHttpHeadersWriter
`ServerHttpHeadersWriter` implementation for the X-Frame-Options headers.
XFrameOptionsServerHttpHeadersWriter.Mode
The X-Frame-Options values.
XorCsrfTokenRequestAttributeHandler
An implementation of the `CsrfTokenRequestHandler` interface that is capable of masking the value of the `CsrfToken` on each request and resolving the raw token value from the masked value as either a header or parameter value of the request.
XorServerCsrfTokenRequestAttributeHandler
An implementation of the `ServerCsrfTokenRequestAttributeHandler` and `ServerCsrfTokenRequestResolver` interfaces that is capable of masking the value of the `CsrfToken` on each request and resolving the raw token value from the masked value as either a form data value or header of the request.
XXssProtectionHeaderWriter
Renders the X-XSS-Protection header.
XXssProtectionHeaderWriter.HeaderValue
The value of the x-xss-protection header.
XXssProtectionServerHttpHeadersWriter
Add the x-xss-protection header.
XXssProtectionServerHttpHeadersWriter.HeaderValue
The value of the x-xss-protection header.