Spring / Spring Security
Difference between Spring Security 5 and 6.
Spring Security 6 (shipped with Spring Boot 3) represents a significant modernization of the framework, removing long-deprecated APIs and enforcing more secure defaults.
Note: Most changes in version 6 are designed to support Jakarta EE 9/10 and Java 17+.
1. Fundamental Baseline Changes
- Java Version: Minimum requirement moved from Java 8/11 to Java 17.
- Jakarta Migration: All
javax.*imports (Servlets, Persistence) have been replaced byjakarta.*.
2. Configuration Overhaul
The most noticeable change for developers is the removal of the old configuration style.
| Feature | Spring Security 5 | Spring Security 6 |
|---|---|---|
| Setup Method | Extending WebSecurityConfigurerAdapter |
Component-based (Bean-based) configuration |
| Request Matchers | antMatchers(), mvcMatchers() |
Unified requestMatchers() |
| HTTP Authorization | authorizeRequests() |
authorizeHttpRequests() |
| Method Security | @EnableGlobalMethodSecurity |
@EnableMethodSecurity |
3. Lambda DSL Requirement
Spring Security 6 forces the use of the Lambda DSL to make configurations more readable and less prone to order-dependent errors.
Spring Security 6 Example:
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.csrf(csrf -> csrf.disable())
.authorizeHttpRequests(auth -> auth
.requestMatchers("/api/public/**").permitAll()
.anyRequest().authenticated()
);
return http.build();
}
4. Security Hardening & Observability
- Default Denial: In version 6, if a request does not match an explicit rule, it is denied by default (Defense-in-depth).
- Lazy CSRF Tokens: CSRF tokens are no longer loaded on every request by default, which is better for performance in stateless applications.
- Micrometer Support: Integrated observability for tracking security metrics and traces.
More Related questions...
