InfoQ Homepage Spring Security Content on InfoQ
Articles
RSS Feed-
/articles/spring-security-7-server-side-dpop-token-exchange/en/smallimage/spring-security-7-server-side-dpop-token-exchange-thumbnail-1791884636157.jpg)
Server-Side DPoP and Token Exchange in Spring Security 7
Spring Authorization Server now lives inside Spring Security 7 under the same Maven coordinates, so the upgrade is a version bump. This server-side guide covers enabling DPoP and RFC 8693 Token Exchange, explains why 7.1 apps can silently stop enforcing DPoP until they call .dPoP(), and shows how to combine both into narrowed, sender-constrained tokens for service-to-service and agentic calls.
-
/articles/pqc-in-spring-boot/en/smallimage/pqc-in-spring-boot-thumbnail-1787646727709.jpg)
Post-Quantum Cryptography in Spring Boot: Four Patterns You Can Ship This Sprint
There are four patterns that bring PQC into a Spring Boot fleet: encrypting payloads between services, locking down database fields, signing documents that need to hold up for decades, and moving service tokens off RS256. Along the way, we discuss why Harvest Now, Decrypt Later is already happening, and why none of this is production-safe until KMS or Vault is in place.
-
/articles/spring-security-flow-diagrams/en/smallimage/spring-security-flow-charts-logo-small-1736840721928.jpg)
Spring Security Configuration with Flow Diagrams
In modern Java systems, Spring Security is widely used, offering numerous settings for various scenarios. This diversity can be confusing when more specific configurations beyond the default formLogin(withDefaults()) are needed. This article demonstrates basic configurations with detailed component analysis through diagrams and code examples, providing a starting point for further customization.