Spring Security 3.2.1 (changelog) and 3.1.5 (changelog) have been released and are now available from Maven Central.

Spring Security 3.2.1 brings a number of bug fixes including

• fixing ordering issues with Java Configuration
• changes to support Spring LDAP 2.0.1.RELEASE

I'm pleased to announce the release of Spring LDAP 2.0.1. This release can be found in Maven Central and contains a number of bug fixes including a fix to work with Spring Security 3.2. For additional details, please see the changelog.

Introduction

Developers often incorrectly use encryption in an attempt to provide authenticity. For example, a RESTful application may mistakenly use an encrypted cookie to embed the current user's identity.

The mistake is that encryption can only be used to keep a secret while signing is used to verify authenticity of a message. In this post, I will explain and provide an example of why encryption is not a guarantee of authenticity.

If you just want to see code, feel free to skip to the end which has a sample Java application that demonstrates the exploit.

Encrypted Cookies (whoops)

Assume we…

I'm pleased to announce that Spring LDAP 2.0.0.RELEASE is now available from Maven Central and Bintray. A special thanks to Mattias Arthursson for all the work he put into this release!

Refer to the What's new in Spring LDAP 2.0 to find the full details of this release. A list of changes can be found within JIRA's change logs. Highlights include:

• Spring Data Repository and QueryDSL support is now included in Spring LDAP.
• Fluent LDAP query support has been added.
• A custom XML namespace is now provided to simplify configuration of Spring LDAP.
• Spring LDAP core has been updated with Java 5 features such as generics and varargs.
• The ODM (Object-Directory Mapping) functionality has been moved to core and there are new methods in LdapOperations/LdapTemplate that uses this automatic translation to/from ODM-annotated classes.
…

I am pleased to announce the release of Spring Security 3.2.0.RELEASE. You can view the highlights of this release within the What’s new in Spring Security 3.2 section of the reference. A list of changes since 3.1.x and since the last release can be found within JIRA's change logs.

To learn more about Spring Security 3.2, I'd like to encourage you to view the new Spring Security guides and to attend the free Spring Security 3.2 Webniar on January 16th.

Please consider helping us spread the word on Twitter, ask questions on Stackoverflow with the spring-security tag and log any issues to the Spring Security JIRA…

Spring Security 3.2.0.RC2 is now available from the SpringSource repository at http://repo.springsource.org. See here for a quick tutorial on resolving these artifacts via Maven.

What's new?

The release resolves 80+ issues. Most of the issues for this release were fixing bug, adding documentation, and converting our documentation to Asciidoctor.

Refer to the recently added What's new in Spring Security 3.2 to find all the highlights of this release. You will notice there are some nice features that have been added that I have not blogged about. Be sure to follow the links to see and links to…

I'm pleased to announce that Spring LDAP 2.0.0.M1 is now available from the SpringSource repository at http://repo.springsource.org. See here for a quick tutorial on resolving these artifacts via Maven.

What's New?

The release adds lots of new functionality! Some of the highlights can be found below:

• Spring Data Repository and QueryDSL support is now included in Spring LDAP.
• Fluent LDAP query support has been added.
• A custom XML namespace is now provided to simplify configuration of Spring LDAP.
• Spring LDAP core has been updated with Java 5 features such as generics and varargs.
• The ODM (Object-Directory Mapping) functionality has been moved to core and there are new methods in LdapOperations/LdapTemplate that uses this automatic translation to/from ODM-annotated classes.
…

Spring Security 3.2.0.RC1 is now available from the SpringSource repository at http://repo.springsource.org. See here for a quick tutorial on resolving these artifacts via Maven.

This release includes tons of updates and fixes. The highlights include:

Refer to Spring Security 3.2.0.RC1 preview for more details about this release.

SpringOne2GX

To learn about all the new features within Spring Security 3.2 attend my Getting Started with Spring Security 3.2 presentation at SpringOne2GX September 9-12, 2013. If you haven't already gotten your tickets, do so now before its too late!

Changelog | Download | Reference Manual | Guides | FAQ

It is with great pleasure that I am announcing the release of Spring LDAP 1.3.2. This release contains lots of bug fixes and will provide a solid foundation for a Spring LDAP 2.0 release.

I'd like to thank Mattias Arthursson from 261 Consulting for all his hard work on this release.

UPDATE

NOTE This blog post is no longer maintained. Refer to the Headers documentation for up to date information about Spring Security's Headers.

Original Article

This is my last post in a two part series on Spring Security 3.2.0.RC1. My previous post discussed Spring Security's CSRF protection. In this post we will discuss how to use Spring Security to add various response headers to help secure your application.

Security Headers

Many of the new Spring Security features in 3.2.0.RC1 are implemented by adding headers to the response. The foundation for these features came from hard work from Marten Deinum. If the name sounds familiar, it may because one of his 10K+ posts on the Spring Forums has helped you out.

If you are using XML configuration, you can add all of the default headers using Spring Security's element with no child elements to add all the default headers to the response:

<http ...>
    ...
    <headers />
</http>

If you are using Spring Security's Java configuration, all of the default security headers are added by default. They can be disabled using the Java configuration below:

@Override protected void configure(HttpSecurity http) throws Exception { http .headers().disable() ...; } }

<p>The remainder of this post will discuss each of the default headers in more detail:</p>
<ul>
<li><a href="#cache-control">Cache Control</a></li>
<li><a href="#content-type-options">Content Type Options</a></li>
<li><a href="#hsts">HTTP Strict Transport Security</a…