You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/modules/ROOT/pages/migration.adoc
+14Lines changed: 14 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -6,6 +6,20 @@ Use 5.8 and the steps below to minimize changes when updating to 6.0.
6
6
7
7
== Servlet
8
8
9
+
[[requestcache-query-optimization]]
10
+
=== Optimize Querying of `RequestCache`
11
+
12
+
In Spring Security 5, the default behavior is to query the xref:servlet/architecture.adoc#savedrequests[saved request] on every request.
13
+
This means that in a typical setup, that in order to use the xref:servlet/architecture.adoc#requestcache[`RequestCache`] the `HttpSession` is queried on every request.
14
+
15
+
In Spring Security 6, the default is that `RequestCache` will only be queried for a cached request if the HTTP parameter `continue` is defined.
16
+
This allows Spring Security to avoid unnecessarily reading the `HttpSession` with the `RequestCache`.
17
+
18
+
In Spring Security 5 the default is to use `HttpSessionRequestCache` which will be queried for a cached request on every request.
19
+
If you are not overriding the defaults (i.e. using `NullRequestCache`), then the following configuration can be used to explicitly opt into the Spring Security 6 behavior in Spring Security 5.8:
=== Use `AuthorizationManager` for Method Security
10
24
11
25
xref:servlet/authorization/method-security.adoc[Method Security] has been xref:servlet/authorization/method-security.adoc#jc-enable-method-security[simplified] through {security-api-url}org/springframework/security/authorization/AuthorizationManager.html[the `AuthorizationManager` API] and direct use of Spring AOP.
0 commit comments