Skip to content

Commit 24cc7ff

Browse files
committed
Document Saved Requests Migration
Closes gh-12089
1 parent c17e258 commit 24cc7ff

File tree

1 file changed

+14
-0
lines changed

1 file changed

+14
-0
lines changed

docs/modules/ROOT/pages/migration.adoc

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,20 @@ Use 5.8 and the steps below to minimize changes when updating to 6.0.
66

77
== Servlet
88

9+
[[requestcache-query-optimization]]
10+
=== Optimize Querying of `RequestCache`
11+
12+
In Spring Security 5, the default behavior is to query the xref:servlet/architecture.adoc#savedrequests[saved request] on every request.
13+
This means that in a typical setup, that in order to use the xref:servlet/architecture.adoc#requestcache[`RequestCache`] the `HttpSession` is queried on every request.
14+
15+
In Spring Security 6, the default is that `RequestCache` will only be queried for a cached request if the HTTP parameter `continue` is defined.
16+
This allows Spring Security to avoid unnecessarily reading the `HttpSession` with the `RequestCache`.
17+
18+
In Spring Security 5 the default is to use `HttpSessionRequestCache` which will be queried for a cached request on every request.
19+
If you are not overriding the defaults (i.e. using `NullRequestCache`), then the following configuration can be used to explicitly opt into the Spring Security 6 behavior in Spring Security 5.8:
20+
21+
include::partial$servlet/architecture/request-cache-continue.adoc[]
22+
923
=== Use `AuthorizationManager` for Method Security
1024

1125
xref:servlet/authorization/method-security.adoc[Method Security] has been xref:servlet/authorization/method-security.adoc#jc-enable-method-security[simplified] through {security-api-url}org/springframework/security/authorization/AuthorizationManager.html[the `AuthorizationManager` API] and direct use of Spring AOP.

0 commit comments

Comments
 (0)