[[new]]
== What's New in Spring Security 5.1

Spring Security 5.1 provides a number of new features.
Below are the highlights of the release.

=== Servlet

* Automatic password storage upgrades through {security-api-url}org/springframework/security/core/userdetails/UserDetailsPasswordService.html[UserDetailsPasswordService]
* {gh-samples-url}/boot/oauth2webclient[OAuth 2.0 Client]
** Customizable Authorize and Token requests
** `authorization_code` grant support
** `client_credentials` grant support
* OAuth 2.0 Resource Server - support for {gh-samples-url}/boot/oauth2resourceserver[JWT-encoded bearer tokens]
* Added OAuth2 <<servlet-webclient,WebClient>> integration
* <<request-matching,HTTP Firewall>> protects against HTTP Verb Tampering and Cross-site Tracing
* <<exception-translation-filter,ExceptionTranslationFilter>> support for selecting an `AccessDeniedHandler` by `RequestMatcher`
* <<csrf,CSRF>> support for excluding certain requests
* Added Support for <<headers-feature,Feature Policy>>
* Added {security-api-url}org/springframework/security/core/Transient.html[@Transient] authentication tokens
* A modern look-and-feel for the default log in page

=== WebFlux

* Automatic password storage upgrades through {security-api-url}org/springframework/security/core/userdetails/ReactiveUserDetailsPasswordService.html[ReactiveUserDetailsPasswordService]
* Added <<webflux-oauth2,OAuth2>> support
** Added <<webflux-oauth2-client,OAuth2 Client>> support
** Added <<webflux-oauth2-resource-server,OAuth2 Resource Server>> support
** Added OAuth2 <<webclient,WebClient>> integration
* `@WithUserDetails` <<test-method-withuserdetails,now works>> with `ReactiveUserDetailsService`
* Added <<webflux-cors,CORS>> support
* Added support for the following <<webflux-headers,HTTP headers>>
** <<webflux-headers-csp,Content Security Policy>>
** <<webflux-headers-feature,Feature Policy>>
** <<webflux-headers-referrer,Referrer Policy>>
* <<webflux-redirect-https,Redirect to HTTPS>>
* Improvements for {security-api-url}org/springframework/security/core/annotation/AuthenticationPrincipal.html[@AuthenticationPrincipal]
** Support for resolving beans
** Support for resolving `errorOnInvalidType`

=== Integrations

* <<jackson,Jackson Support>> works with `BadCredentialsException`
* `@WithMockUser` <<test-method-withmockuser,supports>> customizing when the `SecurityContext` is setup in the test.
For example, `@WithMockUser(setupBefore = TestExecutionEvent.TEST_EXECUTION)` will setup a user after JUnit's `@Before` and before the test executes.
* <<ldap,LDAP Authentication>> can be configured with custom environment variables
* <<x509,X.509 Authentication>> supports deriving the principal as a strategy



