v2.0.1

⚠ Breaking

⭐ New Features

🐞 Bugs Fixed

• removed usage of org.springframework.util.Base64Utils since it is deprecated now
• cookie value was not url-decoded (fixes #30)

v2.0.0

⚠ Breaking

• requires Spring Security 6.0+
• requires Jakarta Servlet™ 6.0 / Jakarta EE 9+ (jakarta.* Namespace)
• requires Java 17+

⭐ New Features

🐞 Bugs Fixed

v1.1.1

⚠ Breaking

⭐ New Features

🐞 Bugs Fixed

• fixed maven warning

The POM for de.sephiroth-j:spring-security-ltpa2:jar:1.1.0 is invalid, transitive dependencies (if any) will not be available, enable debug logging for more details

v1.1.0

⚠ Breaking

⭐ New Features

• Allow to change the default behaviour when an authentication failure occurs (Web Servlet only) (fixes #3)
• Ltpa2Configurer will now also find its UserDetailsService if it was provided as a bean

🐞 Bugs Fixed

• do not expose reason of the AuthenticationException as response message when authentication failed (Web Servlet only)

v1.0.0

Changes:

Features/New

• Support the Reactive Stack with Ltpa2AuthConverter and Ltpa2AuthManager
  check the README for the details
• Emit a warning when allowExpiredToken is enabled.

Breaking

• Spring Security 5.1 is at least required
• Ltpa2Filter will now return FORBIDDEN instead of UNAUTHORIZED when there was a problem with the token or the user was not found.
  This corresponds more to the HTTP specification and matches the default behavior when no token was given at all.
• The dependencies on Spring Security and slf4j-api are no longer optional - only reactor-core is optional as it is only required for the reactive stack.

v0.2.3

This is probably the last 0.2 release! The next release will be 1.0 with Web Reactive support.

Changes:

• made most of the methods in Ltpa2Utils public
• fix: Ltpa2Configurer did not call afterPropertiesSet on the Ltpa2Filter instance after all properties where set which could lead to runtime errors
• other smaller fixes and increased test coverage

v0.2.2

only internal changes, such as:

• replaced lombok.NonNull with org.springframework.lang.NonNull
• ensure "expire" and "user" attributes are not empty when set

v0.2.1

This release fixes an issue with different timezones when converting the expire attribute from unix timestamp to LocalDateTime and back.