Security: full RFC 9700 / OAuth 2.1 + Spring Security parity (audit remediation)#150

Merged

ancongui merged 12 commits into

mainfrom

fix/security-high-severity-rfc9700

Jun 26, 2026

Commits on Jun 25, 2026

feat(security): RFC 9700 / OAuth 2.1 hardening + Spring-parity (PKCE, ROPC, CSRF, encoders, HTTP Basic)
ancongui
committed
feat(security): RFC 9207 iss validation, refresh-token reuse detection, asymmetric AS signing + JWKS
ancongui
committed
feat(security): OAuth2 introspection (7662), revocation (7009), HTTP endpoints + OpaqueTokenIntrospector
ancongui
committed
fix(security): scope introspection/revocation to the owning client; reject empty client auth
ancongui
committed
feat(security): DPoP (RFC 9449) + mTLS (RFC 8705) sender-constrained tokens — AS binding + RS enforcement
ancongui
committed
feat(security): AuthenticationManager SPI, PermissionEvaluator, @pre_filter/@post_filter
ancongui
committed
feat(security): form login + generic logout filters with config-driven auto-config
ancongui
committed