feat(security): Spring Security 6 parity — Tier 0 hardening + passwordless (26.6.29)#37

Merged

ancongui merged 12 commits into

mainfrom

feat/spring-security-tier0-hardening

Jun 18, 2026

Commits on Jun 18, 2026

fix(security): Tier 0 auth-core hardening (H1/H2/H14)

Andrés Contreras Guillén
authored and
Andrés Contreras Guillén
committed
fix(security): Tier 0 filter-chain hardening (H3/H10)

Andrés Contreras Guillén
authored and
Andrés Contreras Guillén
committed
feat(security): Tier 0 JWT/JWKS/bearer hardening (H5/H6/H7/H8)

Andrés Contreras Guillén
authored and
Andrés Contreras Guillén
committed
fix(web,security): Tier 0 web-layer hardening (H4/H9/H11)
Andres Contreras
committed
fix(session-postgres,idp): Tier 0 store hardening (H12/H13)
Andres Contreras
committed
feat(security): one-time-token (magic-link) login — Spring 6.4 oneTimeTokenLogin()
Andres Contreras
committed
docs(book): add the 'Spring Security Parity' appendix (EN + ES)
Andres Contreras
committed
feat(security): WebAuthn / passkey login — Spring 6.4 webAuthn() (feature-gated)
Andres Contreras
committed
feat(security): wire configurable JWT clock-skew through SecurityProperties (Batch 6)
Andres Contreras
committed
fix(security,web,session-postgres): address adversarial review findings
Andres Contreras
committed
chore(release): 26.6.29 — Spring Security 6 parity (Tier 0)
Andres Contreras
committed
docs(security): document the parity work across the book, README & MODULES
Andres Contreras
committed