|
| 1 | +# Changelog |
| 2 | + |
| 3 | +## [1.0.0-beta.0](https://github.com/auth0/auth0-auth-java/tree/1.0.0-beta.0) (2026-03-02) |
| 4 | + |
| 5 | +### Features |
| 6 | + |
| 7 | +- **JWT Bearer Authentication** - Complete Spring Security integration for validating Auth0-issued JWTs. |
| 8 | +- **DPoP (Demonstration of Proof-of-Possession) Support** - Built-in support for DPoP token security per [RFC 9449](https://datatracker.ietf.org/doc/html/rfc9449), including proof validation, token binding, and JWK thumbprint verification. |
| 9 | +- **Flexible Authentication Modes** - Configure how your API handles token types: |
| 10 | + - `DISABLED` - Accept Bearer tokens only. |
| 11 | + - `ALLOWED` - Accept both Bearer and DPoP tokens (default). |
| 12 | + - `REQUIRED` - Enforce DPoP tokens only. |
| 13 | +- **Scope-Based Authorization** - Derive Spring Security authorities from JWT scopes with `SCOPE_` prefix for use with `hasAuthority()`. |
| 14 | +- **Custom Claim Access** - Access any JWT claim via `Auth0AuthenticationToken.getClaim(name)` and `getClaims()`. |
| 15 | +- **Auto-Configuration** - Minimal setup required; just provide `auth0.domain` and `auth0.audience` properties. |
| 16 | +- **WWW-Authenticate Header Generation** - Automatic RFC-compliant error response headers for Bearer and DPoP challenges. |
| 17 | +- **Java 8+ Core Module** - The underlying `auth0-api-java` module targets Java 8, enabling use in non-Spring environments. |
| 18 | + |
| 19 | +### Installation |
| 20 | + |
| 21 | +**Gradle** |
| 22 | + |
| 23 | +```groovy |
| 24 | +implementation 'com.auth0:auth0-springboot-api:1.0.0-beta.0' |
| 25 | +``` |
| 26 | + |
| 27 | +**Maven** |
| 28 | + |
| 29 | +```xml |
| 30 | +<dependency> |
| 31 | + <groupId>com.auth0</groupId> |
| 32 | + <artifactId>auth0-springboot-api</artifactId> |
| 33 | + <version>1.0.0-beta.0</version> |
| 34 | +</dependency> |
| 35 | +``` |
| 36 | + |
| 37 | +### Basic Usage |
| 38 | + |
| 39 | +**1. Add application properties:** |
| 40 | + |
| 41 | +```yaml |
| 42 | +auth0: |
| 43 | + domain: "your-tenant.auth0.com" |
| 44 | + audience: "https://your-api-identifier" |
| 45 | + dpopMode: ALLOWED # DISABLED | ALLOWED | REQUIRED |
| 46 | +``` |
| 47 | +
|
| 48 | +**2. Configure Spring Security:** |
| 49 | +
|
| 50 | +```java |
| 51 | +@Configuration |
| 52 | +@EnableMethodSecurity |
| 53 | +public class SecurityConfig { |
| 54 | + |
| 55 | + @Bean |
| 56 | + SecurityFilterChain apiSecurity(HttpSecurity http, Auth0AuthenticationFilter authFilter) |
| 57 | + throws Exception { |
| 58 | + return http |
| 59 | + .csrf(csrf -> csrf.disable()) |
| 60 | + .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) |
| 61 | + .authorizeHttpRequests(auth -> auth |
| 62 | + .requestMatchers("/api/public").permitAll() |
| 63 | + .requestMatchers("/api/protected").authenticated() |
| 64 | + .requestMatchers("/api/admin/**").hasAuthority("SCOPE_admin") |
| 65 | + .anyRequest().permitAll()) |
| 66 | + .addFilterBefore(authFilter, UsernamePasswordAuthenticationFilter.class) |
| 67 | + .build(); |
| 68 | + } |
| 69 | +} |
| 70 | +``` |
| 71 | + |
| 72 | +**3. Access authenticated user info in your controller:** |
| 73 | + |
| 74 | +```java |
| 75 | +@RestController |
| 76 | +@RequestMapping("/api") |
| 77 | +public class ApiController { |
| 78 | + |
| 79 | + @GetMapping("/protected") |
| 80 | + public ResponseEntity<Map<String, Object>> protectedEndpoint(Authentication authentication) { |
| 81 | + Auth0AuthenticationToken token = (Auth0AuthenticationToken) authentication; |
| 82 | + return ResponseEntity.ok(Map.of( |
| 83 | + "user", authentication.getName(), |
| 84 | + "email", token.getClaim("email"), |
| 85 | + "scopes", token.getScopes() |
| 86 | + )); |
| 87 | + } |
| 88 | +} |
| 89 | +``` |
| 90 | + |
| 91 | +### Dependencies |
| 92 | + |
| 93 | +| Dependency | Version | Module | |
| 94 | +|---|---|---| |
| 95 | +| Spring Boot Starter | 3.2.0 | auth0-springboot-api | |
| 96 | +| Spring Boot Starter Web | 3.2.0 | auth0-springboot-api | |
| 97 | +| Spring Boot Starter Security | 3.2.0 | auth0-springboot-api | |
| 98 | +| Jackson Databind | 2.15.2 | auth0-api-java | |
| 99 | +| Apache HttpClient | 4.5.14 | auth0-api-java | |
| 100 | +| Auth0 java-jwt | 4.5.1 | auth0-api-java | |
| 101 | +| Auth0 jwks-rsa | 0.23.0 | auth0-api-java | |
| 102 | + |
| 103 | +**Runtime Requirements:** |
| 104 | +- `auth0-springboot-api` — Java 17+ |
| 105 | +- `auth0-api-java` — Java 8+ |
0 commit comments