Getting 403 responses for Async REST APIs using Spring MVC after upgrading 2.7.x -> 3.4.x

[edmundham]

Problem:

After upgrading our application to Spring Boot 3.4.x from 2.7.x, we are getting 403 from API endpoints that are using Spring MVC with Async annotation.

Background:

• We are using custom authentication / authorization filter (CustomFilter)
• We have both Spring MVC and Jersey in our application

demo.zip - There is a postman collection inside.

[wilkinsona]

Thanks for the sample. This isn't a Spring Boot issue as the behavior change that you're seeing is due to a change in Spring Security.

You were relying on Spring Security saving the security context automatically. In Spring Security 6 that no longer happens by default. This is covered in its migration documentation. You should configure a SecurityContextRepository that meets your needs and save the context to the repository as described in Spring Security's documentation.

If you have any further questions, please follow up on Stack Overflow. As mentioned in the guidelines for contributing, we prefer to use GitHub issues only for bugs and enhancements.