Serguey Asael Shinder: Spring Security 7.2.0-M2 keeps manifests and DevTools probes out of the RequestCache
Spring Security 7.2.0-M2 is out, and the entry worth reading in its release notes is the one that sounds like housekeeping: modernize the default RequestCache background-request ignore list. Four separate changes sit under it. The default RequestCache now ignores Apple touch icon requests (apple-touch-icon*.png), browserconfig.xml, web app manifest requests (manifest.json and manifest.webmanifest), and Chrome DevTools' probe for .well-known/appspecific/com.chrome.devtools.json.
The reason this matters is what the RequestCache is for. When an unauthenticated user hits a protected URL, Spring Security saves that request so it can send them back there after login. The mechanism does not know which request came from a person and which came from the browser deciding, on its own schedule, to go and fetch an icon. If one of those background requests is the last thing saved before the login redirect, the user authenticates and lands on a manifest.
I have watched two teams debug that symptom, and in both cases it was reported as "login sometimes goes to the wrong page", which is the worst possible description because it sounds intermittent. It is not intermittent. It is deterministic given a particular ordering of requests the developer cannot see in their own browser, because their browser has already cached the icon.
The other entries in this milestone are a mixed set: @EnableMethodSecurity picking up a PermissionEvaluator bean, the authentication success handler becoming configurable in the Resource Server DSL, KerberosRestClient rethrowing the original RestClientException, header writers no longer corrupting Jetty HttpFields state in reactive ResponseBodyEmitter handlers, and a note that TokenType reference comparison is used in BearerTokenAuthentication.
This is a milestone, not a general availability release, so the useful move is not to upgrade but to check whether the symptom is already in your issue tracker under a different name. If your application serves a manifest and uses the default RequestCache, it is worth a search for the phrase your users would actually have written.