Spring Authorization Server 7.1

Apply the Spring Security 7.1 baseline first. These rules cover Spring Authorization Server 7.1.1.

Issuer and endpoint boundaries

• Set one fixed HTTPS issuer with AuthorizationServerSettings.issuer(...); when absent, issuer data is resolved from the current request and therefore depends on trusted host/forwarding configuration.
• Keep multipleIssuersAllowed(false) unless path-based multi-tenancy is designed end to end; issuer-path selection must map to an authenticated tenant configuration, keys, clients, and storage.
• Protect the default authorization, PAR, device, token, revocation, introspection, registration, JWK, user-info, and logout endpoint paths according to their protocol roles.
• Remember that endpoint paths in AuthorizationServerSettings do not enable their features: PAR, device endpoints, OAuth2 client registration, OIDC, and OIDC client registration are disabled by default and require explicit configuration plus their own access policy.
• Build the authorization-server SecurityFilterChain with the framework endpoint matcher and a separate catch-all application chain; first-match gaps can expose surrounding login or consent routes.

Client registration and authentication

• Register exact redirect and post-logout URIs and never use wildcard, suffix, open-redirect, or request-derived matching, except the protocol-defined loopback-port variation for native-client authorization redirects. Require HTTPS for web redirects.
• Keep ClientSettings.requireProofKey(true), the 7.1 default, for authorization-code clients; disabling it relaxes the