Spring Security 7.0

Apply the Spring MVC 7.0 baseline first. These rules cover Spring Security 7.0.7.

Filter chains and request matching

• Give every SecurityFilterChain bean an explicit securityMatcher and a deliberate order: only the first chain whose matcher accepts a request runs, and a request matching no chain gets no Spring Security authentication or authorization.
• End the chain list with a catch-all chain closing with anyRequest().denyAll() or anyRequest().authenticated(), so a route added later isn't unprotected by omission.
• Replace the MvcRequestMatcher and AntPathRequestMatcher usages 7.0 removed with PathPatternRequestMatcher, and re-test every pattern, since the replacement parses paths differently.
• Finish migrating authorizeRequests to authorizeHttpRequests and the removed and() chaining to the lambda DSL; the removed APIs don't compile against 7.0.
• Authorize the FORWARD, ERROR, and INCLUDE dispatcher types deliberately with dispatcherTypeMatchers, and register the security filter for those dispatches so error pages are neither denied nor wide open.
• Prefer permitAll to WebSecurityCustomizer.ignoring; an ignored request skips the filter chain, the security context, and every Spring Security response header the application relies on.
• Keep the default StrictHttpFirewall, and treat setAllowSemicolon, encoded-slash allowances, permissive header or parameter predicates, and setUnsafeAllowAnyHttpMethod(true) as parser bypasses needing differential testing against the servlet container.
• Any SecurityFilterChain bean replaces Spring