Post

I've done a lot of cleanup on #SpringSecurity MFA support this past week. The updates (along with improved docs) can be seen in the reference docs.spring.io/spring-secur...

docs.spring.iodocs.spring.io

Rob Winch

@rwinch.github.io

I'm really fond of how you can declare that URLs require authenticating with a password (or other mechanism) within a specified amount of time docs.spring.io/spring-secur...

10/10/25, 9:36 pm0 reposts0 likes

Rob Winch

@rwinch.github.io

10 Oct 2025

For example this states that the user must have authenticated with a password within the last 30 minutes: AuthorizationManagerFactories.multiFactor() .requireFactor( (factor) -> factor .passwordAuthority() .validDuration(Duration.ofMinutes(30)) ) .build();