infoq.com/articles/spring-security-7-server-side-dpop-token-exchange Article: Server-Side DPoP and Token Exchange in Spring Security 7
Spring Boot 4 quietly folds a standalone auth server into Spring Security 7, and the upgrade isn't just a version bump. DPoP enforcement stops happening automatically on 7.1, so apps that relied on the old default go unprotected until someone adds the missing call.
— via InfoQ, Dhruv Agnihotri
