# What's new in Spring Security 3.1

This section contains summary of the updates found in Spring Security 3.1. A detailed list of changes can be found in the project's JIRA

## High level updates found Spring Security 3.1

Below you can find a high level summary of updates to Spring Security 3.1.

- Support for multiple http elements
- Support for stateless authentication
- DebugFilter provides additional debugging information
- Improved Active Directory LDAP support (i.e. ActiveDirectoryLdapAuthenticationProvider)
- Added Basic Crypto Module.
- The namespace is fully documented in the reference appendix.
- Added dependencies section to the reference appendix
- Support HttpOnly Flag for Cookies in Servlet 3.0 environments
- InMemoryUserDetailsManager provides in memory implementation of UserDetailsManager
- Support for hasPermission expression on the authorize JSP tag
- Support for disabling UI security (for testing purposes)
- Support erasing credentials after successful authentication
- Support clearing cookies on logout
- Spring Security Google App Engine example application
- Support for CAS proxy tickets
- Support for arbitrary implementations of JAAS Configuration
- Support nested switching of users for SwitchUserFilter

## Spring Security 3.1 namespace updates

Below you can find a summary of updates to the Spring Security 3.1 namespace.

- Added support for multiple <http> elements and support for determining which one to use with http@pattern, http@request-matcher, and http@security. Further information can be found in Namespace Configuration section of the reference.
- Added stateless option for http@create-session
- Added support for http@authentication-manager-ref and global-method-security@authentication-manager-ref.
- Added http@name
- Added http@request-matcher-ref and filter-chain@request-matcher-ref
- Added <debug>
- Added Support for setting the AuthenticationDetailsSource using the namespace. See form-login@authentication-details-source-ref, openid-login@authentication-details-source-ref, http-basic@authentication-details-source-ref, and x509@authentication-details-source-ref.
- Added support for http/expression-handler. This allows <expression-handler> to be used for web access expressions.
- Added authentication-manager@erase-credentials
- Added http-basic@entry-point-ref
- Added logout@delete-cookies
- Added remember-me@authentication-success-handler-ref
- Added <metadata-source-ref>
- Added global-method-security@metadata-source-ref
- Added global-method-security@mode
- Added <attribute-exchange>
- Added remember-me@use-secure-cookie
- Added http@jaas-api-provision
- Added form-login@username-parameter and form-login@password-parameter