Spring Security - Third Edition

AuthenticationException

The constructor that accepts extraInformation within AuthenticationException was removed to prevent the accidental leaking of the UserDetails  object. Specifically, we removed the following code:

    public AccountExpiredException(String msg, Object extraInformation) {      ...    }

This impacts the subclasses AccountStatusException, AccountExpiredException, BadCredentialsException, CredentialsExpiredException, DisabledException, LockedException, and UsernameNotFoundException. If you are using any of these constructors, simply remove the additional argument. For example, the following code snippet  is changed:

    new LockedException("Message", userDetails);

The preceding code snippet should be changed to the following code snippet: ...