Announcing mvc-auth-commons v2.0.0-beta.0

[tanya732]

🚀 Announcing mvc-auth-commons v2.0.0-beta.0

We're excited to announce the beta release of mvc-auth-commons v2.0.0, a major upgrade of the Auth0 SDK for Java Servlet web applications.

This release migrates the library from Java 8 / javax.servlet to Java 17 / Jakarta Servlet 6.0 (Jakarta EE 10) while introducing significant security improvements, dependency modernization, and API cleanup.

⚠️ Beta Release

This is a beta release intended for testing and feedback before the GA release. We encourage you to test it in non-production environments and let us know what works well, what doesn't, and what could be improved.

---

✨ Highlights

⬆️ Modern Platform

• Java 17 minimum runtime

• Jakarta Servlet 6.0 (Jakarta EE 10)

• Compatible with:

  • Tomcat 10.1+

  • Jetty 12+

  • WildFly 27+

🛡️ Security Improvements

• HMAC-signed origin-domain cookies bound to the OAuth state

• ID token signatures are always verified

• Automatic JWT algorithm detection (RS256 / HS256)

🍪 Cookie-based Authentication State

Authentication state is now stored in secure transient cookies instead of the HTTP session.

🔧 Custom HTTP Client

Configure custom timeouts, proxies, or shared clients with:

.withHttpClient(Auth0HttpClient)

---

🧩 Getting Started

Maven

<dependency>
  <groupId>com.auth0</groupId>
  <artifactId>mvc-auth-commons</artifactId>
  <version>2.0.0-beta.0</version>
</dependency>

Gradle

implementation "com.auth0:mvc-auth-commons:2.0.0-beta.0"

Basic Configuration

JwkProvider jwkProvider = new JwkProviderBuilder("YOUR-AUTH0-DOMAIN").build();
AuthenticationController controller =

AuthenticationController

.newBuilder(domain, clientId, clientSecret)

.withJwkProvider(jwkProvider)

.build();

---

⚠️ Breaking Changes

Change	Migration
Java 17 required	Upgrade your JDK/runtime
jakarta.servlet namespace	Update imports and use Tomcat 10.1+, Jetty 12+, or WildFly 27+
handle(request) removed	Use handle(request, response)
buildAuthorizeUrl(request, uri) removed	Use buildAuthorizeUrl(request, response, uri)
InvalidRequestException.getDescription() removed	Use getMessage()
withHttpOptions(HttpOptions) removed	Use withHttpClient(Auth0HttpClient)
Custom verifier classes removed	No action required (handled internally by auth0-java v3)
Session-based storage removed	No action required (secure cookies are now used automatically)

---

📚 Resources

• 📖 README
  https://github.com/auth0/auth0-java-mvc-common/blob/2.0.0-beta.0/README.md

• 💻 Examples
  https://github.com/auth0/auth0-java-mvc-common/blob/2.0.0-beta.0/EXAMPLES.md

• 📦 Maven Central
  https://central.sonatype.com/artifact/com.auth0/mvc-auth-commons

---

💬 Feedback

This is a beta release—your feedback will help shape the final v2.0.0 release.

Please let us know:

• What worked well

• What was confusing

• Any migration issues you encountered

• Bugs or unexpected behavior

Reply to this discussion or open an issue:

https://github.com/auth0/auth0-java-mvc-common/issues

Thanks for helping us improve mvc-auth-commons v2!

---

🙏 Credits

Special thanks to the contributors who helped shape this release:

• TareqK for sharing the PR Updated to JDK 21, gradle 8, fixed tests #156 and contributing to this work
• luckpoint for the inputs and suggestions Add jakarta support through bytecode transformation #157