Documenting some issues I encountered while upgrading my blog backend from Java Spring Security 5 to 6. I did the upgrade by changing pom.xml -> spring-boot-starter-parent's version from 2.7.2 to 3.0.6.

Database

For some reason there is a data type change when upgrading spring-boot-starter-parent's version from 2.7.2 to 3.0.6, I am using Azure DB as the database for my blog site, and for each of the blog/article, I store its creation time as an Instant (java.time.Instant). Previously this Java Object is stored as datetime2 in the Azure DB, after the upgrade, its now stored as datetimeoffset with a precision of 6 (i.e DATETIMEOFFSET(6)). And Spring Hibernate is complaining about type mismatch after upgrade, so I manually altered the type of the database using

ALTER TABLE <table_name>
ALTER COLUMN <column_name> DATETIMEOFFSET(6);

And also I need to change application.yml

spring:
  jpa:
    hibernate:
      ddl-auto: update # previously I am using validate

Azure App Service

When compiling a Spring Java Application, the output is usually a single jar file, with a web server built-in. So to host it on Azure App Service, choose "Java web server" -> "Java SE".

Java Spring Security

Previously I have a custom JWT authentication filter JwtAuthFilter, which extends BasicAuthenticationFilter. But in Spring Security 6, AuthenticationManager got deprecated, which BasicAuthenticationFilter depends on. So I changed it to extend OncePerRequestFilter.