What is Spring Security in Spring Boot 4 and what are the key Boot 4 changes?

// Spring Boot 4 / Spring Security 7: SecurityFilterChain
@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            // REST APIs: disable CSRF (Spring Security 7 default changed!)
            // Boot 3: CSRF enabled by default; REST APIs often disabled it
            // Boot 4 / Security 7: review CSRF defaults -- new SameSite-based protection
            .csrf(csrf -> csrf
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            )
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/actuator/health", "/api/public/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)  // for JWT/OAuth2
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt
                    .decoder(JwtDecoders.fromIssuerLocation(issuerUri))
                )
            );
        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

// Spring Security 7: Multi-Factor Authentication
// MFA is now a first-class concept in the security model
// Configure in SecurityFilterChain with mfa() DSL
// Previously required custom implementations