anchor.diff:  </plugin>
   ----
   
  -where `owasp-dependency-check-plugin.version` should be set to `7.1.1` or later.
  -
  -You can configure the plugin like this:
  +[IMPORTANT]
  +====
  +Set the `owasp-dependency-check-plugin.version` value to `7.1.1` or later.
  +====
  +
  +Next, configure the plugin as follows:
   
   [source,xml]
   ----
  
positive.code: |Yes
  |No
  |No
  |UserInfo support
  |Yes
  |No
  |No
  |Pem Key format support
  |No
  |Yes
  |No
  |SecretKey support
  |No
  |In JsonWebKey format
  |No
  |InnerSigned/Encrypted or Encrypted tokens
  |Introspection
  |Local Verification
  |Introspection
  |Custom Token Verification
  |No
  |With Injected JWTParser
  |No
  |Accept JWT as cookie
  |No
  |Yes
  |No
  |===
  
  [[identity-providers]]
  == Identity Providers
  
  `IdentityProvider` converts the authentication credentials provided by `HttpAuthenticationMechanism` to `SecurityIdentity`.
  
  Some extensions such as `OIDC`, `OAuth2`, `SmallRye JWT` have the inlined `IdentityProvider` implementations which are specific to the supported authentication flow.
  For example, `quarkus-oidc` uses its own `IdentityProvider` to convert a token to `SecurityIdentity`. 
  
  If you use `Basic` or `Form` HTTP-based authentication then you have to add an `IdentityProvider` which can convert a username and password to `SecurityIdentity`.
  
  * For more information about `Basic` or `Form` HTTP-based authentication, see: 
  ** xref:security-getting-started.adoc[JPA IdentityProvider]
  ** xref:security-jdbc.adoc[JDBC IdentityProvider]
  ** xref:security-ldap.adoc[LDAP IdentityProvider]
  
  * For a a Basic Authentication configuration walk-through using JPA, see:
  ** xref:security-getting-started.adoc[Getting Started With Security] guide.
  
  * For testing, use the xref:security-testing.adoc#configuring-user-information[User Properties IdentityProvider] section with the `IdentityProvider` with already set usernames, passwords, and roles in `application.properties`.
  
  == Combining Authentication Mechanisms
  
  One can combine multiple authentication mechanisms if they get the authentication credentials from the different sources.
  For example, combining built-in `Basic` and `quarkus-oidc` `Bearer` authentication mechanisms is allowed, but combining `quarkus-oidc` `Bearer` and `smallrye-jwt` authentication mechanisms is not allowed because both will attempt to verify the token extracted from the HTTP `Authorization Bearer` scheme.
  
  === Path Specific Authentication Mechanism
  
  You can enforce that only a single authentication mechanism is selected for a given request path, for example:
  [source,properties]
  ----
  quarkus.http.auth.permission.basic-or-bearer.paths=/service
  
negative.code: quarkus.http.auth.permission.bearer.auth-mechanism=bearer
  ----
  
  Ensure that the value of the `auth-mechanism` property matches the authentication scheme supported by `HttpAuthenticationMechanism`, for example, `basic`, `bearer`, or `form`.
  
  == Proactive authentication
  
  By default, Quarkus does proactive authentication, which means that all incoming requests with credentials are authenticated regardless of whether the target page requires authentication.
  For more information, see xref:security-built-in-authentication.adoc#proactive-authentication[Proactive authentication].
  
  == Secure connections with SSL/TLS
  
   For more information about how Quarkus supports secure connections with SSL/TLS, see the xref:http-reference.adoc#ssl[HTTP reference] information.
  
  == Cross-origin resource sharing
  
  To make your Quarkus application accessible to another application running on a different domain, you need to configure cross-origin resource sharing (CORS). 
  For more information about the CORS filter that is provided by Quarkus, see the xref:http-reference.adoc#cors-filter[HTTP reference] information.
  
  == Cross-site Request Forgery (CSRF) prevention
  
  Quarkus Security provides a RESTEasy Reactive filter that can protect your applications against a https://owasp.org/www-community/attacks/csrf[Cross-Site Request Forgery] attack. 
  For more information, see xref:security-csrf-prevention.adoc[Cross-Site Request Forgery Prevention].
  
  == SameSite cookies
  
  You can add a https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite[SameSite] cookie property to any of the cookies set by a Quarkus endpoint. 
  For more information, see xref:http-reference.adoc#same-site-cookie[SameSite cookies].
  
  == Secret engines
  Secrets engines are components that store, generate, or encrypt data. 
  
  Quarkus provides comprehensive HashiCorp Vault support. 
  For more information, see the link:{vault-guide}[Quarkus and HashiCorp Vault] documentation.
  
  == Secure serialization
  
  If your Quarkus Security architecture includes RESTEasy Reactive and Jackson, Quarkus can limit the fields that are included in JSON serialization based on the configured security.
  For more information, see xref:resteasy-reactive.adoc#secure-serialization[Writing REST services with RESTEasy Reactive].
  
  == National Vulnerability Database
  
  Most of the Quarkus tags are registered in the US link:https://nvd.nist.gov[National Vulnerability Database] (NVD) in Common Platform Enumeration (CPE) name format.
  To view the registered Quarkus CPE names, use link:https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=quarkus[this search query].
  
  If the NVE database flags a CVE against a Quarkus tag, a link that provides more details about the CVE is added to the given CPE name entry.
  
  The NVD CPE team updates the list regularly, but if you encounter a false positive, report the details by creating an issue in the link:https://github.com/quarkusio/quarkus/issues/2611[quarkusio] repository.
  
  You can detect the vulnerabilities at the application build time with an NVD feed by using the Maven link:https://jeremylong.github.io/DependencyCheck/dependency-check-maven/[OWASP Dependency check plugin]. 
  
  
  To add the OWASP Dependency check plugin to your Quarkus Maven project, add the following XML configuration to the `pom.xml` file:
  
  [source,xml]
  ----
  