WebFlux Security :: Spring Security Why Spring Overview Trending Generative AI Cloud Architecture Patterns Microservices Reactive Event Driven Application Types Web Applications Serverless Batch Learn Getting Started Quickstart Guides Academy Courses Get Certified Projects Overview Projects Spring Boot Spring Framework Spring Cloud Spring AI Spring Data Spring Integration Spring Batch Spring Security Foundational Projects Micrometer Reactor Development Tools Spring Tools Spring Initializr Resources Blog Release Calendar Version Mappings Release Highlights Security Advisories GitHub Orgs Spring Projects Spring Cloud Community Overview Events Authors Enterprise Overview Long-term Support Automated Upgrades Governance and Compliance Modern App Development light Spring Security 6.5.11 Search Overview Prerequisites Community What’s New Preparing for 7.0 Authentication Authorization Configuration LDAP Messaging OAuth 2.0 SAML 2.0 Web Migrating to 6 Getting Spring Security Javadoc Features Authentication Password Storage Authorization Protection Against Exploits CSRF HTTP Headers HTTP Requests Integrations Cryptography Spring Data Java’s Concurrency APIs Jackson Localization Project Modules Samples Servlet Applications Getting Started Architecture Authentication Authentication Architecture Username/Password Reading Username/Password Form Basic Digest Password Storage In Memory JDBC UserDetails CredentialsContainer Password Erasure UserDetailsService PasswordEncoder DaoAuthenticationProvider LDAP Persistence Passkeys One-Time Token Session Management Remember Me Anonymous Pre-Authentication JAAS CAS X509 Run-As Logout Authentication Events Authorization Authorization Architecture Authorize HTTP Requests Method Security Domain Object Security ACLs Authorization Events OAuth2 OAuth2 Log In Core Configuration Advanced Configuration OIDC Logout OAuth2 Client Core Interfaces and Classes OAuth2 Authorization Grants OAuth2 Client Authentication OAuth2 Authorized Clients OAuth2 Resource Server JWT Opaque Token Multitenancy Bearer Tokens DPoP-bound Access Tokens SAML2 SAML2 Log In SAML2 Log In Overview SAML2 Authentication Requests SAML2 Authentication Responses SAML2 Logout SAML2 Metadata Migrating from Spring Security SAML Extension Protection Against Exploits Cross Site Request Forgery (CSRF) Security HTTP Response Headers HTTP HttpFirewall Integrations Concurrency Jackson Localization Servlet APIs Spring Data Spring MVC WebSocket Spring’s CORS Support JSP Taglib Observability Configuration Java Configuration Kotlin Configuration Namespace Configuration Testing Method Security MockMvc Support MockMvc Setup Security RequestPostProcessors Mocking Users Mocking CSRF Mocking Form Login Mocking HTTP Basic Mocking OAuth2 Mocking Logout Security RequestBuilders Security ResultMatchers Security ResultHandlers Appendix Database Schemas XML Namespace Authentication Services Web Security Method Security LDAP Security WebSocket Security Proxy Server Configuration FAQ Reactive Applications Getting Started Authentication X.509 Authentication Logout Session Management Concurrent Sessions Control Authorization Authorize HTTP Requests EnableReactiveMethodSecurity OAuth2 OAuth2 Log In Core Configuration Advanced Configuration OIDC Logout OAuth2 Client Core Interfaces and Classes OAuth2 Authorization Grants OAuth2 Client Authentication OAuth2 Authorized Clients OAuth2 Resource Server JWT Opaque Token Multitenancy Bearer Tokens Protection Against Exploits CSRF Headers HTTP Requests ServerWebExchangeFirewall Integrations CORS RSocket Observability Testing Testing Method Security Testing Web Security WebTestClient Setup Testing Authentication Testing CSRF Testing OAuth 2.0 WebFlux Security GraalVM Native Image Support Method Security Search Edit this Page GitHub Project Stack Overflow Spring Security Reactive Applications WebFlux Security For the latest stable version, please use Spring Security 7.1.0! WebFlux Security Spring Security’s WebFlux support relies on a WebFilter and works the same for Spring WebFlux and Spring WebFlux.Fn. A few sample applications demonstrate the code: Hello WebFlux hellowebflux Hello WebFlux.Fn hellowebfluxfn Hello WebFlux Method hellowebflux-method Minimal WebFlux Security Configuration The following listing shows a minimal WebFlux Security configuration: Minimal WebFlux Security Configuration Java Kotlin @Configuration @EnableWebFluxSecurity public class HelloWebfluxSecurityConfig { @Bean public MapReactiveUserDetailsService userDetailsService() { UserDetails user = User.withDefaultPasswordEncoder() .username("user") .password("user") .roles("USER") .build(); return new MapReactiveUserDetailsService(user); } } @Configuration @EnableWebFluxSecurity class HelloWebfluxSecurityConfig { @Bean fun userDetailsService(): ReactiveUserDetailsService { val userDetails = User.withDefaultPasswordEncoder() .username("user") .password("user") .roles("USER") .build() return MapReactiveUserDetailsService(userDetails) } } This configuration provides form and HTTP basic authentication, sets up authorization to require an authenticated user for accessing any page, sets up a default login page and a default logout page, sets up security related HTTP headers, adds CSRF protection, and more. Explicit WebFlux Security Configuration The following page shows an explicit version of the minimal WebFlux Security configuration: Explicit WebFlux Security Configuration Java Kotlin @Configuration @EnableWebFluxSecurity public class HelloWebfluxSecurityConfig { @Bean public MapReactiveUserDetailsService userDetailsService() { UserDetails user = User.withDefaultPasswordEncoder() .username("user") .password("user") .roles("USER") .build(); return new MapReactiveUserDetailsService(user); } @Bean public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) { http .authorizeExchange(exchanges -> exchanges .anyExchange().authenticated() ) .httpBasic(withDefaults()) .formLogin(withDefaults()); return http.build(); } } import org.springframework.security.config.web.server.invoke @Configuration @EnableWebFluxSecurity class HelloWebfluxSecurityConfig { @Bean fun userDetailsService(): ReactiveUserDetailsService { val userDetails = User.withDefaultPasswordEncoder() .username("user") .password("user") .roles("USER") .build() return MapReactiveUserDetailsService(userDetails) } @Bean fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain { return http { authorizeExchange { authorize(anyExchange, authenticated) } formLogin { } httpBasic { } } } } Make sure to import the org.springframework.security.config.web.server.invoke function to enable the Kotlin DSL in your class, as the IDE will not always auto-import the method, causing compilation issues. This configuration explicitly sets up all the same things as our minimal configuration. From here, you can more easily make changes to the defaults. You can find more examples of explicit configuration in unit tests, by searching for EnableWebFluxSecurity in the config/src/test/ directory. Multiple Chains Support You can configure multiple SecurityWebFilterChain instances to separate configuration by RequestMatcher instances. For example, you can isolate configuration for URLs that start with /api: Java Kotlin @Configuration @EnableWebFluxSecurity static class MultiSecurityHttpConfig { @Order(Ordered.HIGHEST_PRECEDENCE) (1) @Bean SecurityWebFilterChain apiHttpSecurity(ServerHttpSecurity http) { http .securityMatcher(new PathPatternParserServerWebExchangeMatcher("/api/**")) (2) .authorizeExchange((exchanges) -> exchanges .anyExchange().authenticated() ) .oauth2ResourceServer(OAuth2ResourceServerSpec::jwt); (3) return http.build(); } @Bean SecurityWebFilterChain webHttpSecurity(ServerHttpSecurity http) { (4) http .authorizeExchange((exchanges) -> exchanges .anyExchange().authenticated() ) .httpBasic(withDefaults()); (5) return http.build(); } @Bean ReactiveUserDetailsService userDetailsService() { return new MapReactiveUserDetailsService( PasswordEncodedUser.user(), PasswordEncodedUser.admin()); } } import org.springframework.security.config.web.server.invoke @Configuration @EnableWebFluxSecurity open class MultiSecurityHttpConfig { @Order(Ordered.HIGHEST_PRECEDENCE) (1) @Bean open fun apiHttpSecurity(http: ServerHttpSecurity): SecurityWebFilterChain { return http { securityMatcher(PathPatternParserServerWebExchangeMatcher("/api/**")) (2) authorizeExchange { authorize(anyExchange, authenticated) } oauth2ResourceServer { jwt { } (3) } } } @Bean open fun webHttpSecurity(http: ServerHttpSecurity): SecurityWebFilterChain { (4) return http { authorizeExchange { authorize(anyExchange, authenticated) } httpBasic { } (5) } } @Bean open fun userDetailsService(): ReactiveUserDetailsService { return MapReactiveUserDetailsService( PasswordEncodedUser.user(), PasswordEncodedUser.admin() ) } } 1 Configure a SecurityWebFilterChain with an @Order to specify which SecurityWebFilterChain Spring Security should consider first 2 Use PathPatternParserServerWebExchangeMatcher to state that this SecurityWebFilterChain will only apply to URL paths that start with /api/ 3 Specify the authentication mechanisms that will be used for /api/** endpoints 4 Create another instance of SecurityWebFilterChain with lower precedence to match all other URLs 5 Specify the authentication mechanisms that will be used for the rest of the application Spring Security selects one SecurityWebFilterChain @Bean for each request. It matches the requests in order by the securityMatcher definition. In this case, that means that, if the URL path starts with /api, Spring Security uses apiHttpSecurity. If the URL does not start with /api, Spring Security defaults to webHttpSecurity, which has an implied securityMatcher that matches any request. Spring Security Stable 7.1.0 7.0.6 6.5.11 Snapshot 7.1.1-SNAPSHOT 7.0.7-SNAPSHOT 6.5.12-SNAPSHOT Related Spring Documentation Spring Framework Spring Security Spring Authorization Server Spring LDAP Spring Security Kerberos Spring Session Spring Vault Spring GraphQL All Docs... Copyright © 2005 - Broadcom. All Rights Reserved. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries. Terms of Use • Privacy • Trademark Guidelines • Thank you • Your California Privacy Rights • Cookie Settings Apache®, Apache Tomcat®, Apache Kafka®, Apache Cassandra™, and Apache Geode™ are trademarks or registered trademarks of the Apache Software Foundation in the United States and/or other countries. Java™, Java™ SE, Java™ EE, and OpenJDK™ are trademarks of Oracle and/or its affiliates. Kubernetes® is a registered trademark of the Linux Foundation in the United States and other countries. Linux® is the registered trademark of Linus Torvalds in the United States and other countries. Windows® and Microsoft® Azure are registered trademarks of Microsoft Corporation. “AWS” and “Amazon Web Services” are trademarks or registered trademarks of Amazon.com Inc. or its affiliates. All other trademarks and copyrights are property of their respective owners and are only mentioned for informative purposes. Other names may be trademarks of their respective owners. Search in all Spring Docs