|
|
|
@ -3023,21 +3023,23 @@ commonly used locations.
|
|
|
|
|
|
|
|
|
|
[[boot-features-security-webflux]]
|
|
|
|
|
=== WebFlux Security
|
|
|
|
|
Similar to Spring MVC applications, you can secure your WebFlux applications by adding the `spring-boot-starter-security` dependency.
|
|
|
|
|
The default security configuration is implemented in `ReactiveSecurityAutoConfiguration` and in
|
|
|
|
|
the classes imported from there (`WebFluxSecurityConfiguration` for web security
|
|
|
|
|
and `ReactiveAuthenticationManagerConfiguration` for authentication configuration, which is also
|
|
|
|
|
relevant in non-web applications). To switch off the default web application security
|
|
|
|
|
configuration completely, you can add a bean of type `WebFilterChainProxy` (doing
|
|
|
|
|
so does not disable the authentication manager configuration or Actuator's security).
|
|
|
|
|
Similar to Spring MVC applications, you can secure your WebFlux applications by adding
|
|
|
|
|
the `spring-boot-starter-security` dependency. The default security configuration is
|
|
|
|
|
implemented in `ReactiveSecurityAutoConfiguration` and in the classes imported from there
|
|
|
|
|
(`WebFluxSecurityConfiguration` for web security and
|
|
|
|
|
`ReactiveAuthenticationManagerConfiguration` for authentication configuration, which is
|
|
|
|
|
also relevant in non-web applications). To switch off the default web application security
|
|
|
|
|
configuration completely, you can add a bean of type `WebFilterChainProxy` (doing so does
|
|
|
|
|
not disable the authentication manager configuration or Actuator's security).
|
|
|
|
|
|
|
|
|
|
To also switch off the authentication manager configuration, you can add a bean of type
|
|
|
|
|
`ReactiveUserDetailsService` or `ReactiveAuthenticationManager`.
|
|
|
|
|
|
|
|
|
|
Access rules can be configured by adding a custom `SecurityWebFilterChain`. Spring
|
|
|
|
|
Boot provides convenience methods that can be used to override access rules for actuator
|
|
|
|
|
endpoints and static resources. `EndpointRequest` can be used to create a `ServerWebExchangeMatcher`
|
|
|
|
|
that is based on the `management.endpoints.web.base-path` property.
|
|
|
|
|
endpoints and static resources. `EndpointRequest` can be used to create a
|
|
|
|
|
`ServerWebExchangeMatcher` that is based on the `management.endpoints.web.base-path`
|
|
|
|
|
property.
|
|
|
|
|
|
|
|
|
|
`PathRequest` can be used to create a `ServerWebExchangeMatcher` for resources in
|
|
|
|
|
commonly used locations.
|
|
|
|
@ -3046,10 +3048,11 @@ For example, you can customize your security configuration by adding something l
|
|
|
|
|
|
|
|
|
|
[source,java,indent=0]
|
|
|
|
|
----
|
|
|
|
|
include::{code-examples}/web/security/CustomWebFluxSecurityExample.java[tag=custom-webflux-security]
|
|
|
|
|
include::{code-examples}/web/security/CustomWebFluxSecurityExample.java[tag=configuration]
|
|
|
|
|
----
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[[boot-features-security-oauth2]]
|
|
|
|
|
=== OAuth2
|
|
|
|
|
https://oauth.net/2/[OAuth2] is a widely used authorization framework that is supported by
|
|
|
|
|