SecurityWebFilterChain is the reactive counterpart to SecurityFilterChain: an ordered chain of web security filters that processes server exchanges and applies authentication and authorization. section 17.3.1 section 17.5
Configure a reactive application by:
- Registering a SecurityWebFilterChain bean that receives a ServerHttpSecurity builder. section 17.3.1
- Enabling an authentication mechanism such as HTTP Basic or JWT resource-server authentication. section 17.3.1 section 17.4
- Defining endpoint rules with authorizeExchange(), then returning http.build(). section 17.3.1
Protect one endpoint
A chain can require authentication for GET /hello while permitting other exchanges: http.authorizeExchange(c -> c.pathMatchers(HttpMethod.GET, "/hello").authenticated().anyExchange().permitAll()); section 17.3.1
Listing 17.7 Configuring endpoint authorization for reactive apps
@Configuration
public class ProjectConfig {
// Omitted code
@Bean
public SecurityWebFilterChain securityWebFilterChain(
ServerHttpSecurity http) {
http.httpBasic(Customizer.withDefaults());
http.authorizeExchange( #1
c -> c.pathMatchers(HttpMethod.GET, "/hello") #2
.authenticated() #3
.anyExchange() #4
.permitAll() #5
);
return http.build(); #6
}
}
Inspect the complete reactive configuration showing HTTP Basic, endpoint matching, authentication requirements, and chain construction. section 17.3.1
