Spring Security

This chapter explains how to secure reactive applications using Spring Security's WebFlux support. It covers authentication, authorization, and integration with reactive data and session stores.

What this chapter covers

• Core differences between reactive and servlet security stacks
• Configuring ServerHttpSecurity and securing routes
• Reactive user details and authentication mechanisms
• Integrating with OAuth2/OpenID Connect and token-based auth

What you'll learn

• How to secure endpoints with declarative and programmatic approaches
• How to configure reactive authentication providers and custom user services
• Patterns for secure error handling and CSRF considerations in reactive apps

Prerequisites

• Familiarity with Spring Security concepts (filters, authentication manager)

Chapter roadmap

1. Basic ServerHttpSecurity configuration and examples
2. Reactive form and token auth patterns
3. Method-level security and testing
4. Integration with Spring Session and external identity providers

Where to find examples: see security/* files for concrete configurations and runnable snippets.