Skip to content

Commit 9f1c4b7

Browse files
committed
Fix inconsistency for effect on Actuator of defining security filter
Closes gh-41569
1 parent 4b9bf63 commit 9f1c4b7

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

spring-boot-project/spring-boot-docs/src/docs/asciidoc/web/spring-security.adoc

+4-4
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@ You can provide a different `AuthenticationEventPublisher` by adding a bean for
3535
The default security configuration is implemented in `SecurityAutoConfiguration` and `UserDetailsServiceAutoConfiguration`.
3636
`SecurityAutoConfiguration` imports `SpringBootWebSecurityConfiguration` for web security and `UserDetailsServiceAutoConfiguration` configures authentication, which is also relevant in non-web applications.
3737

38-
To switch off the default web application security configuration completely or to combine multiple Spring Security components such as OAuth2 Client and Resource Server, add a bean of type `SecurityFilterChain` (doing so does not disable the `UserDetailsService` configuration or Actuator's security).
39-
To also switch off the `UserDetailsService` configuration, you can add a bean of type `UserDetailsService`, `AuthenticationProvider`, or `AuthenticationManager`.
38+
To completely switch off the default web application security configuration, including Actuator security, or to combine multiple Spring Security components such as OAuth2 Client and Resource Server, add a bean of type `SecurityFilterChain` (doing so does not disable the `UserDetailsService` configuration).
39+
To also switch off the `UserDetailsService` configuration, add a bean of type `UserDetailsService`, `AuthenticationProvider`, or `AuthenticationManager`.
4040

4141
The auto-configuration of a `UserDetailsService` will also back off any of the following Spring Security modules is on the classpath:
4242

@@ -59,8 +59,8 @@ Similar to Spring MVC applications, you can secure your WebFlux applications by
5959
The default security configuration is implemented in `ReactiveSecurityAutoConfiguration` and `UserDetailsServiceAutoConfiguration`.
6060
`ReactiveSecurityAutoConfiguration` imports `WebFluxSecurityConfiguration` for web security and `UserDetailsServiceAutoConfiguration` configures authentication, which is also relevant in non-web applications.
6161

62-
To switch off the default web application security configuration completely, you can add a bean of type `WebFilterChainProxy` (doing so does not disable the `UserDetailsService` configuration or Actuator's security).
63-
To also switch off the `UserDetailsService` configuration, you can add a bean of type `ReactiveUserDetailsService` or `ReactiveAuthenticationManager`.
62+
To completely switch off the default web application security configuration, including Actuator security, add a bean of type `WebFilterChainProxy` (doing so does not disable the `UserDetailsService` configuration).
63+
To also switch off the `UserDetailsService` configuration, add a bean of type `ReactiveUserDetailsService` or `ReactiveAuthenticationManager`.
6464

6565
The auto-configuration will also back off when any of the following Spring Security modules is on the classpath:
6666

0 commit comments

Comments
 (0)