diff --git a/docs/manual/src/docbook/taglibs.xml b/docs/manual/src/docbook/taglibs.xml
index d629b96c87..3009467eb6 100644
--- a/docs/manual/src/docbook/taglibs.xml
+++ b/docs/manual/src/docbook/taglibs.xml
@@ -54,6 +54,24 @@ This content will only be visible to users who are authorized to send requests t
stored in a page context scope variable by setting the var attribute
to the variable name, avoiding the need for duplicating and re-evaluating the condition
at other points in the page.
+
+ Disabling Tag Authorization for Testing
+ Hiding a link in a page for unauthorized users doesn't prevent them from accessing
+ the URL. They could just type it into their browser directly, for example. As part
+ of your testing process, you may want to reveal the hidden areas in order to check
+ that links really are secured at the back end. If you set the system property
+ spring.security.disableUISecurity to true,
+ the authorize tag will still run but will not hide its contents.
+ By default it will also surround the content with <span
+ class="securityHiddenUI">...</span> tags. This allows you to
+ display hidden
content with a particular CSS style such as a
+ different background colour. Try running the tutorial
sample
+ application with this property enabled, for example.
+ You can also set the properties spring.security.securedUIPrefix
+ and spring.security.securedUISuffix if you want to change
+ surrounding text from the default span tags (or use empty strings
+ to remove it completely).
+