Release 6.1.2

Issue gh-13551

buildSrc/build.gradle

@@ -86,7 +86,7 @@ dependencies {
 	implementation localGroovy()
 
 	implementation 'io.github.gradle-nexus:publish-plugin:1.1.0'
-	implementation 'io.projectreactor:reactor-core:3.5.7'
+	implementation 'io.projectreactor:reactor-core:3.5.8'
 	implementation 'org.gretty:gretty:4.0.3'
 	implementation 'com.apollographql.apollo:apollo-runtime:2.4.5'
 	implementation 'com.github.ben-manes:gradle-versions-plugin:0.38.0'

buildSrc/src/main/java/org/springframework/gradle/sagan/SaganCreateReleaseTask.java

@@ -16,6 +16,10 @@
 
 package org.springframework.gradle.sagan;
 
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import org.eclipse.core.runtime.Assert;
 import org.gradle.api.DefaultTask;
 import org.gradle.api.tasks.Input;
 import org.gradle.api.tasks.TaskAction;
@@ -25,6 +29,8 @@ import org.springframework.gradle.github.user.User;
 
 public class SaganCreateReleaseTask extends DefaultTask {
 
+	private static final Pattern VERSION_PATTERN = Pattern.compile("^([0-9]+)\\.([0-9]+)\\.([0-9]+)(-.+)?$");
+
 	@Input
 	private String gitHubAccessToken;
 	@Input
@@ -44,9 +50,12 @@ public class SaganCreateReleaseTask extends DefaultTask {
 		// Antora reference docs URLs for snapshots do not contain -SNAPSHOT
 		String referenceDocUrl = this.referenceDocUrl;
 		if (this.version.endsWith("-SNAPSHOT")) {
-			referenceDocUrl = this.referenceDocUrl
-					.replace("{version}", this.version)
-					.replace("-SNAPSHOT", "");
+			Matcher versionMatcher = VERSION_PATTERN.matcher(this.version);
+			Assert.isTrue(versionMatcher.matches(), "Version " + this.version + " does not match expected pattern");
+			String majorVersion = versionMatcher.group(1);
+			String minorVersion = versionMatcher.group(2);
+			String majorMinorVersion = String.format("%s.%s-SNAPSHOT", majorVersion, minorVersion);
+			referenceDocUrl = this.referenceDocUrl.replace("{version}", majorMinorVersion);
 		}
 
 		SaganApi sagan = new SaganApi(user.getLogin(), this.gitHubAccessToken);

config/src/main/java/org/springframework/security/config/annotation/method/configuration/Jsr250MethodSecurityConfiguration.java

@@ -17,9 +17,9 @@
 package org.springframework.security.config.annotation.method.configuration;
 
 import io.micrometer.observation.ObservationRegistry;
+import org.aopalliance.intercept.MethodInterceptor;
 import org.aopalliance.intercept.MethodInvocation;
 
-import org.springframework.aop.Advisor;
 import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Bean;
@@ -46,7 +46,8 @@ final class Jsr250MethodSecurityConfiguration {
 
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	Advisor jsr250AuthorizationMethodInterceptor(ObjectProvider<GrantedAuthorityDefaults> defaultsProvider,
+	static MethodInterceptor jsr250AuthorizationMethodInterceptor(
+			ObjectProvider<GrantedAuthorityDefaults> defaultsProvider,
 			ObjectProvider<SecurityContextHolderStrategy> strategyProvider,
 			ObjectProvider<ObservationRegistry> registryProvider) {
 		Jsr250AuthorizationManager jsr250 = new Jsr250AuthorizationManager();

config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecurityAdvisorRegistrar.java

@@ -0,0 +1,52 @@
+/*
+ * Copyright 2002-2023 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.config.annotation.method.configuration;
+
+import org.springframework.aop.Advisor;
+import org.springframework.beans.factory.config.BeanDefinition;
+import org.springframework.beans.factory.support.BeanDefinitionRegistry;
+import org.springframework.beans.factory.support.RootBeanDefinition;
+import org.springframework.context.annotation.ImportBeanDefinitionRegistrar;
+import org.springframework.core.type.AnnotationMetadata;
+
+class MethodSecurityAdvisorRegistrar implements ImportBeanDefinitionRegistrar {
+
+	@Override
+	public void registerBeanDefinitions(AnnotationMetadata importingClassMetadata, BeanDefinitionRegistry registry) {
+		registerAsAdvisor("preFilterAuthorization", registry);
+		registerAsAdvisor("preAuthorizeAuthorization", registry);
+		registerAsAdvisor("postFilterAuthorization", registry);
+		registerAsAdvisor("postAuthorizeAuthorization", registry);
+		registerAsAdvisor("securedAuthorization", registry);
+		registerAsAdvisor("jsr250Authorization", registry);
+	}
+
+	private void registerAsAdvisor(String prefix, BeanDefinitionRegistry registry) {
+		String interceptorName = prefix + "MethodInterceptor";
+		if (!registry.containsBeanDefinition(interceptorName)) {
+			return;
+		}
+		BeanDefinition definition = registry.getBeanDefinition(interceptorName);
+		if (!(definition instanceof RootBeanDefinition)) {
+			return;
+		}
+		RootBeanDefinition advisor = new RootBeanDefinition((RootBeanDefinition) definition);
+		advisor.setTargetType(Advisor.class);
+		registry.registerBeanDefinition(prefix + "Advisor", advisor);
+	}
+
+}

config/src/main/java/org/springframework/security/config/annotation/method/configuration/MethodSecuritySelector.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2022 the original author or authors.
+ * Copyright 2002-2023 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -60,7 +60,8 @@ final class MethodSecuritySelector implements ImportSelector {
 
 	private static final class AutoProxyRegistrarSelector extends AdviceModeImportSelector<EnableMethodSecurity> {
 
-		private static final String[] IMPORTS = new String[] { AutoProxyRegistrar.class.getName() };
+		private static final String[] IMPORTS = new String[] { AutoProxyRegistrar.class.getName(),
+				MethodSecurityAdvisorRegistrar.class.getName() };
 
 		private static final String[] ASPECTJ_IMPORTS = new String[] {
 				MethodSecurityAspectJAutoProxyRegistrar.class.getName() };

config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java

@@ -17,8 +17,8 @@
 package org.springframework.security.config.annotation.method.configuration;
 
 import io.micrometer.observation.ObservationRegistry;
+import org.aopalliance.intercept.MethodInterceptor;
 
-import org.springframework.aop.Advisor;
 import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.ApplicationContext;
@@ -52,7 +52,8 @@ final class PrePostMethodSecurityConfiguration {
 
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	Advisor preFilterAuthorizationMethodInterceptor(ObjectProvider<GrantedAuthorityDefaults> defaultsProvider,
+	static MethodInterceptor preFilterAuthorizationMethodInterceptor(
+			ObjectProvider<GrantedAuthorityDefaults> defaultsProvider,
 			ObjectProvider<MethodSecurityExpressionHandler> expressionHandlerProvider,
 			ObjectProvider<SecurityContextHolderStrategy> strategyProvider, ApplicationContext context) {
 		PreFilterAuthorizationMethodInterceptor preFilter = new PreFilterAuthorizationMethodInterceptor();
@@ -64,7 +65,8 @@ final class PrePostMethodSecurityConfiguration {
 
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	Advisor preAuthorizeAuthorizationMethodInterceptor(ObjectProvider<GrantedAuthorityDefaults> defaultsProvider,
+	static MethodInterceptor preAuthorizeAuthorizationMethodInterceptor(
+			ObjectProvider<GrantedAuthorityDefaults> defaultsProvider,
 			ObjectProvider<MethodSecurityExpressionHandler> expressionHandlerProvider,
 			ObjectProvider<SecurityContextHolderStrategy> strategyProvider,
 			ObjectProvider<AuthorizationEventPublisher> eventPublisherProvider,
@@ -81,7 +83,8 @@ final class PrePostMethodSecurityConfiguration {
 
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	Advisor postAuthorizeAuthorizationMethodInterceptor(ObjectProvider<GrantedAuthorityDefaults> defaultsProvider,
+	static MethodInterceptor postAuthorizeAuthorizationMethodInterceptor(
+			ObjectProvider<GrantedAuthorityDefaults> defaultsProvider,
 			ObjectProvider<MethodSecurityExpressionHandler> expressionHandlerProvider,
 			ObjectProvider<SecurityContextHolderStrategy> strategyProvider,
 			ObjectProvider<AuthorizationEventPublisher> eventPublisherProvider,
@@ -98,7 +101,8 @@ final class PrePostMethodSecurityConfiguration {
 
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	Advisor postFilterAuthorizationMethodInterceptor(ObjectProvider<GrantedAuthorityDefaults> defaultsProvider,
+	static MethodInterceptor postFilterAuthorizationMethodInterceptor(
+			ObjectProvider<GrantedAuthorityDefaults> defaultsProvider,
 			ObjectProvider<MethodSecurityExpressionHandler> expressionHandlerProvider,
 			ObjectProvider<SecurityContextHolderStrategy> strategyProvider, ApplicationContext context) {
 		PostFilterAuthorizationMethodInterceptor postFilter = new PostFilterAuthorizationMethodInterceptor();

config/src/main/java/org/springframework/security/config/annotation/method/configuration/SecuredMethodSecurityConfiguration.java

@@ -17,9 +17,9 @@
 package org.springframework.security.config.annotation.method.configuration;
 
 import io.micrometer.observation.ObservationRegistry;
+import org.aopalliance.intercept.MethodInterceptor;
 import org.aopalliance.intercept.MethodInvocation;
 
-import org.springframework.aop.Advisor;
 import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Bean;
@@ -46,7 +46,8 @@ final class SecuredMethodSecurityConfiguration {
 
 	@Bean
 	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
-	Advisor securedAuthorizationMethodInterceptor(ObjectProvider<SecurityContextHolderStrategy> strategyProvider,
+	static MethodInterceptor securedAuthorizationMethodInterceptor(
+			ObjectProvider<SecurityContextHolderStrategy> strategyProvider,
 			ObjectProvider<ObservationRegistry> registryProvider) {
 		SecuredAuthorizationManager secured = new SecuredAuthorizationManager();
 		SecurityContextHolderStrategy strategy = strategyProvider

config/src/main/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.java

@@ -19,8 +19,11 @@ package org.springframework.security.config.annotation.web;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Map;
 
 import jakarta.servlet.DispatcherType;
+import jakarta.servlet.ServletContext;
+import jakarta.servlet.ServletRegistration;
 
 import org.springframework.beans.factory.NoSuchBeanDefinitionException;
 import org.springframework.context.ApplicationContext;
@@ -36,6 +39,7 @@ import org.springframework.security.web.util.matcher.RegexRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;
 import org.springframework.util.ClassUtils;
+import org.springframework.web.context.WebApplicationContext;
 import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
 
 /**
@@ -179,14 +183,47 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 	 * @since 5.8
 	 */
 	public C requestMatchers(HttpMethod method, String... patterns) {
-		List<RequestMatcher> matchers = new ArrayList<>();
-		if (mvcPresent) {
-			matchers.addAll(createMvcMatchers(method, patterns));
+		if (!mvcPresent) {
+			return requestMatchers(RequestMatchers.antMatchersAsArray(method, patterns));
 		}
-		else {
-			matchers.addAll(RequestMatchers.antMatchers(method, patterns));
+		if (!(this.context instanceof WebApplicationContext)) {
+			return requestMatchers(RequestMatchers.antMatchersAsArray(method, patterns));
 		}
-		return requestMatchers(matchers.toArray(new RequestMatcher[0]));
+		WebApplicationContext context = (WebApplicationContext) this.context;
+		ServletContext servletContext = context.getServletContext();
+		if (servletContext == null) {
+			return requestMatchers(RequestMatchers.antMatchersAsArray(method, patterns));
+		}
+		Map<String, ? extends ServletRegistration> registrations = servletContext.getServletRegistrations();
+		if (registrations == null) {
+			return requestMatchers(RequestMatchers.antMatchersAsArray(method, patterns));
+		}
+		if (!hasDispatcherServlet(registrations)) {
+			return requestMatchers(RequestMatchers.antMatchersAsArray(method, patterns));
+		}
+		Assert.isTrue(registrations.size() == 1,
+				"This method cannot decide whether these patterns are Spring MVC patterns or not. If this endpoint is a Spring MVC endpoint, please use requestMatchers(MvcRequestMatcher); otherwise, please use requestMatchers(AntPathRequestMatcher).");
+		return requestMatchers(createMvcMatchers(method, patterns).toArray(new RequestMatcher[0]));
+	}
+
+	private boolean hasDispatcherServlet(Map<String, ? extends ServletRegistration> registrations) {
+		if (registrations == null) {
+			return false;
+		}
+		Class<?> dispatcherServlet = ClassUtils.resolveClassName("org.springframework.web.servlet.DispatcherServlet",
+				null);
+		for (ServletRegistration registration : registrations.values()) {
+			try {
+				Class<?> clazz = Class.forName(registration.getClassName());
+				if (dispatcherServlet.isAssignableFrom(clazz)) {
+					return true;
+				}
+			}
+			catch (ClassNotFoundException ex) {
+				return false;
+			}
+		}
+		return false;
 	}
 
 	/**
@@ -262,12 +299,7 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 		 * @return a {@link List} of {@link AntPathRequestMatcher} instances
 		 */
 		static List<RequestMatcher> antMatchers(HttpMethod httpMethod, String... antPatterns) {
-			String method = (httpMethod != null) ? httpMethod.toString() : null;
-			List<RequestMatcher> matchers = new ArrayList<>();
-			for (String pattern : antPatterns) {
-				matchers.add(new AntPathRequestMatcher(pattern, method));
-			}
-			return matchers;
+			return Arrays.asList(antMatchersAsArray(httpMethod, antPatterns));
 		}
 
 		/**
@@ -281,6 +313,15 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 			return antMatchers(null, antPatterns);
 		}
 
+		static RequestMatcher[] antMatchersAsArray(HttpMethod httpMethod, String... antPatterns) {
+			String method = (httpMethod != null) ? httpMethod.toString() : null;
+			RequestMatcher[] matchers = new RequestMatcher[antPatterns.length];
+			for (int index = 0; index < antPatterns.length; index++) {
+				matchers[index] = new AntPathRequestMatcher(antPatterns[index], method);
+			}
+			return matchers;
+		}
+
 		/**
 		 * Create a {@link List} of {@link RegexRequestMatcher} instances.
 		 * @param httpMethod the {@link HttpMethod} to use or {@code null} for any

config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java

@@ -781,8 +781,8 @@ class HttpConfigurationBuilder {
 		BeanDefinitionBuilder builder = BeanDefinitionBuilder.rootBeanDefinition(FilterSecurityInterceptor.class);
 		builder.addPropertyReference("accessDecisionManager", accessManagerId);
 		builder.addPropertyValue("authenticationManager", authManager);
-		if ("false".equals(this.httpElt.getAttribute(ATT_ONCE_PER_REQUEST))) {
-			builder.addPropertyValue("observeOncePerRequest", Boolean.FALSE);
+		if ("true".equals(this.httpElt.getAttribute(ATT_ONCE_PER_REQUEST))) {
+			builder.addPropertyValue("observeOncePerRequest", Boolean.TRUE);
 		}
 		builder.addPropertyValue("securityMetadataSource", securityMds);
 		builder.addPropertyValue("securityContextHolderStrategy", this.holderStrategyRef);

config/src/main/java/org/springframework/security/config/web/server/AbstractServerWebExchangeMatcherRegistry.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2017 the original author or authors.
+ * Copyright 2002-2023 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@
 
 package org.springframework.security.config.web.server;
 
+import java.util.ArrayList;
 import java.util.List;
 
 import org.springframework.http.HttpMethod;
@@ -23,6 +24,8 @@ import org.springframework.security.web.server.util.matcher.OrServerWebExchangeM
 import org.springframework.security.web.server.util.matcher.PathPatternParserServerWebExchangeMatcher;
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
 import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
+import org.springframework.web.util.pattern.PathPattern;
+import org.springframework.web.util.pattern.PathPatternParser;
 
 /**
  * @author Rob Winch
@@ -62,7 +65,8 @@ public abstract class AbstractServerWebExchangeMatcherRegistry<T> {
 	 * {@link ServerWebExchangeMatcher}
 	 */
 	public T pathMatchers(HttpMethod method, String... antPatterns) {
-		return matcher(ServerWebExchangeMatchers.pathMatchers(method, antPatterns));
+		List<PathPattern> pathPatterns = parsePatterns(antPatterns);
+		return matcher(ServerWebExchangeMatchers.pathMatchers(method, pathPatterns.toArray(new PathPattern[0])));
 	}
 
 	/**
@@ -74,7 +78,19 @@ public abstract class AbstractServerWebExchangeMatcherRegistry<T> {
 	 * {@link ServerWebExchangeMatcher}
 	 */
 	public T pathMatchers(String... antPatterns) {
-		return matcher(ServerWebExchangeMatchers.pathMatchers(antPatterns));
+		List<PathPattern> pathPatterns = parsePatterns(antPatterns);
+		return matcher(ServerWebExchangeMatchers.pathMatchers(pathPatterns.toArray(new PathPattern[0])));
+	}
+
+	private List<PathPattern> parsePatterns(String[] antPatterns) {
+		PathPatternParser parser = getPathPatternParser();
+		List<PathPattern> pathPatterns = new ArrayList<>(antPatterns.length);
+		for (String pattern : antPatterns) {
+			pattern = parser.initFullPathPattern(pattern);
+			PathPattern pathPattern = parser.parse(pattern);
+			pathPatterns.add(pathPattern);
+		}
+		return pathPatterns;
 	}
 
 	/**
@@ -96,6 +112,10 @@ public abstract class AbstractServerWebExchangeMatcherRegistry<T> {
 	 */
 	protected abstract T registerMatcher(ServerWebExchangeMatcher matcher);
 
+	protected PathPatternParser getPathPatternParser() {
+		return PathPatternParser.defaultInstance;
+	}
+
 	/**
 	 * Associates a {@link ServerWebExchangeMatcher} instances
 	 * @param matcher the {@link ServerWebExchangeMatcher} instance

config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java

@@ -191,9 +191,11 @@ import org.springframework.web.cors.reactive.CorsConfigurationSource;
 import org.springframework.web.cors.reactive.CorsProcessor;
 import org.springframework.web.cors.reactive.CorsWebFilter;
 import org.springframework.web.cors.reactive.DefaultCorsProcessor;
+import org.springframework.web.reactive.result.method.annotation.RequestMappingHandlerMapping;
 import org.springframework.web.server.ServerWebExchange;
 import org.springframework.web.server.WebFilter;
 import org.springframework.web.server.WebFilterChain;
+import org.springframework.web.util.pattern.PathPatternParser;
 
 /**
  * A {@link ServerHttpSecurity} is similar to Spring Security's {@code HttpSecurity} but
@@ -1661,6 +1663,18 @@ public class ServerHttpSecurity {
 		return null;
 	}
 
+	private <T> T getBeanOrNull(String beanName, Class<T> requiredClass) {
+		if (this.context == null) {
+			return null;
+		}
+		try {
+			return this.context.getBean(beanName, requiredClass);
+		}
+		catch (Exception ex) {
+			return null;
+		}
+	}
+
 	private <T> String[] getBeanNamesForTypeOrEmpty(Class<T> beanClass) {
 		if (this.context == null) {
 			return new String[0];
@@ -1681,6 +1695,8 @@ public class ServerHttpSecurity {
 	 */
 	public class AuthorizeExchangeSpec extends AbstractServerWebExchangeMatcherRegistry<AuthorizeExchangeSpec.Access> {
 
+		private static final String REQUEST_MAPPING_HANDLER_MAPPING_BEAN_NAME = "requestMappingHandlerMapping";
+
 		private DelegatingReactiveAuthorizationManager.Builder managerBldr = DelegatingReactiveAuthorizationManager
 				.builder();
 
@@ -1688,6 +1704,8 @@ public class ServerHttpSecurity {
 
 		private boolean anyExchangeRegistered;
 
+		private PathPatternParser pathPatternParser;
+
 		/**
 		 * Allows method chaining to continue configuring the {@link ServerHttpSecurity}
 		 * @return the {@link ServerHttpSecurity} to continue configuring
@@ -1710,6 +1728,22 @@ public class ServerHttpSecurity {
 			return result;
 		}
 
+		@Override
+		protected PathPatternParser getPathPatternParser() {
+			if (this.pathPatternParser != null) {
+				return this.pathPatternParser;
+			}
+			RequestMappingHandlerMapping requestMappingHandlerMapping = getBeanOrNull(
+					REQUEST_MAPPING_HANDLER_MAPPING_BEAN_NAME, RequestMappingHandlerMapping.class);
+			if (requestMappingHandlerMapping != null) {
+				this.pathPatternParser = requestMappingHandlerMapping.getPathPatternParser();
+			}
+			if (this.pathPatternParser == null) {
+				this.pathPatternParser = PathPatternParser.defaultInstance;
+			}
+			return this.pathPatternParser;
+		}
+
 		@Override
 		protected Access registerMatcher(ServerWebExchangeMatcher matcher) {
 			Assert.state(!this.anyExchangeRegistered, () -> "Cannot register " + matcher

config/src/test/java/org/springframework/security/config/MockServletContext.java

@@ -0,0 +1,139 @@
+/*
+ * Copyright 2002-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.config;
+
+import java.util.Collection;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Set;
+
+import jakarta.servlet.MultipartConfigElement;
+import jakarta.servlet.Servlet;
+import jakarta.servlet.ServletRegistration;
+import jakarta.servlet.ServletSecurityElement;
+
+import org.springframework.lang.NonNull;
+import org.springframework.web.servlet.DispatcherServlet;
+
+public class MockServletContext extends org.springframework.mock.web.MockServletContext {
+
+	private final Map<String, ServletRegistration> registrations = new LinkedHashMap<>();
+
+	public static MockServletContext mvc() {
+		MockServletContext servletContext = new MockServletContext();
+		servletContext.addServlet("dispatcherServlet", DispatcherServlet.class);
+		return servletContext;
+	}
+
+	@NonNull
+	@Override
+	public ServletRegistration.Dynamic addServlet(@NonNull String servletName, Class<? extends Servlet> clazz) {
+		ServletRegistration.Dynamic dynamic = new MockServletRegistration(servletName, clazz);
+		this.registrations.put(servletName, dynamic);
+		return dynamic;
+	}
+
+	@NonNull
+	@Override
+	public Map<String, ? extends ServletRegistration> getServletRegistrations() {
+		return this.registrations;
+	}
+
+	private static class MockServletRegistration implements ServletRegistration.Dynamic {
+
+		private final String name;
+
+		private final Class<?> clazz;
+
+		MockServletRegistration(String name, Class<?> clazz) {
+			this.name = name;
+			this.clazz = clazz;
+		}
+
+		@Override
+		public void setLoadOnStartup(int loadOnStartup) {
+
+		}
+
+		@Override
+		public Set<String> setServletSecurity(ServletSecurityElement constraint) {
+			return null;
+		}
+
+		@Override
+		public void setMultipartConfig(MultipartConfigElement multipartConfig) {
+
+		}
+
+		@Override
+		public void setRunAsRole(String roleName) {
+
+		}
+
+		@Override
+		public void setAsyncSupported(boolean isAsyncSupported) {
+
+		}
+
+		@Override
+		public Set<String> addMapping(String... urlPatterns) {
+			return null;
+		}
+
+		@Override
+		public Collection<String> getMappings() {
+			return null;
+		}
+
+		@Override
+		public String getRunAsRole() {
+			return null;
+		}
+
+		@Override
+		public String getName() {
+			return this.name;
+		}
+
+		@Override
+		public String getClassName() {
+			return this.clazz.getName();
+		}
+
+		@Override
+		public boolean setInitParameter(String name, String value) {
+			return false;
+		}
+
+		@Override
+		public String getInitParameter(String name) {
+			return null;
+		}
+
+		@Override
+		public Set<String> setInitParameters(Map<String, String> initParameters) {
+			return null;
+		}
+
+		@Override
+		public Map<String, String> getInitParameters() {
+			return null;
+		}
+
+	}
+
+}

config/src/test/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistryTests.java

@@ -19,18 +19,22 @@ package org.springframework.security.config.annotation.web;
 import java.util.List;
 
 import jakarta.servlet.DispatcherType;
+import jakarta.servlet.Servlet;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 import org.springframework.beans.factory.NoSuchBeanDefinitionException;
 import org.springframework.context.ApplicationContext;
 import org.springframework.http.HttpMethod;
+import org.springframework.security.config.MockServletContext;
 import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 import org.springframework.security.web.util.matcher.DispatcherTypeRequestMatcher;
 import org.springframework.security.web.util.matcher.RegexRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
+import org.springframework.web.context.WebApplicationContext;
+import org.springframework.web.servlet.DispatcherServlet;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@@ -54,12 +58,15 @@ public class AbstractRequestMatcherRegistryTests {
 
 	private TestRequestMatcherRegistry matcherRegistry;
 
+	private WebApplicationContext context;
+
 	@BeforeEach
 	public void setUp() {
 		this.matcherRegistry = new TestRequestMatcherRegistry();
-		ApplicationContext context = mock(ApplicationContext.class);
-		given(context.getBean(ObjectPostProcessor.class)).willReturn(NO_OP_OBJECT_POST_PROCESSOR);
-		this.matcherRegistry.setApplicationContext(context);
+		this.context = mock(WebApplicationContext.class);
+		given(this.context.getBean(ObjectPostProcessor.class)).willReturn(NO_OP_OBJECT_POST_PROCESSOR);
+		given(this.context.getServletContext()).willReturn(MockServletContext.mvc());
+		this.matcherRegistry.setApplicationContext(this.context);
 		mockMvcIntrospector(true);
 	}
 
@@ -147,6 +154,32 @@ public class AbstractRequestMatcherRegistryTests {
 						"Please ensure Spring Security & Spring MVC are configured in a shared ApplicationContext");
 	}
 
+	@Test
+	public void requestMatchersWhenNoDispatcherServletThenAntPathRequestMatcherType() {
+		MockServletContext servletContext = new MockServletContext();
+		given(this.context.getServletContext()).willReturn(servletContext);
+		List<RequestMatcher> requestMatchers = this.matcherRegistry.requestMatchers("/**");
+		assertThat(requestMatchers).isNotEmpty();
+		assertThat(requestMatchers).hasSize(1);
+		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(AntPathRequestMatcher.class);
+		servletContext.addServlet("servletOne", Servlet.class);
+		servletContext.addServlet("servletTwo", Servlet.class);
+		requestMatchers = this.matcherRegistry.requestMatchers("/**");
+		assertThat(requestMatchers).isNotEmpty();
+		assertThat(requestMatchers).hasSize(1);
+		assertThat(requestMatchers.get(0)).isExactlyInstanceOf(AntPathRequestMatcher.class);
+	}
+
+	@Test
+	public void requestMatchersWhenAmbiguousServletsThenException() {
+		MockServletContext servletContext = new MockServletContext();
+		given(this.context.getServletContext()).willReturn(servletContext);
+		servletContext.addServlet("dispatcherServlet", DispatcherServlet.class);
+		servletContext.addServlet("servletTwo", Servlet.class);
+		assertThatExceptionOfType(IllegalArgumentException.class)
+				.isThrownBy(() -> this.matcherRegistry.requestMatchers("/**"));
+	}
+
 	private void mockMvcIntrospector(boolean isPresent) {
 		ApplicationContext context = this.matcherRegistry.getApplicationContext();
 		given(context.containsBean("mvcHandlerMappingIntrospector")).willReturn(isPresent);

config/src/test/java/org/springframework/security/config/annotation/web/configurers/AuthorizeRequestsTests.java

@@ -28,10 +28,10 @@ import org.springframework.http.HttpMethod;
 import org.springframework.mock.web.MockFilterChain;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
-import org.springframework.mock.web.MockServletContext;
 import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
 import org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.config.MockServletContext;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.core.authority.AuthorityUtils;
@@ -77,7 +77,7 @@ public class AuthorizeRequestsTests {
 
 	@BeforeEach
 	public void setup() {
-		this.servletContext = spy(new MockServletContext());
+		this.servletContext = spy(MockServletContext.mvc());
 		this.request = new MockHttpServletRequest("GET", "");
 		this.request.setMethod("GET");
 		this.response = new MockHttpServletResponse();

config/src/test/java/org/springframework/security/config/annotation/web/configurers/HttpSecuritySecurityMatchersTests.java

@@ -32,7 +32,7 @@ import org.springframework.core.annotation.Order;
 import org.springframework.mock.web.MockFilterChain;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
-import org.springframework.mock.web.MockServletContext;
+import org.springframework.security.config.MockServletContext;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.core.userdetails.User;
@@ -220,7 +220,7 @@ public class HttpSecuritySecurityMatchersTests {
 	public void loadConfig(Class<?>... configs) {
 		this.context = new AnnotationConfigWebApplicationContext();
 		this.context.register(configs);
-		this.context.setServletContext(new MockServletContext());
+		this.context.setServletContext(MockServletContext.mvc());
 		this.context.refresh();
 		this.context.getAutowireCapableBeanFactory().autowireBean(this);
 	}

config/src/test/java/org/springframework/security/config/annotation/web/configurers/UrlAuthorizationConfigurerTests.java

@@ -30,8 +30,8 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.mock.web.MockFilterChain;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
-import org.springframework.mock.web.MockServletContext;
 import org.springframework.security.config.Customizer;
+import org.springframework.security.config.MockServletContext;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.core.userdetails.PasswordEncodedUser;
@@ -167,7 +167,7 @@ public class UrlAuthorizationConfigurerTests {
 	public void loadConfig(Class<?>... configs) {
 		this.context = new AnnotationConfigWebApplicationContext();
 		this.context.register(configs);
-		this.context.setServletContext(new MockServletContext());
+		this.context.setServletContext(MockServletContext.mvc());
 		this.context.refresh();
 		this.context.getAutowireCapableBeanFactory().autowireBean(this);
 	}

config/src/test/java/org/springframework/security/config/http/MiscHttpConfigTests.java

@@ -323,6 +323,13 @@ public class MiscHttpConfigTests {
 		assertThat(filterSecurityInterceptor.isObserveOncePerRequest()).isFalse();
 	}
 
+	@Test
+	public void configureWhenOncePerRequestIsTrueThenFilterSecurityInterceptorObserveOncePerRequestIsTrue() {
+		this.spring.configLocations(xml("OncePerRequestTrue")).autowire();
+		FilterSecurityInterceptor filterSecurityInterceptor = getFilter(FilterSecurityInterceptor.class);
+		assertThat(filterSecurityInterceptor.isObserveOncePerRequest()).isTrue();
+	}
+
 	@Test
 	public void requestWhenCustomHttpBasicEntryPointRefThenInvokesOnCommence() throws Exception {
 		this.spring.configLocations(xml("CustomHttpBasicEntryPointRef")).autowire();

config/src/test/java/org/springframework/security/config/test/SpringTestContext.java

@@ -28,8 +28,8 @@ import jakarta.servlet.http.HttpServletResponse;
 
 import org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor;
 import org.springframework.mock.web.MockServletConfig;
-import org.springframework.mock.web.MockServletContext;
 import org.springframework.security.config.BeanIds;
+import org.springframework.security.config.MockServletContext;
 import org.springframework.security.config.util.InMemoryXmlWebApplicationContext;
 import org.springframework.test.context.web.GenericXmlWebContextLoader;
 import org.springframework.test.web.servlet.MockMvc;
@@ -132,7 +132,7 @@ public class SpringTestContext implements Closeable {
 
 	public ConfigurableWebApplicationContext getContext() {
 		if (!this.context.isRunning()) {
-			this.context.setServletContext(new MockServletContext());
+			this.context.setServletContext(MockServletContext.mvc());
 			this.context.setServletConfig(new MockServletConfig());
 			this.context.refresh();
 		}
@@ -140,7 +140,7 @@ public class SpringTestContext implements Closeable {
 	}
 
 	public void autowire() {
-		this.context.setServletContext(new MockServletContext());
+		this.context.setServletContext(MockServletContext.mvc());
 		this.context.setServletConfig(new MockServletConfig());
 		for (Consumer<ConfigurableWebApplicationContext> postProcessor : this.postProcessors) {
 			postProcessor.accept(this.context);

config/src/test/resources/org/springframework/security/config/http/MiscHttpConfigTests-OncePerRequestTrue.xml

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2002-2023 the original author or authors.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~      https://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<b:beans xmlns:b="http://www.springframework.org/schema/beans"
+		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+		xmlns="http://www.springframework.org/schema/security"
+		xsi:schemaLocation="
+			http://www.springframework.org/schema/security
+			https://www.springframework.org/schema/security/spring-security.xsd
+			http://www.springframework.org/schema/beans
+			https://www.springframework.org/schema/beans/spring-beans.xsd">
+
+	<http once-per-request="true" use-authorization-manager="false">
+		<http-basic/>
+		<intercept-url pattern="/protected" access="authenticated"/>
+		<intercept-url pattern="/unprotected-forwards-to-protected" access="permitAll"/>
+	</http>
+
+	<b:import resource="userservice.xml"/>
+	<b:import resource="handlermappingintrospector.xml"/>
+</b:beans>

core/src/main/java/org/springframework/security/authorization/AuthorizationManagers.java

@@ -41,11 +41,17 @@ public final class AuthorizationManagers {
 			List<AuthorizationDecision> decisions = new ArrayList<>();
 			for (AuthorizationManager<T> manager : managers) {
 				AuthorizationDecision decision = manager.check(authentication, object);
-				if (decision == null || decision.isGranted()) {
+				if (decision == null) {
+					continue;
+				}
+				if (decision.isGranted()) {
 					return decision;
 				}
 				decisions.add(decision);
 			}
+			if (decisions.isEmpty()) {
+				return new AuthorizationDecision(false);
+			}
 			return new CompositeAuthorizationDecision(false, decisions);
 		};
 	}
@@ -64,11 +70,17 @@ public final class AuthorizationManagers {
 			List<AuthorizationDecision> decisions = new ArrayList<>();
 			for (AuthorizationManager<T> manager : managers) {
 				AuthorizationDecision decision = manager.check(authentication, object);
-				if (decision != null && !decision.isGranted()) {
+				if (decision == null) {
+					continue;
+				}
+				if (!decision.isGranted()) {
 					return decision;
 				}
 				decisions.add(decision);
 			}
+			if (decisions.isEmpty()) {
+				return new AuthorizationDecision(true);
+			}
 			return new CompositeAuthorizationDecision(true, decisions);
 		};
 	}

core/src/test/java/org/springframework/security/authorization/AuthorizationManagersTests.java

@@ -36,12 +36,14 @@ class AuthorizationManagersTests {
 		assertThat(decision.isGranted()).isTrue();
 	}
 
+	// gh-13069
 	@Test
-	void checkAnyOfWhenOneAbstainedThenAbstainedDecision() {
+	void checkAnyOfWhenAllNonAbstainingDeniesThenDeniedDecision() {
 		AuthorizationManager<?> composed = AuthorizationManagers.anyOf((a, o) -> new AuthorizationDecision(false),
 				(a, o) -> null);
 		AuthorizationDecision decision = composed.check(null, null);
-		assertThat(decision).isNull();
+		assertThat(decision).isNotNull();
+		assertThat(decision.isGranted()).isFalse();
 	}
 
 	@Test
@@ -61,8 +63,9 @@ class AuthorizationManagersTests {
 		assertThat(decision.isGranted()).isTrue();
 	}
 
+	// gh-13069
 	@Test
-	void checkAllOfWhenOneAbstainedThenGrantedDecision() {
+	void checkAllOfWhenAllNonAbstainingGrantsThenGrantedDecision() {
 		AuthorizationManager<?> composed = AuthorizationManagers.allOf((a, o) -> new AuthorizationDecision(true),
 				(a, o) -> null);
 		AuthorizationDecision decision = composed.check(null, null);

dependencies/spring-security-dependencies.gradle

@@ -12,7 +12,7 @@ dependencies {
 	api platform("io.rsocket:rsocket-bom:1.1.4")
 	api platform("org.junit:junit-bom:5.9.3")
 	api platform("org.mockito:mockito-bom:4.8.1")
-	api platform("org.springframework.data:spring-data-bom:2022.0.7")
+	api platform("org.springframework.data:spring-data-bom:2022.0.8")
 	api platform("org.jetbrains.kotlin:kotlin-bom:$kotlinVersion")
 	api platform("org.jetbrains.kotlinx:kotlinx-coroutines-bom:1.6.4")
 	api platform("com.fasterxml.jackson:jackson-bom:2.14.3")
@@ -34,8 +34,8 @@ dependencies {
 		api "jakarta.servlet:jakarta.servlet-api:6.0.0"
 		api "jakarta.xml.bind:jakarta.xml.bind-api:4.0.0"
 		api "jakarta.persistence:jakarta.persistence-api:3.1.0"
-		api "jakarta.websocket:jakarta.websocket-api:2.1.0"
-		api "jakarta.websocket:jakarta.websocket-client-api:2.1.0"
+		api "jakarta.websocket:jakarta.websocket-api:2.1.1"
+		api "jakarta.websocket:jakarta.websocket-client-api:2.1.1"
 		api "ldapsdk:ldapsdk:4.1"
 		api "net.sourceforge.htmlunit:htmlunit:2.66.0"
 		api "org.apache.directory.server:apacheds-core-entry:1.5.5"

docs/modules/ROOT/pages/servlet/architecture.adoc

@@ -164,44 +164,222 @@ In fact, a `SecurityFilterChain` might have zero security `Filter` instances if
 == Security Filters
 
 The Security Filters are inserted into the <<servlet-filterchainproxy>> with the <<servlet-securityfilterchain>> API.
-The <<servlet-filters-review,order of `Filter`>> instances matters.
-It is typically not necessary to know the ordering of Spring Security's `Filter` instances.
-However, there are times that it is beneficial to know the ordering.
+Those filters can be used for a number of different purposes, like xref:servlet/authentication/index.adoc[authentication], xref:servlet/authorization/index.adoc[authorization], xref:servlet/exploits/index.adoc[exploit protection], and more.
+The filters are executed in a specific order to guarantee that they are invoked at the right time, for example, the `Filter` that performs authentication should be invoked before the `Filter` that performs authorization.
+It is typically not necessary to know the ordering of Spring Security's ``Filter``s.
+However, there are times that it is beneficial to know the ordering, if you want to know them, you can check the {gh-url}/config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterOrderRegistration.java[`FilterOrderRegistration` code].
 
-The following is a comprehensive list of Spring Security Filter ordering:
+To exemplify the above paragraph, let's consider the following security configuration:
+
+====
+.Java
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+        http
+            .csrf(Customizer.withDefaults())
+            .authorizeHttpRequests(authorize -> authorize
+                .anyRequest().authenticated()
+            )
+            .httpBasic(Customizer.withDefaults())
+            .formLogin(Customizer.withDefaults());
+        return http.build();
+    }
+
+}
+----
+.Kotlin
+[source,kotlin,role="secondary"]
+----
+import org.springframework.security.config.web.servlet.invoke
+
+@Configuration
+@EnableWebSecurity
+class SecurityConfig {
+
+    @Bean
+    fun filterChain(http: HttpSecurity): SecurityFilterChain {
+        http {
+            csrf { }
+            authorizeHttpRequests {
+                authorize(anyRequest, authenticated)
+            }
+            httpBasic { }
+            formLogin { }
+        }
+        return http.build()
+    }
+
+}
+----
+====
+
+The above configuration will result in the following `Filter` ordering:
+
+[cols="1,1", options="header"]
+|====
+| Filter | Added by
+| xref:servlet/exploits/csrf.adoc[CsrfFilter] | `HttpSecurity#csrf`
+| xref:servlet/authentication/passwords/form.adoc#servlet-authentication-form[UsernamePasswordAuthenticationFilter] | `HttpSecurity#formLogin`
+| xref:servlet/authentication/passwords/basic.adoc[BasicAuthenticationFilter] | `HttpSecurity#httpBasic`
+| xref:servlet/authorization/authorize-http-requests.adoc[AuthorizationFilter] | `HttpSecurity#authorizeHttpRequests`
+|====
+
+1. First, the `CsrfFilter` is invoked to protect against xref:servlet/exploits/csrf.adoc[CSRF attacks].
+2. Second, the authentication filters are invoked to authenticate the request.
+3. Third, the `AuthorizationFilter` is invoked to authorize the request.
+
+[NOTE]
+====
+There might be other `Filter` instances that are not listed above.
+If you want to see the list of filters invoked for a particular request, you can <<servlet-print-filters,print them>>.
+====
+
+[[servlet-print-filters]]
+=== Printing the Security Filters
+
+Often times, it is useful to see the list of security ``Filter``s that are invoked for a particular request.
+For example, you want to make sure that the <<adding-custom-filter,filter you have added>> is in the list of the security filters.
+
+The list of filters is printed at INFO level on the application startup, so you can see something like the following on the console output for example:
+
+[source,text,role="terminal"]
+----
+2023-06-14T08:55:22.321-03:00  INFO 76975 --- [           main] o.s.s.web.DefaultSecurityFilterChain     : Will secure any request with [
+org.springframework.security.web.session.DisableEncodeUrlFilter@404db674,
+org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@50f097b5,
+org.springframework.security.web.context.SecurityContextHolderFilter@6fc6deb7,
+org.springframework.security.web.header.HeaderWriterFilter@6f76c2cc,
+org.springframework.security.web.csrf.CsrfFilter@c29fe36,
+org.springframework.security.web.authentication.logout.LogoutFilter@ef60710,
+org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@7c2dfa2,
+org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter@4397a639,
+org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter@7add838c,
+org.springframework.security.web.authentication.www.BasicAuthenticationFilter@5cc9d3d0,
+org.springframework.security.web.savedrequest.RequestCacheAwareFilter@7da39774,
+org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@32b0876c,
+org.springframework.security.web.authentication.AnonymousAuthenticationFilter@3662bdff,
+org.springframework.security.web.access.ExceptionTranslationFilter@77681ce4,
+org.springframework.security.web.access.intercept.AuthorizationFilter@169268a7]
+----
+
+And that will give a pretty good idea of the security filters that are configured for <<servlet-securityfilterchain,each filter chain>>.
+
+But that is not all, you can also configure your application to print the invocation of each individual filter for each request.
+That is helpful to see if the filter you have added is invoked for a particular request or to check where an exception is coming from.
+To do that, you can configure your application to <<servlet-logging,log the security events>>.
+
+[[adding-custom-filter]]
+=== Adding a Custom Filter to the Filter Chain
+
+Mostly of the times, the default security filters are enough to provide security to your application.
+However, there might be times that you want to add a custom `Filter` to the security filter chain.
+
+For example, let's say that you want to add a `Filter` that gets a tenant id header and check if the current user has access to that tenant.
+The previous description already gives us a clue on where to add the filter, since we need to know the current user, we need to add it after the authentication filters.
+
+First, let's create the `Filter`:
+
+[source,java]
+----
+import java.io.IOException;
+
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import org.springframework.security.access.AccessDeniedException;
+
+public class TenantFilter implements Filter {
+
+    @Override
+    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
+        HttpServletRequest request = (HttpServletRequest) servletRequest;
+        HttpServletResponse response = (HttpServletResponse) servletResponse;
+
+        String tenantId = request.getHeader("X-Tenant-Id"); <1>
+        boolean hasAccess = isUserAllowed(tenantId); <2>
+        if (hasAccess) {
+            filterChain.doFilter(request, response); <3>
+            return;
+        }
+        throw new AccessDeniedException("Access denied"); <4>
+    }
+
+}
+
+----
+
+The sample code above does the following:
+
+<1> Get the tenant id from the request header.
+<2> Check if the current user has access to the tenant id.
+<3> If the user has access, then invoke the rest of the filters in the chain.
+<4> If the user does not have access, then throw an `AccessDeniedException`.
+
+[TIP]
+====
+Instead of implementing `Filter`, you can extend from {spring-framework-api-url}org/springframework/web/filter/OncePerRequestFilter.html[OncePerRequestFilter] which is a base class for filters that are only invoked once per request and provides a `doFilterInternal` method with the `HttpServletRequest` and `HttpServletResponse` parameters.
+====
+
+Now, we need to add the filter to the security filter chain.
+
+====
+.Java
+[source,java,role="primary"]
+----
+@Bean
+SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http
+        // ...
+        .addFilterBefore(new TenantFilter(), AuthorizationFilter.class); <1>
+    return http.build();
+}
+----
+.Kotlin
+[source,kotlin,role="secondary"]
+----
+@Bean
+fun filterChain(http: HttpSecurity): SecurityFilterChain {
+    http
+        // ...
+        .addFilterBefore(TenantFilter(), AuthorizationFilter::class.java) <1>
+    return http.build()
+}
+----
+====
+
+<1> Use `HttpSecurity#addFilterBefore` to add the `TenantFilter` before the `AuthorizationFilter`.
+
+By adding the filter before the `AuthorizationFilter` we are making sure that the `TenantFilter` is invoked after the authentication filters.
+You can also use `HttpSecurity#addFilterAfter` to add the filter after a particular filter or `HttpSecurity#addFilterAt` to add the filter at a particular filter position in the filter chain.
+
+And that's it, now the `TenantFilter` will be invoked in the filter chain and will check if the current user has access to the tenant id.
+
+Be careful when you declare your filter as a Spring bean, either by annotating it with `@Component` or by declaring it as a bean in your configuration, because Spring Boot will automatically {spring-boot-reference-url}web.html#web.servlet.embedded-container.servlets-filters-listeners.beans[register it with the embedded container].
+That may cause the filter to be invoked twice, once by the container and once by Spring Security and in a different order.
+
+If you still want to declare your filter as a Spring bean to take advantage of dependency injection for example, and avoid the duplicate invocation, you can tell Spring Boot to not register it with the container by declaring a `FilterRegistrationBean` bean and setting its `enabled` property to `false`:
+
+[source,java]
+----
+@Bean
+public FilterRegistrationBean<TenantFilter> tenantFilterRegistration(TenantFilter filter) {
+    FilterRegistrationBean<TenantFilter> registration = new FilterRegistrationBean<>(filter);
+    registration.setEnabled(false);
+    return registration;
+}
+----
 
-* xref:servlet/authentication/session-management.adoc#session-mgmt-force-session-creation[`ForceEagerSessionCreationFilter`]
-* `ChannelProcessingFilter`
-* `WebAsyncManagerIntegrationFilter`
-* `SecurityContextPersistenceFilter`
-* `HeaderWriterFilter`
-* `CorsFilter`
-* `CsrfFilter`
-* `LogoutFilter`
-* `OAuth2AuthorizationRequestRedirectFilter`
-* `Saml2WebSsoAuthenticationRequestFilter`
-* `X509AuthenticationFilter`
-* `AbstractPreAuthenticatedProcessingFilter`
-* `CasAuthenticationFilter`
-* `OAuth2LoginAuthenticationFilter`
-* `Saml2WebSsoAuthenticationFilter`
-* xref:servlet/authentication/passwords/form.adoc#servlet-authentication-usernamepasswordauthenticationfilter[`UsernamePasswordAuthenticationFilter`]
-* `DefaultLoginPageGeneratingFilter`
-* `DefaultLogoutPageGeneratingFilter`
-* `ConcurrentSessionFilter`
-* xref:servlet/authentication/passwords/digest.adoc#servlet-authentication-digest[`DigestAuthenticationFilter`]
-* `BearerTokenAuthenticationFilter`
-* xref:servlet/authentication/passwords/basic.adoc#servlet-authentication-basic[`BasicAuthenticationFilter`]
-* <<requestcacheawarefilter,RequestCacheAwareFilter>>
-* `SecurityContextHolderAwareRequestFilter`
-* `JaasApiIntegrationFilter`
-* `RememberMeAuthenticationFilter`
-* `AnonymousAuthenticationFilter`
-* `OAuth2AuthorizationCodeGrantFilter`
-* `SessionManagementFilter`
-* <<servlet-exceptiontranslationfilter,`ExceptionTranslationFilter`>>
-* xref:servlet/authorization/authorize-http-requests.adoc[`AuthorizationFilter`]
-* `SwitchUserFilter`
 
 [[servlet-exceptiontranslationfilter]]
 == Handling Security Exceptions
@@ -333,3 +511,52 @@ XML::
 === RequestCacheAwareFilter
 
 The {security-api-url}org/springframework/security/web/savedrequest/RequestCacheAwareFilter.html[`RequestCacheAwareFilter`] uses the <<requestcache,`RequestCache`>> to save the `HttpServletRequest`.
+
+[[servlet-logging]]
+== Logging
+
+Spring Security provides comprehensive logging of all security related events at the DEBUG and TRACE level.
+This can be very useful when debugging your application because for security measures Spring Security does not add any detail of why a request has been rejected to the response body.
+If you come across a 401 or 403 error, it is very likely that you will find a log message that will help you understand what is going on.
+
+Let's consider an example where a user tries to make a `POST` request to a resource that has xref:servlet/exploits/csrf.adoc[CSRF protection] enabled without the CSRF token.
+With no logs, the user will see a 403 error with no explanation of why the request was rejected.
+However, if you enable logging for Spring Security, you will see a log message like this:
+
+[source,text]
+----
+2023-06-14T09:44:25.797-03:00 DEBUG 76975 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy        : Securing POST /hello
+2023-06-14T09:44:25.797-03:00 TRACE 76975 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking DisableEncodeUrlFilter (1/15)
+2023-06-14T09:44:25.798-03:00 TRACE 76975 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking WebAsyncManagerIntegrationFilter (2/15)
+2023-06-14T09:44:25.800-03:00 TRACE 76975 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking SecurityContextHolderFilter (3/15)
+2023-06-14T09:44:25.801-03:00 TRACE 76975 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking HeaderWriterFilter (4/15)
+2023-06-14T09:44:25.802-03:00 TRACE 76975 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy        : Invoking CsrfFilter (5/15)
+2023-06-14T09:44:25.814-03:00 DEBUG 76975 --- [nio-8080-exec-1] o.s.security.web.csrf.CsrfFilter         : Invalid CSRF token found for http://localhost:8080/hello
+2023-06-14T09:44:25.814-03:00 DEBUG 76975 --- [nio-8080-exec-1] o.s.s.w.access.AccessDeniedHandlerImpl   : Responding with 403 status code
+2023-06-14T09:44:25.814-03:00 TRACE 76975 --- [nio-8080-exec-1] o.s.s.w.header.writers.HstsHeaderWriter  : Not injecting HSTS header since it did not match request to [Is Secure]
+----
+
+It becomes clear that the CSRF token is missing and that is why the request is being denied.
+
+To configure your application to log all the security events, you can add the following to your application:
+
+====
+.application.properties in Spring Boot
+[source,properties,role="primary"]
+----
+logging.level.org.springframework.security=TRACE
+----
+.logback.xml
+[source,xml,role="secondary"]
+----
+<configuration>
+    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+        <!-- ... -->
+    </appender>
+    <!-- ... -->
+    <logger name="org.springframework.security" level="trace" additivity="false">
+        <appender-ref ref="Console" />
+    </logger>
+</configuration>
+----
+====

docs/modules/ROOT/pages/servlet/oauth2/resource-server/jwt.adoc

@@ -176,7 +176,7 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
         .authorizeHttpRequests(authorize -> authorize
             .anyRequest().authenticated()
         )
-        .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt);
+        .oauth2ResourceServer((oauth2) -> oauth2.jwt(Customizer.withDefaults()));
     return http.build();
 }
 ----

docs/modules/ROOT/pages/servlet/saml2/login/authentication.adoc

@@ -29,7 +29,7 @@ Java::
 SecurityFilterChain securityFilters(HttpSecurity http) throws Exception {
 	http
         // ...
-        .saml2Login((saml2) -> saml2.filterProcessingUrl("/saml2/login/sso"))
+        .saml2Login((saml2) -> saml2.loginProcessingUrl("/saml2/login/sso"))
         // ...
 
     return http.build();
@@ -45,7 +45,7 @@ fun securityFilters(val http: HttpSecurity): SecurityFilterChain {
 	http {
         // ...
         .saml2Login {
-            filterProcessingUrl = "/saml2/login/sso"
+            loginProcessingUrl = "/saml2/login/sso"
         }
         // ...
     }

gradle.properties

@@ -1,11 +1,11 @@
 aspectjVersion=1.9.19
-reactorVersion=2022.0.8
+reactorVersion=2022.0.9
 springJavaformatVersion=0.0.39
-springBootVersion=3.0.6
-springFrameworkVersion=6.0.10
-micrometerVersion=1.10.8
+springBootVersion=3.1.1
+springFrameworkVersion=6.0.11
+micrometerVersion=1.10.9
 openSamlVersion=4.1.1
-version=6.1.1
+version=6.1.2
 kotlinVersion=1.8.22
 samplesBranch=main
 org.gradle.jvmargs=-Xmx3g -XX:+HeapDumpOnOutOfMemoryError

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,5 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-7.5.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-7.6.2-bin.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

gradlew

@@ -205,6 +205,12 @@ set -- \
         org.gradle.wrapper.GradleWrapperMain \
         "$@"
 
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
 # Use "xargs" to parse quoted args.
 #
 # With -n1 it outputs one arg per line, with the quotes and backslashes removed.

gradlew.bat

@@ -14,7 +14,7 @@
 @rem limitations under the License.
 @rem
 
-@if "%DEBUG%" == "" @echo off
+@if "%DEBUG%"=="" @echo off
 @rem ##########################################################################
 @rem
 @rem  Gradle startup script for Windows
@@ -25,7 +25,7 @@
 if "%OS%"=="Windows_NT" setlocal
 
 set DIRNAME=%~dp0
-if "%DIRNAME%" == "" set DIRNAME=.
+if "%DIRNAME%"=="" set DIRNAME=.
 set APP_BASE_NAME=%~n0
 set APP_HOME=%DIRNAME%
 
@@ -40,7 +40,7 @@ if defined JAVA_HOME goto findJavaFromJavaHome
 
 set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
-if "%ERRORLEVEL%" == "0" goto execute
+if %ERRORLEVEL% equ 0 goto execute
 
 echo.
 echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
@@ -75,13 +75,15 @@ set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
 
 :end
 @rem End local scope for the variables with windows NT shell
-if "%ERRORLEVEL%"=="0" goto mainEnd
+if %ERRORLEVEL% equ 0 goto mainEnd
 
 :fail
 rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
 rem the _cmd.exe /c_ return code!
-if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
-exit /b 1
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
 
 :mainEnd
 if "%OS%"=="Windows_NT" endlocal

oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/AbstractWebClientReactiveOAuth2AccessTokenResponseClient.java

@@ -115,7 +115,8 @@ public abstract class AbstractWebClientReactiveOAuth2AccessTokenResponseClient<T
 		if (!supportedClientAuthenticationMethod) {
 			throw new IllegalArgumentException(String.format(
 					"This class supports `client_secret_basic`, `client_secret_post`, and `none` by default. Client [%s] is using [%s] instead. Please use a supported client authentication method, or use `set/addParametersConverter` or `set/addHeadersConverter` to supply an instance that supports [%s].",
-					clientRegistration.getRegistrationId(), clientAuthenticationMethod, clientAuthenticationMethod));
+					clientRegistration.getRegistrationId(), clientAuthenticationMethod.getValue(),
+					clientAuthenticationMethod.getValue()));
 		}
 	}
 

oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/endpoint/ClientAuthenticationMethodValidatingRequestEntityConverter.java

@@ -41,7 +41,7 @@ class ClientAuthenticationMethodValidatingRequestEntityConverter<T extends Abstr
 				|| clientAuthenticationMethod.equals(ClientAuthenticationMethod.CLIENT_SECRET_POST);
 		Assert.isTrue(supportedClientAuthenticationMethod, () -> String.format(
 				"This class supports `client_secret_basic`, `client_secret_post`, and `none` by default. Client [%s] is using [%s] instead. Please use a supported client authentication method, or use `setRequestEntityConverter` to supply an instance that supports [%s].",
-				registrationId, clientAuthenticationMethod, clientAuthenticationMethod));
+				registrationId, clientAuthenticationMethod.getValue(), clientAuthenticationMethod.getValue()));
 		return this.delegate.convert(grantRequest);
 	}
 

web/src/main/java/org/springframework/security/web/access/intercept/AuthorizationFilter.java

@@ -206,7 +206,7 @@ public class AuthorizationFilter extends GenericFilterBean {
 
 	/**
 	 * Sets whether this filter apply only once per request. By default, this is
-	 * <code>true</code>, meaning the filter will only execute once per request. Sometimes
+	 * <code>false</code>, meaning the filter will execute on every request. Sometimes
 	 * users may wish it to execute more than once per request, such as when JSP forwards
 	 * are being used and filter security is desired on each included fragment of the HTTP
 	 * request.
@@ -218,7 +218,8 @@ public class AuthorizationFilter extends GenericFilterBean {
 	}
 
 	/**
-	 * If set to true, the filter will be applied to error dispatcher. Defaults to false.
+	 * If set to true, the filter will be applied to error dispatcher. Defaults to
+	 * {@code true}.
 	 * @param filterErrorDispatch whether the filter should be applied to error dispatcher
 	 */
 	public void setFilterErrorDispatch(boolean filterErrorDispatch) {
@@ -227,7 +228,7 @@ public class AuthorizationFilter extends GenericFilterBean {
 
 	/**
 	 * If set to true, the filter will be applied to the async dispatcher. Defaults to
-	 * false.
+	 * {@code true}.
 	 * @param filterAsyncDispatch whether the filter should be applied to async dispatch
 	 */
 	public void setFilterAsyncDispatch(boolean filterAsyncDispatch) {

web/src/main/java/org/springframework/security/web/savedrequest/DefaultSavedRequest.java

@@ -37,6 +37,7 @@ import org.springframework.security.web.PortResolver;
 import org.springframework.security.web.util.UrlUtils;
 import org.springframework.util.Assert;
 import org.springframework.util.ObjectUtils;
+import org.springframework.web.util.UriComponentsBuilder;
 
 /**
  * Represents central information from a {@code HttpServletRequest}.
@@ -371,10 +372,8 @@ public class DefaultSavedRequest implements SavedRequest {
 		if (queryString == null || queryString.length() == 0) {
 			return matchingRequestParameterName;
 		}
-		if (queryString.endsWith("&")) {
-			return queryString + matchingRequestParameterName;
-		}
-		return queryString + "&" + matchingRequestParameterName;
+		return UriComponentsBuilder.newInstance().query(queryString).replaceQueryParam(matchingRequestParameterName)
+				.queryParam(matchingRequestParameterName).build().getQuery();
 	}
 
 	/**

web/src/main/java/org/springframework/security/web/server/util/matcher/PathPatternParserServerWebExchangeMatcher.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2023 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -42,8 +42,6 @@ public final class PathPatternParserServerWebExchangeMatcher implements ServerWe
 
 	private static final Log logger = LogFactory.getLog(PathPatternParserServerWebExchangeMatcher.class);
 
-	private static final PathPatternParser DEFAULT_PATTERN_PARSER = new PathPatternParser();
-
 	private final PathPattern pattern;
 
 	private final HttpMethod method;
@@ -60,7 +58,7 @@ public final class PathPatternParserServerWebExchangeMatcher implements ServerWe
 
 	public PathPatternParserServerWebExchangeMatcher(String pattern, HttpMethod method) {
 		Assert.notNull(pattern, "pattern cannot be null");
-		this.pattern = DEFAULT_PATTERN_PARSER.parse(pattern);
+		this.pattern = parse(pattern);
 		this.method = method;
 	}
 
@@ -68,6 +66,12 @@ public final class PathPatternParserServerWebExchangeMatcher implements ServerWe
 		this(pattern, null);
 	}
 
+	private PathPattern parse(String pattern) {
+		PathPatternParser parser = PathPatternParser.defaultInstance;
+		pattern = parser.initFullPathPattern(pattern);
+		return parser.parse(pattern);
+	}
+
 	@Override
 	public Mono<MatchResult> matches(ServerWebExchange exchange) {
 		ServerHttpRequest request = exchange.getRequest();

web/src/main/java/org/springframework/security/web/server/util/matcher/ServerWebExchangeMatchers.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2017 the original author or authors.
+ * Copyright 2002-2023 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,6 +23,7 @@ import reactor.core.publisher.Mono;
 
 import org.springframework.http.HttpMethod;
 import org.springframework.web.server.ServerWebExchange;
+import org.springframework.web.util.pattern.PathPattern;
 
 /**
  * Provides factory methods for creating common {@link ServerWebExchangeMatcher}
@@ -59,6 +60,30 @@ public abstract class ServerWebExchangeMatchers {
 		return pathMatchers(null, patterns);
 	}
 
+	/**
+	 * Creates a matcher that matches on any of the provided {@link PathPattern}s.
+	 * @param pathPatterns the {@link PathPattern}s to match on
+	 * @return the matcher to use
+	 */
+	public static ServerWebExchangeMatcher pathMatchers(PathPattern... pathPatterns) {
+		return pathMatchers(null, pathPatterns);
+	}
+
+	/**
+	 * Creates a matcher that matches on the specific method and any of the provided
+	 * {@link PathPattern}s.
+	 * @param method the method to match on. If null, any method will be matched.
+	 * @param pathPatterns the {@link PathPattern}s to match on
+	 * @return the matcher to use
+	 */
+	public static ServerWebExchangeMatcher pathMatchers(HttpMethod method, PathPattern... pathPatterns) {
+		List<ServerWebExchangeMatcher> matchers = new ArrayList<>(pathPatterns.length);
+		for (PathPattern pathPattern : pathPatterns) {
+			matchers.add(new PathPatternParserServerWebExchangeMatcher(pathPattern, method));
+		}
+		return new OrServerWebExchangeMatcher(matchers);
+	}
+
 	/**
 	 * Creates a matcher that will match on any of the provided matchers
 	 * @param matchers the matchers to match on

web/src/test/java/org/springframework/security/web/savedrequest/DefaultSavedRequestTests.java

@@ -122,4 +122,14 @@ public class DefaultSavedRequestTests {
 		assertThat(new URL(savedRequest.getRedirectUrl())).hasQuery("foo=bar&success");
 	}
 
+	// gh-13438
+	@Test
+	public void getRedirectUrlWhenQueryAlreadyHasSuccessThenDoesNotAdd() throws Exception {
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.setQueryString("foo=bar&success");
+		DefaultSavedRequest savedRequest = new DefaultSavedRequest(request, new MockPortResolver(8080, 8443),
+				"success");
+		assertThat(savedRequest.getRedirectUrl()).contains("foo=bar&success");
+	}
+
 }

web/src/test/java/org/springframework/security/web/server/util/matcher/PathPatternParserServerWebExchangeMatcherTests.java

@@ -0,0 +1,40 @@
+/*
+ * Copyright 2002-2023 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.web.server.util.matcher;
+
+import org.junit.jupiter.api.Test;
+
+import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
+import org.springframework.mock.web.server.MockServerWebExchange;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Tests for {@link PathPatternParserServerWebExchangeMatcher}
+ *
+ * @author Marcus da Coregio
+ */
+class PathPatternParserServerWebExchangeMatcherTests {
+
+	@Test
+	void matchesWhenConfiguredWithNoTrailingSlashAndPathContainsSlashThenMatches() {
+		PathPatternParserServerWebExchangeMatcher matcher = new PathPatternParserServerWebExchangeMatcher("user/**");
+		MockServerHttpRequest request = MockServerHttpRequest.get("/user/test").build();
+		assertThat(matcher.matches(MockServerWebExchange.from(request)).block().isMatch()).isTrue();
+	}
+
+}