Add Reactive Security

[rwinch]

Please add a reactive security option

cc @joshlong

[snicoll]

Please expand what that means.

[rwinch]

The equivalent of the Security but for Reactive.

[snicoll]

We will, of course, add a Reactive Security option to Initialzr but there are a few things that need to happen first:

1. Spring Boot needs to be using a version of Spring Security with Reactive Support
2. Spring Boot needs to have auto-configuration for Reactive Security
3. Spring Boot needs to provide a Reactive Security starter

I am not 100% sure about 3 yet but regardless I don't see this request happening before proper support land in Spring Boot. Have I missed something?

[rwinch]

Thanks. I think it makes sense to wait for this list to be taken care of.

Spring Security 5.0.0.M1+ includes reactive support so this should be taken care of.

I believe that the second one will be addressed in Spring Boot M4 which is when we are planning for addressing Spring Security Auto configuration.

I'm not sure what Boot will do in terms of starters for Reactive Security either.

[sdeleuze]

Another important point IMO : Spring Security should support the functional web API as well. We do our best to mutualize infrastrcture between annotation and functional variants, so there is maybe not much to do, but worth to check since Boot supports both.

[rwinch]

We do support it through the same setup as annotated framework. See https://github.com/spring-projects/spring-security/tree/master/samples/javaconfig/hellowebfluxfn/src/main/java/sample

Given the amount of effort due to lack of overlap in the APIs and the fact that Functional API does not support global filtering I'm not sure we will ever support registration through the route API.

[snicoll]

See spring-projects/spring-boot#10301