reactor/reactor

Hi, everyone

TL;DR: Adding a SecurityWebFilterChain @Bean in my security config made my rest controller start executing requests on boundedElastic threads and I can't understand why and how to avoid this (assuming it should be avoided).

At work I use Spring Boot with Webflux. I wanted to fool around a bit with the framework to test a couple of things, the threading model, schedulers and wrapping blocking calls to mention some, so I decided to create a new project from scratch to make things a bit simpler. I didn't get far before I discovered something that I find a bit peculiar, and that I'm hoping someone here can help me sort out.

I started out creating a simple rest controller:

@RestController
public class SimpleController {

    private final Logger logger = LoggerFactory.getLogger(getClass());

    @GetMapping("/thread")
    public Mono<ResponseEntity<String>> thread() {

        logger.info("Received a GET request on endpoint /thread");

        return Mono.just("Hello from ThreadsApplication")
                .doOnNext(msg -> logger.info("Controller doing its work on thread: {}", Thread.currentThread().getName()))
                .map(msg -> {
                    logger.info("Returning the message: {}", msg);
                    return new ResponseEntity<>(msg, HttpStatus.OK);
                });
    }
}

All fine and dandy, incoming requests are executed on reactor-http-epoll threads.

Then I wanted to add some security, so I added spring-boot-starter-security to my POM and set up the following configuration:

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public MapReactiveUserDetailsService userDetailsService() {
        UserDetails user = User
                .withUsername("a")
                .password(passwordEncoder().encode("a"))
                .roles("USER")
                .build();
        return new MapReactiveUserDetailsService(user);
    }
}

Okay, so now security is activated and you have to provide credentials to access the rest controller's endpoints.

The next step was to play with permissions, so I started simple and added this to the security configuration, effectively "deactivating" it again:

@Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {

        http.authorizeExchange()
                .anyExchange()
                .permitAll();

        return http.build();
    }

But suddenly, after adding this, all requests received in the controller started running on boundedElastic threads?! Why does this happen? Is the SecurityWebFilterChain somehow blocking, triggering the use of boundedElastic through some auto-configuring? I thought one of the principles behind Webflux was having an event loop with a limited set of threads that do the main work (reactor-http threads), and offload some work to e.g. boundedElastic if needed, like if you need to do blocking calls. It thus seems very strange that the rest controller suddenly started using boundedElastic threads "by default".

I hope someone can help alleviate my confusion.

The application can be found in its entirety here: https://github.com/bhhoffmann/webflux-threads (PS: The code that makes the rest controller run on boundedElastic threads is commented out in the SecurityConfig class)