anchor.diff:  
   xref:servlet/integrations/websocket.adoc[Message Security] has been xref:servlet/integrations/websocket.adoc#websocket-configuration[improved] through {security-api-url}org/springframework/security/authorization/AuthorizationManager.html[the `AuthorizationManager` API] and direct use of Spring AOP.
   
  -==== Declare the 5.8 default
  -
  -In case you run into trouble with the ensuing steps and cannot use `AuthorizationManager` at this time, it's recommended as a first step to declare you are using the 5.8 default so that 5.8 behavior is preserved when you update.
  -
  -The only default to change for Method Security is if you are using `<websocket-message-broker>` in which case you will change:
  -
  -====
  -.Xml
  -[source,xml,role="secondary"]
  -----
  -<websocket-message-broker>
  -    <intercept-message pattern="/user/queue/errors" access="permitAll"/>
  -    <intercept-message pattern="/admin/**" access="hasRole('ADMIN')"/>
  -</websocket-message-broker>
  -----
  -====
  -
  -to:
  -
  -====
  -.Xml
  -[source,xml,role="secondary"]
  -----
  -<websocket-message-broker use-authorization-manager="false">
  -    <intercept-message pattern="/user/queue/errors" access="permitAll"/>
  -    <intercept-message pattern="/admin/**" access="hasRole('ADMIN')"/>
  -</websocket-message-broker>
  -----
  -====
  -
  -Later steps will turn this value back on, but now your code is minimally ready for upgrading in case you run into trouble with the remaining steps.
  +Should you run into trouble with making these changes, you can follow the <<servlet-authorizationmanager-messages-opt-out,opt out steps>> at the end of this section.
   
   ==== Ensure all messages have defined authorization rules
   
  
positive.code: ----
  ====
  
  == Reactive
  
  === Use `AuthorizationManager` for Method Security
  
  xref:reactive/authorization/method.adoc[Method Security] has been xref:reactive/authorization/method.adoc#jc-enable-reactive-method-security-authorization-manager[improved] through {security-api-url}org/springframework/security/authorization/AuthorizationManager.html[the `AuthorizationManager` API] and direct use of Spring AOP.
  
  '''
  
  In Spring Security 5.8, `useAuthorizationManager` was added to {security-api-url}org/springframework/security/config/annotation/method/configuration/EnableReactiveMethodSecurity.html[`@EnableReactiveMethodSecurity`] to allow applications to opt in to ``AuthorizationManager``'s features.
  
  ==== Declare the 5.8 default
  
  First, declare the 5.8 default:
  
  ====
  .Java
  [source,java,role="primary"]
  ----
  @EnableReactiveMethodSecurity
  ----
  
  .Kotlin
  [source,kotlin,role="secondary"]
  ----
  @EnableReactiveMethodSecurity
  ----
  ====
  
  to:
  
  ====
  .Java
  [source,java,role="primary"]
  ----
  @EnableReactiveMethodSecurity(useAuthorizationManager = false)
  ----
  
  .Kotlin
  [source,kotlin,role="secondary"]
  ----
  @EnableReactiveMethodSecurity(useAuthorizationManager = false)
  ----
  ====
  
  This is helpful because, if the remaining preparation steps cannot be taken, you can still upgrade to 6.0 while keeping this feature as-is.
  
  [[reactive-change-to-useauthorizationmanager]]
  ==== Change `useAuthorizationManager` to `true`
  
negative.code: 
  ==== Switch to filter all dispatcher types
  
  Spring Security 5.8 and earlier only xref:servlet/authorization/architecture.adoc[perform authorization] once per request.
  This means that dispatcher types like `FORWARD` and `INCLUDE` that run after `REQUEST` are not secured by default.
  
  It's recommended that Spring Security secure all dispatch types.
  As such, in 6.0, Spring Security changes this default.
  
  So, finally, change your authorization rules to filter all dispatcher types.
  
  To do this, change:
  
  