anchor.diff:  ----
   ====
   
  +[[servlet-authorizationmanager-messages-opt-out]]
  +==== Opt-out Steps
  +
  +In case you had trouble, take a look at these scenarios for optimal opt out behavior:
  +
  +===== I cannot declare an authorization rule for all requests
  +
  +If you are having trouble setting an `anyRequest` authorization rule of `denyAll`, please use {security-api-url}org/springframework/security/messaging/access/intercept/MessageMatcherDelegatingAuthorizationManager.Builder.Constraint.html#permitAll()[`permitAll`] instead, like so:
  +
  +====
  +.Java
  +[source,java,role="primary"]
  +----
  +@Bean
  +AuthorizationManager<Message<?>> messageSecurity(MessageMatcherDelegatingAuthorizationManager.Builder messages) {
  +    messages
  +        .simpDestMatchers("/user/queue/errors").permitAll()
  +        .simpDestMatchers("/admin/**").hasRole("ADMIN")
  +        // ...
  +        .anyMessage().permitAll();
  +	return messages.build();
  +}
  +----
  +
  +.Kotlin
  +[source,kotlin,role="secondary"]
  +----
  +@Bean
  +fun messageSecurity(val messages: MessageMatcherDelegatingAuthorizationManager.Builder): AuthorizationManager<Message<?>> {
  +    messages
  +        .simpDestMatchers("/user/queue/errors").permitAll()
  +        .simpDestMatchers("/admin/**").hasRole("ADMIN")
  +        // ...
  +        .anyMessage().permitAll();
  +    return messages.build()
  +}
  +----
  +
  +.Xml
  +[source,xml,role="secondary"]
  +----
  +<websocket-message-broker use-authorization-manager="true">
  +    <intercept-message pattern="/user/queue/errors" access="permitAll"/>
  +    <intercept-message pattern="/admin/**" access="hasRole('ADMIN')"/>
  +    <!-- ... -->
  +    <intercept-message pattern="/**" access="permitAll"/>
  +</websocket-message-broker>
  +----
  +====
  +
  +===== I cannot get CSRF working, need some other `AbstractSecurityWebSocketMessageBrokerConfigurer` feature, or am having trouble with `AuthorizationManager`
  +
  +In the case of Java, you may continue using `AbstractMessageSecurityWebSocketMessageBrokerConfigurer`.
  +Even though it is deprecated, it will not be removed in 6.0.
  +
  +In the case of XML, you can opt out of `AuthorizationManager` by setting `use-authorization-manager="false"`:
  +
  +====
  +.Xml
  +[source,xml,role="secondary"]
  +----
  +<websocket-message-broker>
  +    <intercept-message pattern="/user/queue/errors" access="permitAll"/>
  +    <intercept-message pattern="/admin/**" access="hasRole('ADMIN')"/>
  +</websocket-message-broker>
  +----
  +====
  +
  +to:
  +
  +====
  +.Xml
  +[source,xml,role="secondary"]
  +----
  +<websocket-message-broker use-authorization-manager="false">
  +    <intercept-message pattern="/user/queue/errors" access="permitAll"/>
  +    <intercept-message pattern="/admin/**" access="hasRole('ADMIN')"/>
  +</websocket-message-broker>
  +----
  +====
  +
   === Use `AuthorizationManager` for Request Security
   
   xref:servlet/authorization/authorize-requests.adoc[HTTP Request Security] has been xref:servlet/authorization/authorize-http-requests.adoc[simplified] through {security-api-url}org/springframework/security/authorization/AuthorizationManager.html[the `AuthorizationManager` API].
   
  -==== Declare the 5.8 default
  -
  -Spring Security 5.8 and earlier only xref:servlet/authorization/architecture.adoc[perform authorization] once per request.
  -This means that dispatcher types like `FORWARD` and `INCLUDE` that run after `REQUEST` are not secured by default.
  -
  -It's recommended that Spring Security secure all dispatch types.
  -As such, in 6.0, Spring Security changes this default.
  -
  -In case you have trouble with the remaining steps and cannot use `AuthorizationManager` at this time, it's recommended as a first step to declare the 5.8 default so that the 5.8 behavior is preserved when you update.
  -
  -To declare the 5.8 default, change:
  -
  -====
  -.Java
  -[source,java,role="primary"]
  -----
  -http
  -    .authorizeRequests((authorize) -> authorize
  -        .mvcMatchers("/app/**").hasRole("APP")
  -        // ...
  -    )
  -    // ...
  -----
  -
  -.Kotlin
  -[source,kotlin,role="secondary"]
  -----
  -http {
  -    authorizeRequests {
  -        authorize("/messages/**", hasRole("APP"))
  -        // ...
  -    }
  -}
  -----
  -
  -.Xml
  -[source,xml,role="secondary"]
  -----
  -<http>
  -    <intercept-url pattern="/app/*" access="hasRole('APP')"/>
  -    <!-- ... -->
  -</http>
  -----
  -====
  -
  -to:
  -
  -====
  -.Java
  -[source,java,role="primary"]
  -----
  -http
  -    .authorizeRequests((authorize) -> authorize
  -        .filterSecurityInterceptorOncePerRequest(true)
  -        .mvcMatchers("/app/**").hasRole("APP")
  -        // ...
  -    )
  -    // ...
  -----
  -
  -.Kotlin
  -[source,kotlin,role="secondary"]
  -----
  -http {
  -    authorizeRequests {
  -        filterSecurityInterceptorOncePerRequest = true
  -        authorize("/messages/**", hasRole("APP"))
  -        // ...
  -    }
  -}
  -----
  -
  -.Xml
  -[source,xml,role="secondary"]
  -----
  -<http once-per-request="true" use-authorization-manager="false">
  -    <intercept-url pattern="/app/*" access="hasRole('APP')"/>
  -    <!-- ... -->
  -</http>
  -----
  -====
  -
  -Or, if you already migrated to `authorizeHttpRequests` in a previous release, change:
  -
  -====
  -.Java
  -[source,java,role="primary"]
  -----
  -http
  -    .authorizeHttpRequests((authorize) -> authorize
  -        .mvcMatchers("/app/**").hasRole("APP")
  -        // ...
  -    )
  -    // ...
  -----
  -
  -.Kotlin
  -[source,kotlin,role="secondary"]
  -----
  -http {
  -    authorizeHttpRequests {
  -        authorize("/messages/**", hasRole("APP"))
  -        // ...
  -    }
  -}
  -----
  -====
  -
  -to:
  -
  -====
  -.Java
  -[source,java,role="primary"]
  -----
  -http
  -    .authorizeHttpRequests((authorize) -> authorize
  -        .shouldFilterAllDispatcherTypes(false)
  -        .mvcMatchers("/app/**").hasRole("APP")
  -        // ...
  -    )
  -    // ...
  -----
  -
  -.Kotlin
  -[source,kotlin,role="secondary"]
  -----
  -http {
  -    authorizeHttpRequests {
  -        shouldFilterAllDispatcherTypes = false
  -        authorize("/messages/**", hasRole("APP"))
  -        // ...
  -    }
  -}
  -----
  -====
  -
  -This value will be switched in a later step, but now you are ready for upgrading in case you run into trouble with the remaining steps.
  +Should you run into trouble with making these changes, you can follow the <<servlet-authorizationmanager-requests-opt-out,opt out steps>> at the end of this section.
   
   ==== Ensure that all requests have defined authorization rules
   
  
positive.code: 
  xref:servlet/authorization/method-security.adoc[Method Security] has been xref:servlet/authorization/method-security.adoc#jc-enable-method-security[simplified] through {security-api-url}org/springframework/security/authorization/AuthorizationManager.html[the `AuthorizationManager` API] and direct use of Spring AOP.
  
  '''
  
  [[servlet-replace-globalmethodsecurity-with-methodsecurity]]
  
negative.code: 
  ==== Switch to filter all dispatcher types
  
  Spring Security 5.8 and earlier only xref:servlet/authorization/architecture.adoc[perform authorization] once per request.
  This means that dispatcher types like `FORWARD` and `INCLUDE` that run after `REQUEST` are not secured by default.
  
  It's recommended that Spring Security secure all dispatch types.
  As such, in 6.0, Spring Security changes this default.
  
  So, finally, change your authorization rules to filter all dispatcher types.
  
  To do this, change:
  
  