anchor.diff:  	<repository>
   		<id>spring-milestone</id>
   		<name>Spring Milestone Repository</name>
  -		<url>http://repo.spring.io/milestone</url>
  +		<url>https://repo.spring.io/milestone</url>
   	</repository>
   </repositories>
   ----
   
  -[[maven-bom]]
  -=== Spring Framework BOM
  -
  -Spring Security builds against Spring Framework {spring-version}, but should work with 5
  -The problem that many users will have is that Spring Security's transitive dependencies resolve Spring Framework {spring-version} which can cause strange classpath problems.
  -
  -One (tedious) way to circumvent this issue would be to include all the Spring Framework modules in a http://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Dependency_Management[<dependencyManagement>] section of your pom.
  -An alternative approach is to include the `spring-framework-bom` within your `<dependencyManagement>` section of your `pom.xml` as shown below:
  -
  -.pom.xml
  -[source,xml]
  -[subs="verbatim,attributes"]
  -----
  -<dependencyManagement>
  -	<dependencies>
  -	<dependency>
  -		<groupId>org.springframework</groupId>
  -		<artifactId>spring-framework-bom</artifactId>
  -		<version>{spring-version}</version>
  -		<type>pom</type>
  -		<scope>import</scope>
  -	</dependency>
  -	</dependencies>
  -</dependencyManagement>
  -----
  -
  -This will ensure that all the transitive dependencies of Spring Security use the Spring {spring-version} modules.
  -
  -NOTE: This approach uses Maven's "bill of materials" (BOM) concept and is only available in Maven 2.0.9+.
  -For additional details about how dependencies are resolved refer to http://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html[Maven's Introduction to the Dependency Mechanism documentation].
   
   [[gradle]]
   == Gradle
  -A minimal Spring Security Gradle set of dependencies typically looks like the following:
  +
  +Like most open source projects, Spring Security deploys its dependencies as Maven artifacts which allows for for first class Gradle support.
  +The following sections provide details on how to consume Spring Security when using Gradle.
  +
  +=== Spring Boot with Gradle
  +
  +Spring Boot provides a spring-boot-starter-security starter which aggregates Spring Security related dependencies together.
  +The simplest and preferred method to leverage the starter is to use https://docs.spring.io/initializr/docs/current/reference/htmlsingle/[Spring Initializr] using an IDE integration (http://joshlong.com/jl/blogPost/tech_tip_geting_started_with_spring_boot.html[Eclipse], https://www.jetbrains.com/help/idea/spring-boot.html#d1489567e2[IntelliJ], https://github.com/AlexFalappa/nb-springboot/wiki/Quick-Tour[NetBeans]) or through https://start.spring.io.
  +
  +Alternatively, the starter can be added manually:
   
   .build.gradle
   [source,groovy]
   [subs="verbatim,attributes"]
   ----
   dependencies {
  -	compile 'org.springframework.security:spring-security-web:{spring-security-version}'
  -	compile 'org.springframework.security:spring-security-config:{spring-security-version}'
  -}
  +	compile "org.springframework.boot:spring-boot-starter-security"
  +}
  +----
  +
  +Since Spring Boot provides a Maven BOM to manage dependency versions, there is no need to specify a version.
  +If you wish to override the Spring Security version, you may do so by providing a Gradle property:
  +
  +.build.gradle
  +[source,groovy]
  +[subs="verbatim,attributes"]
  +----
  +ext['spring-security.version']='{spring-security-version}'
  +----
  +
  +Since Spring Security only makes breaking changes in major releases, it is safe to use a newer version of Spring Security with Spring Boot.
  +However, at times it may be necessary to update the version of Spring Framework as well.
  +This can easily be done by adding a Gradle property as well:
  +
  +.build.gradle
  +[source,groovy]
  +[subs="verbatim,attributes"]
  +----
  +ext['spring.version']='{spring-version}'
   ----
   
   If you are using additional features like LDAP, OpenID, etc. you will need to also include the appropriate <<modules>>.
  +
  +=== Gradle Without Spring Boot
  +
  +When using Spring Security without Spring Boot, the preferred way is to leverage Spring Security's BOM to ensure a consistent version of Spring Security is used throughout the entire project.
  +This can be done by using the https://github.com/spring-gradle-plugins/dependency-management-plugin[Dependency Management Plugin].
  +
  +.build.gradle
  +[source,groovy]
  +[subs="verbatim,attributes"]
  +----
  +plugins {
  +	id "io.spring.dependency-management" version "1.0.6.RELEASE"
  +}
  +
  +dependencyManagement {
  +	imports {
  +		mavenBom 'org.springframework.security:spring-security-bom:{spring-security-version}'
  +	}
  +}
  +----
  +
  +
  +A minimal Spring Security Maven set of dependencies typically looks like the following:
  +
  +.build.gradle
  +[source,groovy]
  +[subs="verbatim,attributes"]
  +----
  +dependencies {
  +	compile "org.springframework.security:spring-security-web"
  +	compile "org.springframework.security:spring-security-config"
  +}
  +----
  +
  +If you are using additional features like LDAP, OpenID, etc. you will need to also include the appropriate <<modules>>.
  +
  +Spring Security builds against Spring Framework {spring-version}, but should generally work with any newer version of Spring Framework 5.x
  +The problem that many users will have is that Spring Security's transitive dependencies resolve Spring Framework {spring-version} which can cause strange classpath problems.
  +The easiest way to resolve this is to use the `spring-framework-bom` within your `<dependencyManagement>` section of your `pom.xml` as shown below:
  +This can be done by using the https://github.com/spring-gradle-plugins/dependency-management-plugin[Dependency Management Plugin].
  +
  +.build.gradle
  +[source,groovy]
  +[subs="verbatim,attributes"]
  +----
  +plugins {
  +	id "io.spring.dependency-management" version "1.0.6.RELEASE"
  +}
  +
  +dependencyManagement {
  +	imports {
  +		mavenBom 'org.springframework:spring-framework-bom:{spring-version}'
  +	}
  +}
  +----
  +
  +This will ensure that all the transitive dependencies of Spring Security use the Spring {spring-version} modules.
   
   [[gradle-repositories]]
   === Gradle Repositories
  
positive.code: 	<dependency>
  		<groupId>org.springframework.security</groupId>
  		<artifactId>spring-security-web</artifactId>
  		<version>{spring-security-version}</version>
  	</dependency>
  	<dependency>
  		<groupId>org.springframework.security</groupId>
  		<artifactId>spring-security-config</artifactId>
  		<version>{spring-security-version}</version>
  	</dependency>
  </dependencies>
  ----
  
  If you are using additional features like LDAP, OpenID, etc. you will need to also include the appropriate <<modules>>.
  
  [[maven-repositories]]
  === Maven Repositories
  
negative.code: 
  [[maven]]
  == Usage with Maven
  
  Like most open source projects, Spring Security deploys its dependencies as Maven artifacts.
  The following sections provide details on how to consume Spring Security when using Maven.
  
  === Spring Boot with Maven
  
  Spring Boot provides a spring-boot-starter-security starter which aggregates Spring Security related dependencies together.
  The simplest and preferred method to leverage the starter is to use https://docs.spring.io/initializr/docs/current/reference/htmlsingle/[Spring Initializr] using an IDE integration (http://joshlong.com/jl/blogPost/tech_tip_geting_started_with_spring_boot.html[Eclipse], https://www.jetbrains.com/help/idea/spring-boot.html#d1489567e2[IntelliJ], https://github.com/AlexFalappa/nb-springboot/wiki/Quick-Tour[NetBeans]) or through https://start.spring.io.
  
  Alternatively, the starter can be added manually:
  
  .pom.xml
  [source,xml]
  [subs="verbatim,attributes"]
  ----
  <dependencies>
  	<!-- ... other dependency elements ... -->
  	<dependency>
  		<groupId>org.springframework.boot</groupId>
  		<artifactId>spring-boot-starter-security</artifactId>
  	</dependency>
  </dependencies>
  ----
  
  Since Spring Boot provides a Maven BOM to manage dependency versions, there is no need to specify a version.
  If you wish to override the Spring Security version, you may do so by providing a Maven property:
  
  .pom.xml
  [source,xml]
  [subs="verbatim,attributes"]
  ----
  <properties>
  	<!-- ... -->
  	<spring-security.version>{spring-security-version}</spring.security.version>
  </dependencies>
  ----
  
  Since Spring Security only makes breaking changes in major releases, it is safe to use a newer version of Spring Security with Spring Boot.
  However, at times it may be necessary to update the version of Spring Framework as well.
  This can easily be done by adding a Maven property as well:
  
  .pom.xml
  [source,xml]
  [subs="verbatim,attributes"]
  ----
  <properties>
  	<!-- ... -->
  	<spring.version>{spring-version}</spring.version>
  </dependencies>
  ----
  
  If you are using additional features like LDAP, OpenID, etc. you will need to also include the appropriate <<modules>>.
  
  === Maven Without Spring Boot
  
  When using Spring Security without Spring Boot, the preferred way is to leverage Spring Security's BOM to ensure a consistent version of Spring Security is used throughout the entire project.
  
  .pom.xml
  [source,xml]
  [subs="verbatim,attributes"]
  ----
  <dependencyManagement>
  	<dependencies>
  		<!-- ... other dependency elements ... -->
  		<dependency>
  			<groupId>org.springframework.security</groupId>
  			<artifactId>spring-security-bom</artifactId>
  			<version>{spring-security-version}</version>
  			<type>pom</type>
  			<scope>import</scope>
  		</dependency>
  	</dependencies>
  </dependencyManagement>
  ----
  
  
  A minimal Spring Security Maven set of dependencies typically looks like the following:
  
  