anchor.diff:  ----
   
   The URL for class uploading should be exempted both from the web security and from the
  -csrf filter. Here’s an example `WebSecurityConfigurerAdapter` configuration that uses
  -HTTP Basic Auth to secure all URLs except the default one used by devtools for class
  -uploading:
  +csrf filter. The following example shows how anonymous access to the remote devtools endpoint
  +can be configured:
   
   [source,java,indent=0]
   ----
  
positive.code: 	spring.devtools.restart.quiet-period=1s
  ----
  
  The monitored classpath folders are now being swept every 2 seconds, and a 1 second quiet
  period is maintained to make sure no additional class changes are coming.
  
  [[security-configuration-for-devtools-remote]]
  ==== Security Configuration for Devtools Remote
  If you use security configuration on the server, you may observe HTTP error 401 or 403 in
  the logs of the `RemoteSpringApplication`:
  
  [indent=0,subs="attributes"]
  
negative.code: 
  	@Override
  	protected void configure(HttpSecurity http) throws Exception {
  		http.requestMatchers("/.~~spring-boot!~/restart").anyRequest().anonymous()
  			.and().csrf().disable();
  	}
  
  }
  ----
  
  NOTE: The above configuration will only affect the remote devtools endpoint. Spring Boot's default
  security auto-configuration will still apply to the rest of the application. If the rest
  of the application requires custom security, it needs to be configured separately.
  
  
  
  