anchor.diff:  As such, in 6.0, Spring Security by default denies any request that is missing an authorization rule.
   
   The simplest way to prepare for this change is to introduce an appropriate {security-api-url}org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.html#anyRequest()[`anyRequest`] rule as the last authorization rule.
  -The recommendation is {security-api-url}org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurer.AuthorizedUrl.html#denyAll()[`denyAll`] since that is the implied 6.0 default; however, you may want to choose {security-api-url}org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurer.AuthorizedUrl.html#permitAll()[`permitAll`] to preserve 5.8 behavior.
  +The recommendation is {security-api-url}org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurer.AuthorizedUrl.html#denyAll()[`denyAll`] since that is the implied 6.0 default.
   
   [NOTE]
   ====
  
positive.code: ----
  ====
  
  == Reactive
  
  === Use `AuthorizationManager` for Method Security
  
  xref:reactive/authorization/method.adoc[Method Security] has been xref:reactive/authorization/method.adoc#jc-enable-reactive-method-security-authorization-manager[improved] through {security-api-url}org/springframework/security/authorization/AuthorizationManager.html[the `AuthorizationManager` API] and direct use of Spring AOP.
  
  '''
  
  In Spring Security 5.8, `useAuthorizationManager` was added to {security-api-url}org/springframework/security/config/annotation/method/configuration/EnableReactiveMethodSecurity.html[`@EnableReactiveMethodSecurity`] to allow applications to opt in to ``AuthorizationManager``'s features.
  
  ==== Declare the 5.8 default
  
  First, declare the 5.8 default:
  
  ====
  .Java
  [source,java,role="primary"]
  ----
  @EnableReactiveMethodSecurity
  ----
  
  .Kotlin
  [source,kotlin,role="secondary"]
  ----
  @EnableReactiveMethodSecurity
  ----
  ====
  
  to:
  
  ====
  .Java
  [source,java,role="primary"]
  ----
  @EnableReactiveMethodSecurity(useAuthorizationManager = false)
  ----
  
  .Kotlin
  [source,kotlin,role="secondary"]
  ----
  @EnableReactiveMethodSecurity(useAuthorizationManager = false)
  ----
  ====
  
  This is helpful because, if the remaining preparation steps cannot be taken, you can still upgrade to 6.0 while keeping this feature as-is.
  
  [[reactive-change-to-useauthorizationmanager]]
  ==== Change `useAuthorizationManager` to `true`
  
negative.code: 
  xref:servlet/integrations/websocket.adoc[Message Security] has been xref:servlet/integrations/websocket.adoc#websocket-configuration[improved] through {security-api-url}org/springframework/security/authorization/AuthorizationManager.html[the `AuthorizationManager` API] and direct use of Spring AOP.
  
  Should you run into trouble with making these changes, you can follow the <<servlet-authorizationmanager-messages-opt-out,opt out steps>> at the end of this section.
  
  ==== Ensure all messages have defined authorization rules
  
  