anchor.diff:  
   xref:servlet/authorization/method-security.adoc[Method Security] has been xref:servlet/authorization/method-security.adoc#jc-enable-method-security[simplified] through {security-api-url}org/springframework/security/authorization/AuthorizationManager.html[the `AuthorizationManager` API] and direct use of Spring AOP.
   
  +Should you run into trouble with making these changes, note that `@EnableGlobalMethodSecurity`, while deprecated, will not be removed in 6.0, allowing you to opt out by sticking with the old annotation.
  +
   '''
   
   [[servlet-replace-globalmethodsecurity-with-methodsecurity]]
  
positive.code: 
  ==== Switch to filter all dispatcher types
  
  Finally, change your authorization rules to filter all dispatcher types.
  
  To do this, change:
  
  
negative.code: ----
  ====
  
  [[servlet-authorizationmanager-requests-opt-out]]
  ==== Opt-out Steps
  
  In case you had trouble, take a look at these scenarios for optimal opt out behavior:
  
  ===== I cannot secure all dispatcher types
  
  If you cannot secure all dispatcher types, first try and declare which dispatcher types should not require authorization like so:
  
  ====
  .Java
  [source,java,role="primary"]
  ----
  http
      .authorizeHttpRequests((authorize) -> authorize
          .shouldFilterAllDispatcherTypes(true)
          .dispatcherTypeMatchers(FORWARD, INCLUDE).permitAll()
          .mvcMatchers("/app/**").hasRole("APP")
          // ...
          .anyRequest().denyAll()
      )
      // ...
  ----
  
  .Kotlin
  [source,kotlin,role="secondary"]
  ----
  http {
      authorizeHttpRequests {
          shouldFilterAllDispatcherTypes = true
          authorize(DispatcherTypeRequestMatcher(FORWARD, INCLUDE), permitAll)
          authorize("/app/**", hasRole("APP"))
          // ...
          authorize(anyRequest, denyAll)
      }
  }
  ----
  
  .Xml
  [source,xml,role="secondary"]
  ----
  <http filter-all-dispatcher-types="true" use-authorization-manager="true">
      <intercept-url request-matcher-ref="dispatchers"/>
      <intercept-url pattern="/app/*" access="hasRole('APP')"/>
      <!-- ... -->
      <intercept-url pattern="/**" access="denyAll"/>
  </http>
  
  <bean id="dispatchers" class="org.springframework.security.web.util.matcher.DispatcherTypeRequestMatcher">
      <constructor-arg>
          <util:list value-type="javax.servlet.DispatcherType">
              <value>FORWARD</value>
              <value>INCLUDE</value>
          </util:list>
      </constructor-arg>
  </bean>
  ----
  ====
  
  Or, if that doesn't work, then you can explicitly opt out of the behavior by setting `filter-all-dispatcher-types` and `filterAllDispatcherTypes` to `false`:
  
  ====
  .Java
  [source,java,role="primary"]
  ----
  http
      .authorizeHttpRequests((authorize) -> authorize
          .filterAllDispatcherTypes(false)
          .mvcMatchers("/app/**").hasRole("APP")
          // ...
      )
      // ...
  ----
  
  .Kotlin
  [source,kotlin,role="secondary"]
  ----
  http {
      authorizeHttpRequests {
          filterAllDispatcherTypes = false
          authorize("/messages/**", hasRole("APP"))
          // ...
      }
  }
  ----
  
  .Xml
  [source,xml,role="secondary"]
  ----
  <http filter-all-dispatcher-types="false" use-authorization-manager="true">
      <intercept-url pattern="/app/*" access="hasRole('APP')"/>
      <!-- ... -->
  </http>
  ----
  ====
  
  or, if you are still using `authorizeRequests` or `use-authorization-manager="false"`, set `oncePerRequest` to `true`:
  
  ====
  .Java
  [source,java,role="primary"]
  ----
  http
      .authorizeRequests((authorize) -> authorize
          .filterSecurityInterceptorOncePerRequest(true)
          .mvcMatchers("/app/**").hasRole("APP")
          // ...
      )
      // ...
  ----
  
  .Kotlin
  [source,kotlin,role="secondary"]
  ----
  http {
      authorizeRequests {
          filterSecurityInterceptorOncePerRequest = true
          authorize("/messages/**", hasRole("APP"))
          // ...
      }
  }
  ----
  
  .Xml
  [source,xml,role="secondary"]
  ----
  <http once-per-request="true" use-authorization-manager="false">
      <intercept-url pattern="/app/*" access="hasRole('APP')"/>
      <!-- ... -->
  </http>
  ----
  ====
  
  ===== I cannot declare an authorization rule for all requests
  
  If you are having trouble setting an `anyRequest` authorization rule of `denyAll`, please use {security-api-url}org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurer.AuthorizedUrl.html#permitAll()[`permitAll`] instead, like so:
  
  ====
  .Java
  [source,java,role="primary"]
  ----
  http
      .authorizeHttpReqeusts((authorize) -> authorize
          .mvcMatchers("/app/*").hasRole("APP")
          // ...
          .anyRequest().permitAll()
      )
  ----
  
  .Kotlin
  [source,kotlin,role="secondary"]
  ----
  http {
      authorizeHttpRequests {
          authorize("/app*", hasRole("APP"))
          // ...
          authorize(anyRequest, permitAll)
      }
  }
  ----
  
  .Xml
  [source,xml,role="secondary"]
  ----
  <http>
      <intercept-url pattern="/app/*" access="hasRole('APP')"/>
      <!-- ... -->
      <intercept-url pattern="/**" access="permitAll"/>
  </http>
  ----
  ====
  
  ===== I cannot migrate my SpEL or my `AccessDecisionManager`
  
  If you are having trouble with SpEL, `AccessDecisionManager`, or there is some other feature that you are needing to keep using in `<http>` or `authorizeRequests`, try the following.
  
  First, if you still need `authorizeRequests`, you are welcome to keep using it. Even though it is deprecated, it is not removed in 6.0.
  
  Second, if you still need your custom `access-decision-manager-ref` or have some other reason to opt out of `AuthorizationManager`, do:
  
  ====
  .Xml
  [source,xml,role="secondary"]
  ----
  <http use-authorization-manager="false">
      <intercept-url pattern="/app/*" access="hasRole('APP')"/>
      <!-- ... -->
  </http>
  ----
  ====
  
  == Reactive
  
  === Use `AuthorizationManager` for Method Security
  
  xref:reactive/authorization/method.adoc[Method Security] has been xref:reactive/authorization/method.adoc#jc-enable-reactive-method-security-authorization-manager[improved] through {security-api-url}org/springframework/security/authorization/AuthorizationManager.html[the `AuthorizationManager` API] and direct use of Spring AOP.
  
  Should you run into trouble with making these changes, you can follow the
  <<reactive-authorizationmanager-methods-opt-out,opt out steps>> at the end of this section.
  
  '''
  
  In Spring Security 5.8, `useAuthorizationManager` was added to {security-api-url}org/springframework/security/config/annotation/method/configuration/EnableReactiveMethodSecurity.html[`@EnableReactiveMethodSecurity`] to allow applications to opt in to ``AuthorizationManager``'s features.
  
  [[reactive-change-to-useauthorizationmanager]]
  ==== Change `useAuthorizationManager` to `true`
  