title: Spring Security WebFlux IP Whitelist
body: <p>In the latest Spring Security which leverages WebFlux, the security config works like below,</p>
  
  <pre><code>SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
  http.authorizeExchange().pathMatchers("/**") ....
  </code></pre>
  
  <p>Before there is a method hasIpAddress("xxx.xxx.xxx.xxx") we can use to config IP whitelist, now it's gone. </p>
  
  <p>How to specify IP whitelist for new Spring Security Webflux? </p>
  
  <p>Based on idea from @özkan pakdil below, here is my code, but IP filter does not work - The request from IP which is not on whitelist still can go through. </p>
  
  <pre><code>private Mono&lt;AuthorizationDecision&gt; isAuthorizedIP(Mono&lt;Authentication&gt; authentication, AuthorizationContext context) {
      String ip = context.getExchange().getRequest().getRemoteAddress().getAddress().toString().replace("/", "");
  
      return authentication.map((a) -&gt; new AuthorizationDecision(
                                          ipWhiteList.contains(ip)));     
  }
  </code></pre>
  
  <p>SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) throws Exception {</p>
  
  <p>http.authorizeExchange().anyExchange().access(this::isAuthorizedIP).and().oauth2Login();</p>
  
  <p>return http.build();</p>
  
  <p>}    </p>