I’m trying to convert a Spring Boot Web application to Webflux. Authentication is working for GET endpoints, but I can’t get past a 401 response on POST endpoints. I’m using the exact same postman calls that 1) worked before converting, and 2) works if I switch the POST to GET in the same request.

Any ideas for what could cause authentication to work for only some methods? Spring Boot 3.2.4

From what I’ve read, it seems like this is a symptom if the CSRF isn’t disabled. However, CSRF is disabled as far as I know. So, I’m kinda stuck.

    @GetMapping
    public OrganizationsResponse getAllOrgs(Authentication auth) {
    //This works fine, returns the expected response with a 200
    }

    @PostMapping(consumes = MediaType.APPLICATION_JSON_VALUE)    
    public OrganizationsResponse createOrUpdateOrgs(
            @RequestBody OrganizationsRequest orgPost,
            Authentication auth) {
    //This returns a 401
    }

@Configuration
@PropertySource(value = "classpath:application.properties", ignoreResourceNotFound = true)
@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
@EnableAsync
public class SecurityConfig implements WebFluxConfigurer {

    @Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        http
            .csrf(ServerHttpSecurity.CsrfSpec::disable)
            .httpBasic(ServerHttpSecurity.HttpBasicSpec::disable)
            .formLogin(ServerHttpSecurity.FormLoginSpec::disable)
            .logout(ServerHttpSecurity.LogoutSpec::disable)
            .authenticationManager(authenticationManager)
            .securityContextRepository(securityContextRepository)
            .authorizeExchange(a -> a.anyExchange().permitAll());

    }
}