Spring Security Enabling @EnableWebFluxSecurity in a Spring boot Webflux project causes threads to run in a boundedElastic thread rather than reactor-http-nio

Describe the bug When i have spring-boot-starter-security as a dependency in my SpringBoot Webflux project, HTTP Request are run in boundedElastic threads rather than reactor-http-nio threads. All HTTP requests should run in reactor-http-nio threads in Spring Webflux. This came out of a bug I filed with the blockhound team [https://github.com/reactor/BlockHound/issues/173]

To Reproduce

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

@EnableWebFluxSecurity
public class SecurityConfig {
    @Bean
    public MapReactiveUserDetailsService userDetailsService() {
        UserDetails user = User.withUsername("admin").password(passwordEncoder().encode("password")).roles("ADMIN")
                .build();
        return new MapReactiveUserDetailsService(user);
    }

    @Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        http.csrf().disable().authorizeExchange().pathMatchers("/**").permitAll().and().httpBasic();
        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

Expected behavior HTTP Requests should always run in reactor-http-nio thread whether Spring Security is turned on or off.

Comment From: jzheaux

Hi, @rinfimate, thanks for the report.

I'm wondering if this is related to https://github.com/spring-projects/spring-security/issues/9200. Can you try the workaround in that ticket? If it works, we can close this ticket as a duplicate and keep the conversation going over there.

Comment From: spring-projects-issues

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.

Comment From: spring-projects-issues

Closing due to lack of requested feedback. If you would like us to look at this issue, please provide the requested information and we will re-open the issue.