When you use Spring Security without Boot, Spring Security's filter uses ASYNC, REQUEST, and ERROR as its dispatcher types. When used in Boot, it gets whatever our default is. We should align with what Spring Security gives you by default if you configure things yourself.