Merge branch '3.2.x'

Closes gh-41080

buildSrc/src/main/java/org/springframework/boot/build/bom/UpgradePolicy.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -35,12 +35,12 @@ public enum UpgradePolicy implements BiPredicate<DependencyVersion, DependencyVe
 	/**
 	 * Minor versions of the current major version.
 	 */
-	SAME_MAJOR_VERSION((candidate, current) -> candidate.isSameMajor(current)),
+	SAME_MAJOR_VERSION(DependencyVersion::isSameMajor),
 
 	/**
 	 * Patch versions of the current minor version.
 	 */
-	SAME_MINOR_VERSION((candidate, current) -> candidate.isSameMinor(current));
+	SAME_MINOR_VERSION(DependencyVersion::isSameMinor);
 
 	private final BiPredicate<DependencyVersion, DependencyVersion> delegate;
 

spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/quartz/QuartzEndpoint.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -46,6 +46,7 @@ import org.quartz.Trigger;
 import org.quartz.Trigger.TriggerState;
 import org.quartz.TriggerKey;
 import org.quartz.impl.matchers.GroupMatcher;
+import org.quartz.utils.Key;
 
 import org.springframework.boot.actuate.endpoint.OperationResponseBody;
 import org.springframework.boot.actuate.endpoint.SanitizableData;
@@ -100,7 +101,7 @@ public class QuartzEndpoint {
 		for (String groupName : this.scheduler.getJobGroupNames()) {
 			List<String> jobs = this.scheduler.getJobKeys(GroupMatcher.jobGroupEquals(groupName))
 				.stream()
-				.map((key) -> key.getName())
+				.map(Key::getName)
 				.toList();
 			result.put(groupName, Collections.singletonMap("jobs", jobs));
 		}
@@ -121,7 +122,7 @@ public class QuartzEndpoint {
 			groupDetails.put("triggers",
 					this.scheduler.getTriggerKeys(GroupMatcher.triggerGroupEquals(groupName))
 						.stream()
-						.map((key) -> key.getName())
+						.map(Key::getName)
 						.toList());
 			result.put(groupName, groupDetails);
 		}

spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/flyway/FlywayAutoConfiguration.java

@@ -226,6 +226,8 @@ public class FlywayAutoConfiguration {
 		 * @param properties the properties
 		 */
 		private void configureProperties(FluentConfiguration configuration, FlywayProperties properties) {
+			// NOTE: Using method references in the mapper methods can break
+			// back-compatibilty (see gh-38164)
 			PropertyMapper map = PropertyMapper.get().alwaysApplyingWhenNonNull();
 			String[] locations = new LocationResolver(configuration.getDataSource())
 				.resolveLocations(properties.getLocations())

spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/orm/jpa/HibernateProperties.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2022 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -148,9 +148,9 @@ public class HibernateProperties {
 
 		private void applyNamingStrategies(Map<String, Object> properties) {
 			applyNamingStrategy(properties, AvailableSettings.IMPLICIT_NAMING_STRATEGY, this.implicitStrategy,
-					() -> SpringImplicitNamingStrategy.class.getName());
+					SpringImplicitNamingStrategy.class::getName);
 			applyNamingStrategy(properties, AvailableSettings.PHYSICAL_NAMING_STRATEGY, this.physicalStrategy,
-					() -> CamelCaseToUnderscoresNamingStrategy.class.getName());
+					CamelCaseToUnderscoresNamingStrategy.class::getName);
 		}
 
 		private void applyNamingStrategy(Map<String, Object> properties, String key, Object strategy,

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/graphql/security/GraphQlWebFluxSecurityAutoConfigurationTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2023 the original author or authors.
+ * Copyright 2020-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -45,6 +45,7 @@ import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.config.annotation.method.configuration.EnableReactiveMethodSecurity;
 import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.config.web.server.ServerHttpSecurity.CsrfSpec;
 import org.springframework.security.core.userdetails.MapReactiveUserDetailsService;
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.core.userdetails.UserDetails;
@@ -161,7 +162,7 @@ class GraphQlWebFluxSecurityAutoConfigurationTests {
 
 		@Bean
 		SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) {
-			return http.csrf((spec) -> spec.disable())
+			return http.csrf(CsrfSpec::disable)
 				// Demonstrate that method security works
 				// Best practice to use both for defense in depth
 				.authorizeExchange((requests) -> requests.anyExchange().permitAll())

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/graphql/security/GraphQlWebMvcSecurityAutoConfigurationTests.java

@@ -41,6 +41,7 @@ import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
@@ -154,7 +155,7 @@ class GraphQlWebMvcSecurityAutoConfigurationTests {
 
 		@Bean
 		DefaultSecurityFilterChain springWebFilterChain(HttpSecurity http) throws Exception {
-			return http.csrf((c) -> c.disable())
+			return http.csrf(CsrfConfigurer::disable)
 				// Demonstrate that method security works
 				// Best practice to use both for defense in depth
 				.authorizeHttpRequests((requests) -> requests.anyRequest().permitAll())

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/logging/ConditionEvaluationReportLoggingListenerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -58,7 +58,7 @@ class ConditionEvaluationReportLoggingListenerTests {
 		AnnotationConfigApplicationContext context = new AnnotationConfigApplicationContext();
 		this.initializer.initialize(context);
 		context.register(Config.class);
-		withDebugLogging(() -> context.refresh());
+		withDebugLogging(context::refresh);
 		assertThat(output).contains("CONDITIONS EVALUATION REPORT");
 	}
 

spring-boot-project/spring-boot-devtools/src/main/java/org/springframework/boot/devtools/autoconfigure/RemoteDevtoolsSecurityConfiguration.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,6 +23,7 @@ import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.annotation.Order;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 
@@ -49,7 +50,7 @@ class RemoteDevtoolsSecurityConfiguration {
 	SecurityFilterChain devtoolsSecurityFilterChain(HttpSecurity http) throws Exception {
 		http.securityMatcher(new AntPathRequestMatcher(this.url));
 		http.authorizeHttpRequests((requests) -> requests.anyRequest().anonymous());
-		http.csrf((csrf) -> csrf.disable());
+		http.csrf(CsrfConfigurer::disable);
 		return http.build();
 	}
 

spring-boot-project/spring-boot-devtools/src/test/java/org/springframework/boot/devtools/filewatch/FileSystemWatcherTests.java

@@ -297,7 +297,7 @@ class FileSystemWatcherTests {
 	private void setupWatcher(long pollingInterval, long quietPeriod, SnapshotStateRepository snapshotStateRepository) {
 		this.watcher = new FileSystemWatcher(false, Duration.ofMillis(pollingInterval), Duration.ofMillis(quietPeriod),
 				snapshotStateRepository);
-		this.watcher.addListener((changeSet) -> FileSystemWatcherTests.this.changes.add(changeSet));
+		this.watcher.addListener(FileSystemWatcherTests.this.changes::add);
 	}
 
 	private File startWithNewDirectory() {

spring-boot-project/spring-boot-docker-compose/src/test/java/org/springframework/boot/docker/compose/core/DefaultRunningServiceTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -115,7 +115,7 @@ class DefaultRunningServiceTests {
 	}
 
 	private DefaultRunningService createRunningService(boolean psResponseHasImage) {
-		DockerHost host = DockerHost.get("192.168.1.1", () -> Collections.emptyList());
+		DockerHost host = DockerHost.get("192.168.1.1", Collections::emptyList);
 		String id = "123";
 		String name = "my-service";
 		String image = "redis";

spring-boot-project/spring-boot-docker-compose/src/test/java/org/springframework/boot/docker/compose/core/DockerHostTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -52,7 +52,7 @@ class DockerHostTests {
 
 	private static final Function<String, String> NO_SYSTEM_ENV = (key) -> null;
 
-	private static final Supplier<List<DockerCliContextResponse>> NO_CONTEXT = () -> Collections.emptyList();
+	private static final Supplier<List<DockerCliContextResponse>> NO_CONTEXT = Collections::emptyList;
 
 	@Test
 	void getWhenHasHost() {

spring-boot-project/spring-boot-docker-compose/src/test/java/org/springframework/boot/docker/compose/lifecycle/TcpConnectServiceReadinessCheckTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -58,14 +58,14 @@ class TcpConnectServiceReadinessCheckTests {
 
 	@Test
 	void checkWhenServerWritesData() throws Exception {
-		withServer((socket) -> socket.getOutputStream().write('!'), (port) -> check(port));
+		withServer((socket) -> socket.getOutputStream().write('!'), this::check);
 	}
 
 	@Test
 	void checkWhenNoSocketOutput() throws Exception {
 		// Simulate waiting for traffic from client to server. The sleep duration must
 		// be longer than the read timeout of the ready check!
-		withServer((socket) -> sleep(Duration.ofSeconds(10)), (port) -> check(port));
+		withServer((socket) -> sleep(Duration.ofSeconds(10)), this::check);
 	}
 
 	@Test

spring-boot-project/spring-boot-docs/src/main/java/org/springframework/boot/docs/data/sql/h2webconsole/springsecurity/DevProfileSecurityConfiguration.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,6 +24,8 @@ import org.springframework.core.Ordered;
 import org.springframework.core.annotation.Order;
 import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
+import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.FrameOptionsConfig;
 import org.springframework.security.web.SecurityFilterChain;
 
 @Profile("dev")
@@ -35,8 +37,8 @@ public class DevProfileSecurityConfiguration {
 	SecurityFilterChain h2ConsoleSecurityFilterChain(HttpSecurity http) throws Exception {
 		http.securityMatcher(PathRequest.toH2Console());
 		http.authorizeHttpRequests(yourCustomAuthorization());
-		http.csrf((csrf) -> csrf.disable());
+		http.csrf(CsrfConfigurer::disable);
-		http.headers((headers) -> headers.frameOptions((frame) -> frame.sameOrigin()));
+		http.headers((headers) -> headers.frameOptions(FrameOptionsConfig::sameOrigin));
 		return http.build();
 	}
 

spring-boot-project/spring-boot-test/src/test/java/org/springframework/boot/test/context/filter/ExcludeFilterApplicationContextInitializerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -40,7 +40,7 @@ class ExcludeFilterApplicationContextInitializerTests {
 	void testConfigurationIsExcluded() {
 		SpringApplication application = new SpringApplication(TestApplication.class);
 		application.setWebApplicationType(WebApplicationType.NONE);
-		AssertableApplicationContext applicationContext = AssertableApplicationContext.get(() -> application.run());
+		AssertableApplicationContext applicationContext = AssertableApplicationContext.get(application::run);
 		assertThat(applicationContext).hasSingleBean(TestApplication.class);
 		assertThat(applicationContext).doesNotHaveBean(ExcludedTestConfiguration.class);
 	}

spring-boot-project/spring-boot-testcontainers/src/test/java/org/springframework/boot/testcontainers/service/connection/ContainerConnectionDetailsFactoryTests.java

@@ -111,7 +111,7 @@ class ContainerConnectionDetailsFactoryTests {
 	void getContainerWhenNotInitializedThrowsException() {
 		TestContainerConnectionDetailsFactory factory = new TestContainerConnectionDetailsFactory();
 		TestContainerConnectionDetails connectionDetails = getConnectionDetails(factory, this.source);
-		assertThatIllegalStateException().isThrownBy(() -> connectionDetails.callGetContainer())
+		assertThatIllegalStateException().isThrownBy(connectionDetails::callGetContainer)
 			.withMessage("Container cannot be obtained before the connection details bean has been initialized");
 	}
 

spring-boot-project/spring-boot-tools/spring-boot-buildpack-platform/src/test/java/org/springframework/boot/buildpack/platform/docker/type/ImageReferenceTests.java

@@ -255,7 +255,7 @@ class ImageReferenceTests {
 	void inTaggedFormWhenHasDigestThrowsException() {
 		ImageReference reference = ImageReference
 			.of("ubuntu@sha256:6e9f67fa63b0323e9a1e587fd71c561ba48a034504fb804fd26fd8800039835d");
-		assertThatIllegalStateException().isThrownBy(() -> reference.inTaggedForm())
+		assertThatIllegalStateException().isThrownBy(reference::inTaggedForm)
 			.withMessage(
 					"Image reference 'docker.io/library/ubuntu@sha256:6e9f67fa63b0323e9a1e587fd71c561ba48a034504fb804fd26fd8800039835d' cannot contain a digest");
 	}

spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/main/java/org/springframework/boot/gradle/dsl/SpringBootExtension.java

@@ -93,7 +93,7 @@ public class SpringBootExtension {
 			tasks.named(JavaPlugin.CLASSES_TASK_NAME).configure((task) -> task.dependsOn(bootBuildInfo));
 			bootBuildInfo.configure((buildInfo) -> buildInfo.getProperties()
 				.getArtifact()
-				.convention(this.project.provider(() -> determineArtifactBaseName())));
+				.convention(this.project.provider(this::determineArtifactBaseName)));
 		});
 		if (configurer != null) {
 			bootBuildInfo.configure(configurer);

spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/main/java/org/springframework/boot/gradle/plugin/SpringBootAotPlugin.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -152,7 +152,7 @@ public class SpringBootAotPlugin implements Plugin<Project> {
 		task.getClassesOutput()
 			.set(project.getLayout().getBuildDirectory().dir("generated/" + sourceSet.getName() + "Classes"));
 		task.getGroupId().set(project.provider(() -> String.valueOf(project.getGroup())));
-		task.getArtifactId().set(project.provider(() -> project.getName()));
+		task.getArtifactId().set(project.provider(project::getName));
 		configureToolchainConvention(project, task);
 	}
 

spring-boot-project/spring-boot-tools/spring-boot-loader-classic/src/test/java/org/springframework/boot/loader/jar/JarFileTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -719,7 +719,7 @@ class JarFileTests {
 		Iterator<JarEntry> iterator = this.jarFile.iterator();
 		iterator.next();
 		this.jarFile.close();
-		assertThatZipFileClosedIsThrownBy(() -> iterator.hasNext());
+		assertThatZipFileClosedIsThrownBy(iterator::hasNext);
 	}
 
 	@Test

spring-boot-project/spring-boot-tools/spring-boot-loader/src/test/java/org/springframework/boot/loader/jar/NestedJarFileTests.java

@@ -240,7 +240,7 @@ class NestedJarFileTests {
 	void getCommentWhenClosedThrowsException() throws IOException {
 		try (NestedJarFile jar = new NestedJarFile(this.file)) {
 			jar.close();
-			assertThatIllegalStateException().isThrownBy(() -> jar.getComment()).withMessage("Zip file closed");
+			assertThatIllegalStateException().isThrownBy(jar::getComment).withMessage("Zip file closed");
 		}
 	}
 
@@ -269,7 +269,7 @@ class NestedJarFileTests {
 	void sizeWhenClosedThrowsException() throws Exception {
 		try (NestedJarFile jar = new NestedJarFile(this.file)) {
 			jar.close();
-			assertThatIllegalStateException().isThrownBy(() -> jar.size()).withMessage("Zip file closed");
+			assertThatIllegalStateException().isThrownBy(jar::size).withMessage("Zip file closed");
 		}
 	}
 

spring-boot-project/spring-boot-tools/spring-boot-loader/src/test/java/org/springframework/boot/loader/net/protocol/jar/JarUrlConnectionTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -242,7 +242,7 @@ class JarUrlConnectionTests {
 	@Test
 	void getInputStreamWhenNotNestedAndHasNoEntryThrowsException() throws Exception {
 		JarUrlConnection connection = JarUrlConnection.open(JarUrl.create(this.file));
-		assertThatIOException().isThrownBy(() -> connection.getInputStream()).withMessage("no entry name specified");
+		assertThatIOException().isThrownBy(connection::getInputStream).withMessage("no entry name specified");
 	}
 
 	@Test

spring-boot-project/spring-boot-tools/spring-boot-test-support/src/test/java/org/springframework/boot/testsupport/classpath/ModifiedClassPathExtensionForkParameterizedTests.java

@@ -37,10 +37,14 @@ class ModifiedClassPathExtensionForkParameterizedTests {
 	@ParameterizedTest
 	@ValueSource(strings = { "one", "two", "three" })
 	void testIsInvokedOnceForEachArgument(String argument) {
-		switch (argument) {
+		if (argument.equals("one")) {
-			case "one" -> assertThat(arguments).isEmpty();
+			assertThat(arguments).isEmpty();
-			case "two" -> assertThat(arguments).doesNotContain("two", "three");
+		}
-			case "three" -> assertThat(arguments).doesNotContain("three");
+		else if (argument.equals("two")) {
+			assertThat(arguments).doesNotContain("two", "three");
+		}
+		else if (argument.equals("three")) {
+			assertThat(arguments).doesNotContain("three");
 		}
 		arguments.add(argument);
 	}

spring-boot-project/spring-boot/src/test/java/org/springframework/boot/context/properties/PropertySourcesDeducerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -79,7 +79,7 @@ class PropertySourcesDeducerTests {
 		Environment environment = mock(Environment.class);
 		given(applicationContext.getEnvironment()).willReturn(environment);
 		PropertySourcesDeducer deducer = new PropertySourcesDeducer(applicationContext);
-		assertThatIllegalStateException().isThrownBy(() -> deducer.getPropertySources())
+		assertThatIllegalStateException().isThrownBy(deducer::getPropertySources)
 			.withMessage("Unable to obtain PropertySources from PropertySourcesPlaceholderConfigurer or Environment");
 	}
 

spring-boot-project/spring-boot/src/test/java/org/springframework/boot/logging/LoggerConfigurationTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -160,7 +160,7 @@ class LoggerConfigurationTests {
 		@Test
 		void getLevelWhenCustomThrowsException() {
 			LevelConfiguration configuration = LevelConfiguration.ofCustom("FINE");
-			assertThatIllegalStateException().isThrownBy(() -> configuration.getLevel())
+			assertThatIllegalStateException().isThrownBy(configuration::getLevel)
 				.withMessage("Unable to provide LogLevel for 'FINE'");
 		}
 

spring-boot-project/spring-boot/src/test/java/org/springframework/boot/logging/log4j2/SpringBootPropertySourceTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@
 
 package org.springframework.boot.logging.log4j2;
 
+import java.lang.reflect.Method;
 import java.util.stream.Stream;
 
 import org.apache.logging.log4j.LogManager;
@@ -46,8 +47,7 @@ class SpringBootPropertySourceTests {
 
 	@Test
 	void allDefaultMethodsAreImplemented() {
-		assertThat(Stream.of(SpringBootPropertySource.class.getMethods()).filter((method) -> method.isDefault()))
+		assertThat(Stream.of(SpringBootPropertySource.class.getMethods()).filter(Method::isDefault)).isEmpty();
-			.isEmpty();
 	}
 
 }

spring-boot-project/spring-boot/src/test/java/org/springframework/boot/logging/logback/LogbackLoggingSystemParallelInitializationTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -53,7 +53,7 @@ class LogbackLoggingSystemParallelInitializationTests {
 		List<Thread> threads = new ArrayList<>();
 		List<Throwable> exceptions = new CopyOnWriteArrayList<>();
 		for (int i = 0; i < 10; i++) {
-			Thread thread = new Thread(() -> this.loggingSystem.beforeInitialize());
+			Thread thread = new Thread(this.loggingSystem::beforeInitialize);
 			thread.setUncaughtExceptionHandler((t, ex) -> exceptions.add(ex));
 			threads.add(thread);
 		}

spring-boot-project/spring-boot/src/test/java/org/springframework/boot/sql/init/AbstractScriptDatabaseInitializerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -59,7 +59,7 @@ public abstract class AbstractScriptDatabaseInitializerTests<T extends AbstractS
 		DatabaseInitializationSettings settings = new DatabaseInitializationSettings();
 		settings.setDataLocations(Arrays.asList("data.sql"));
 		T initializer = createEmbeddedDatabaseInitializer(settings);
-		assertThatExceptionOfType(DataAccessException.class).isThrownBy(() -> initializer.initializeDatabase());
+		assertThatExceptionOfType(DataAccessException.class).isThrownBy(initializer::initializeDatabase);
 		assertThatDatabaseWasAccessed(initializer);
 	}
 

spring-boot-project/spring-boot/src/test/java/org/springframework/boot/ssl/DefaultSslManagerBundleTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -89,7 +89,7 @@ class DefaultSslManagerBundleTests {
 		SslStoreBundle storeBundle = SslStoreBundle.of(keyStore, null, null);
 		DefaultSslManagerBundle bundle = new TestDefaultSslManagerBundle(storeBundle,
 				SslBundleKey.of("secret", "alias"));
-		assertThatIllegalStateException().isThrownBy(() -> bundle.getKeyManagerFactory())
+		assertThatIllegalStateException().isThrownBy(bundle::getKeyManagerFactory)
 			.withMessage("Keystore does not contain alias 'alias'");
 	}
 
@@ -100,7 +100,7 @@ class DefaultSslManagerBundleTests {
 		SslStoreBundle storeBundle = SslStoreBundle.of(keyStore, null, null);
 		DefaultSslManagerBundle bundle = new TestDefaultSslManagerBundle(storeBundle,
 				SslBundleKey.of("secret", "alias"));
-		assertThatIllegalStateException().isThrownBy(() -> bundle.getKeyManagerFactory())
+		assertThatIllegalStateException().isThrownBy(bundle::getKeyManagerFactory)
 			.withMessage("Could not determine if keystore contains alias 'alias'");
 	}
 

spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/reactive/context/ReactiveWebServerApplicationContextTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -59,7 +59,7 @@ class ReactiveWebServerApplicationContextTests {
 
 	@Test
 	void whenThereIsNoWebServerFactoryBeanThenContextRefreshWillFail() {
-		assertThatExceptionOfType(ApplicationContextException.class).isThrownBy(() -> this.context.refresh())
+		assertThatExceptionOfType(ApplicationContextException.class).isThrownBy(this.context::refresh)
 			.havingRootCause()
 			.withMessageContaining(
 					"Unable to start ReactiveWebServerApplicationContext due to missing ReactiveWebServerFactory bean");
@@ -68,7 +68,7 @@ class ReactiveWebServerApplicationContextTests {
 	@Test
 	void whenThereIsNoHttpHandlerBeanThenContextRefreshWillFail() {
 		addWebServerFactoryBean();
-		assertThatExceptionOfType(ApplicationContextException.class).isThrownBy(() -> this.context.refresh())
+		assertThatExceptionOfType(ApplicationContextException.class).isThrownBy(this.context::refresh)
 			.havingRootCause()
 			.withMessageContaining("Unable to start ReactiveWebApplicationContext due to missing HttpHandler bean");
 	}
@@ -77,7 +77,7 @@ class ReactiveWebServerApplicationContextTests {
 	void whenThereAreMultipleWebServerFactoryBeansThenContextRefreshWillFail() {
 		addWebServerFactoryBean();
 		addWebServerFactoryBean("anotherWebServerFactory");
-		assertThatExceptionOfType(ApplicationContextException.class).isThrownBy(() -> this.context.refresh())
+		assertThatExceptionOfType(ApplicationContextException.class).isThrownBy(this.context::refresh)
 			.havingRootCause()
 			.withMessageContaining(
 					"Unable to start ReactiveWebApplicationContext due to multiple ReactiveWebServerFactory beans");
@@ -88,7 +88,7 @@ class ReactiveWebServerApplicationContextTests {
 		addWebServerFactoryBean();
 		addHttpHandlerBean("httpHandler1");
 		addHttpHandlerBean("httpHandler2");
-		assertThatExceptionOfType(ApplicationContextException.class).isThrownBy(() -> this.context.refresh())
+		assertThatExceptionOfType(ApplicationContextException.class).isThrownBy(this.context::refresh)
 			.havingRootCause()
 			.withMessageContaining("Unable to start ReactiveWebApplicationContext due to multiple HttpHandler beans");
 	}
@@ -164,7 +164,7 @@ class ReactiveWebServerApplicationContextTests {
 		addWebServerFactoryBean();
 		addHttpHandlerBean();
 		this.context.refresh();
-		assertThatIllegalStateException().isThrownBy(() -> this.context.refresh())
+		assertThatIllegalStateException().isThrownBy(this.context::refresh)
 			.withMessageContaining("multiple refresh attempts");
 	}
 

spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/servlet/AbstractFilterRegistrationBeanTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -205,7 +205,7 @@ abstract class AbstractFilterRegistrationBeanTests {
 
 	@Test
 	void failsWithDoubleRegistration() {
-		assertThatIllegalStateException().isThrownBy(() -> doubleRegistration())
+		assertThatIllegalStateException().isThrownBy(this::doubleRegistration)
 			.withMessage("Failed to register 'filter double-registration' on the "
 					+ "servlet context. Possibly already registered?");
 	}

spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/servlet/ServletRegistrationBeanTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -69,7 +69,7 @@ class ServletRegistrationBeanTests {
 
 	@Test
 	void failsWithDoubleRegistration() {
-		assertThatIllegalStateException().isThrownBy(() -> doubleRegistration())
+		assertThatIllegalStateException().isThrownBy(this::doubleRegistration)
 			.withMessage("Failed to register 'servlet double-registration' on "
 					+ "the servlet context. Possibly already registered?");
 	}

spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/servlet/context/ServletWebServerApplicationContextTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -215,7 +215,7 @@ class ServletWebServerApplicationContextTests {
 	void cannotSecondRefresh() {
 		addWebServerFactoryBean();
 		this.context.refresh();
-		assertThatIllegalStateException().isThrownBy(() -> this.context.refresh());
+		assertThatIllegalStateException().isThrownBy(this.context::refresh);
 	}
 
 	@Test
@@ -229,7 +229,7 @@ class ServletWebServerApplicationContextTests {
 
 	@Test
 	void missingServletWebServerFactory() {
-		assertThatExceptionOfType(ApplicationContextException.class).isThrownBy(() -> this.context.refresh())
+		assertThatExceptionOfType(ApplicationContextException.class).isThrownBy(this.context::refresh)
 			.havingRootCause()
 			.withMessageContaining("Unable to start ServletWebServerApplicationContext due to missing "
 					+ "ServletWebServerFactory bean");
@@ -240,7 +240,7 @@ class ServletWebServerApplicationContextTests {
 		addWebServerFactoryBean();
 		this.context.registerBeanDefinition("webServerFactory2",
 				new RootBeanDefinition(MockServletWebServerFactory.class));
-		assertThatExceptionOfType(ApplicationContextException.class).isThrownBy(() -> this.context.refresh())
+		assertThatExceptionOfType(ApplicationContextException.class).isThrownBy(this.context::refresh)
 			.havingRootCause()
 			.withMessageContaining("Unable to start ServletWebServerApplicationContext due to "
 					+ "multiple ServletWebServerFactory beans");

spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator/src/test/java/smoketest/actuator/ShutdownSampleActuatorApplicationTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -29,6 +29,7 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.test.annotation.DirtiesContext;
 
@@ -74,7 +75,7 @@ class ShutdownSampleActuatorApplicationTests {
 
 		@Bean
 		SecurityFilterChain configure(HttpSecurity http) throws Exception {
-			http.csrf((csrf) -> csrf.disable());
+			http.csrf(CsrfConfigurer::disable);
 			return http.build();
 		}
 

spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-graphql/src/main/java/smoketest/graphql/SecurityConfig.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,6 +21,7 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
@@ -35,7 +36,7 @@ public class SecurityConfig {
 
 	@Bean
 	public DefaultSecurityFilterChain springWebFilterChain(HttpSecurity http) throws Exception {
-		return http.csrf((csrf) -> csrf.disable())
+		return http.csrf(CsrfConfigurer::disable)
 			// Demonstrate that method security works
 			// Best practice to use both for defense in depth
 			.authorizeHttpRequests((requests) -> requests.anyRequest().permitAll())

spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-session-hazelcast/src/main/java/smoketest/session/hazelcast/SecurityConfiguration.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,6 +21,7 @@ import org.springframework.boot.actuate.health.HealthEndpoint;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
 import org.springframework.security.web.SecurityFilterChain;
 
 import static org.springframework.security.config.Customizer.withDefaults;
@@ -41,7 +42,7 @@ class SecurityConfiguration {
 		});
 		http.formLogin(withDefaults());
 		http.httpBasic(withDefaults());
-		http.csrf((csrf) -> csrf.disable());
+		http.csrf(CsrfConfigurer::disable);
 		return http.build();
 	}
 

spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-session-jdbc/src/main/java/smoketest/session/SecurityConfiguration.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,6 +21,7 @@ import org.springframework.boot.actuate.health.HealthEndpoint;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
 import org.springframework.security.web.SecurityFilterChain;
 
 import static org.springframework.security.config.Customizer.withDefaults;
@@ -41,7 +42,7 @@ class SecurityConfiguration {
 		});
 		http.formLogin(withDefaults());
 		http.httpBasic(withDefaults());
-		http.csrf((csrf) -> csrf.disable());
+		http.csrf(CsrfConfigurer::disable);
 		return http.build();
 	}
 

spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-session-mongo/src/main/java/smoketest/session/mongodb/SecurityConfiguration.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,6 +21,7 @@ import org.springframework.boot.actuate.health.HealthEndpoint;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
 import org.springframework.security.web.SecurityFilterChain;
 
 import static org.springframework.security.config.Customizer.withDefaults;
@@ -41,7 +42,7 @@ class SecurityConfiguration {
 		});
 		http.formLogin(withDefaults());
 		http.httpBasic(withDefaults());
-		http.csrf((csrf) -> csrf.disable());
+		http.csrf(CsrfConfigurer::disable);
 		return http.build();
 	}
 

spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-session-redis/src/main/java/smoketest/session/redis/SecurityConfiguration.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,6 +21,7 @@ import org.springframework.boot.actuate.health.HealthEndpoint;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
 import org.springframework.security.web.SecurityFilterChain;
 
 import static org.springframework.security.config.Customizer.withDefaults;
@@ -41,7 +42,7 @@ class SecurityConfiguration {
 		});
 		http.formLogin(withDefaults());
 		http.httpBasic(withDefaults());
-		http.csrf((csrf) -> csrf.disable());
+		http.csrf(CsrfConfigurer::disable);
 		return http.build();
 	}
 

spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-method-security/src/main/java/smoketest/security/method/SampleMethodSecurityApplication.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -28,6 +28,7 @@ import org.springframework.core.annotation.Order;
 import org.springframework.security.access.annotation.Secured;
 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
 import org.springframework.security.web.SecurityFilterChain;
@@ -75,7 +76,7 @@ public class SampleMethodSecurityApplication implements WebMvcConfigurer {
 
 		@Bean
 		SecurityFilterChain configure(HttpSecurity http) throws Exception {
-			http.csrf((csrf) -> csrf.disable());
+			http.csrf(CsrfConfigurer::disable);
 			http.authorizeHttpRequests((requests) -> {
 				requests.dispatcherTypeMatchers(DispatcherType.FORWARD).permitAll();
 				requests.anyRequest().fullyAuthenticated();
@@ -94,7 +95,7 @@ public class SampleMethodSecurityApplication implements WebMvcConfigurer {
 
 		@Bean
 		SecurityFilterChain actuatorSecurity(HttpSecurity http) throws Exception {
-			http.csrf((csrf) -> csrf.disable());
+			http.csrf(CsrfConfigurer::disable);
 			http.securityMatcher(EndpointRequest.toAnyEndpoint());
 			http.authorizeHttpRequests((requests) -> requests.anyRequest().authenticated());
 			http.httpBasic(withDefaults());

spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure-custom/src/main/java/smoketest/web/secure/custom/SampleWebSecureCustomApplication.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,6 +23,7 @@ import org.springframework.boot.builder.SpringApplicationBuilder;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@@ -45,7 +46,7 @@ public class SampleWebSecureCustomApplication implements WebMvcConfigurer {
 
 		@Bean
 		SecurityFilterChain configure(HttpSecurity http) throws Exception {
-			http.csrf((csrf) -> csrf.disable());
+			http.csrf(CsrfConfigurer::disable);
 			http.authorizeHttpRequests((requests) -> {
 				requests.dispatcherTypeMatchers(DispatcherType.FORWARD).permitAll();
 				requests.anyRequest().fullyAuthenticated();

spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure-jdbc/src/main/java/smoketest/web/secure/jdbc/SampleWebSecureJdbcApplication.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -25,6 +25,7 @@ import org.springframework.boot.builder.SpringApplicationBuilder;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
 import org.springframework.security.provisioning.JdbcUserDetailsManager;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
@@ -48,7 +49,7 @@ public class SampleWebSecureJdbcApplication implements WebMvcConfigurer {
 
 		@Bean
 		SecurityFilterChain configure(HttpSecurity http) throws Exception {
-			http.csrf((csrf) -> csrf.disable());
+			http.csrf(CsrfConfigurer::disable);
 			http.authorizeHttpRequests((requests) -> {
 				requests.dispatcherTypeMatchers(DispatcherType.FORWARD).permitAll();
 				requests.anyRequest().fullyAuthenticated();

spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure/src/test/java/smoketest/web/secure/SampleWebSecureApplicationTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -34,6 +34,7 @@ import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.util.LinkedMultiValueMap;
 import org.springframework.util.MultiValueMap;
@@ -96,7 +97,7 @@ class SampleWebSecureApplicationTests {
 
 		@Bean
 		SecurityFilterChain configure(HttpSecurity http) throws Exception {
-			http.csrf((csrf) -> csrf.disable());
+			http.csrf(CsrfConfigurer::disable);
 			http.authorizeHttpRequests((requests) -> {
 				requests.requestMatchers("/public/**").permitAll();
 				requests.dispatcherTypeMatchers(DispatcherType.FORWARD).permitAll();