Spring WebFlux is part of Spring 5, which provides reactive development support for web applications. In this tutorial, we will use RestController and WebClient, to create a small responsive REST application. We will also analyze how to use Spring Security to protect our reactive endpoints.

Spring WebFlux is part of Spring 5, which provides reactive development support for web applications.

Spring-WebFlux framework

Spring WebFlux uses Project Reactor and its publishers for its internal Flux and Mono implementation.

The new framework supports two programming models:

  • Firstly, annotated response element.
  • Secondly, routing and processing of functions.


Let’s start with the WebFlux Spring Boot Starter dependencies, which contain all the other required dependencies:

  • Spring Boot and Spring Boot Starter for basic Spring Boot application settings;
  • Spring-WebFlux framework;
  • Reactor-core, Reactor-netty.

Responsive application

We will now use Spring WebFlux to build a simple employee management REST application:

Simple domain model – Employee with id fields and first name.

We will use RestController to build a REST API to publish employee resources as a single resource and collection, WebClient to build a client to download the same resources, WebFlux and Spring Security to create a secure passive endpoint.

Responsive REST controller

SpringwWebFlux handles annotation-based configuration in the same way as the springwebmvc framework.

First, we create an annotated controller on the server that publishes an employee resource response flow.

Let’s create EmployeeController with annotations:

EmployeeRepository can be any data repository supporting a non-blocking reactive flow.

Single resource

Let’s create an endpoint in the controller to publish a single employee resource:

We wrap an employee asset in Mono because we are returning a maximum of one employee.

Collection resources

We will also add an endpoint to publish a set of resources for all employees.

Reactive Web Client

WebClient in Spring5 is a non-blocking client that supports reactive streaming.

We can use WebClient to create a client that gets data from an endpoint provided by EmployeeController.

Let’s create a simple EmployeeWebClient:

Here we are using the create factory method to create a WebClient. It will point to localhost: 8080, so we can use a relative URL to call this client instance.

We take a single resource

To download a single Mono / employees / {id} resource, we do the following:

Recover collection assets

Similarly, to get the resources of a Flux collection, let’s do the following:

Spring Security WebFlux

We can use Spring Security to protect our reactive endpoints.

Suppose we have a new endpoint in EmployeeController that updates employee data and sends back the updated employee.

Since this solution allows users to change existing employees, we want to limit only users with the administrator role.

Let’s add a new method to EmployeeController:

Now, to restrict access to this method, let’s create a SecurityConfig and define some path-based rules to allow dos only administrators:

This configuration will restrict access to / employees/update. Therefore, only users with the ADMIN role can access this endpoint and update existing employees.

Finally, the @EnableWebFluxSecurity annotation adds the default Spring-Security-WebFlux support in the default configuration.

In conclusion

In this article, we discussed, how to build and use reactive web components supported by the SpringWebFlux framework. For example, we built a small REST application.

In addition to Reactive RestController and WebClient, the WebFlux framework also supports Reactive WebSocket and its corresponding WebSocketClient for reactive streaming.

Leave a Comment