title: Spring webflux custom authentication for API
body: <p>I am creating an API for an Angular 5 application. I would like to use JWT for authentication.<br>
  I would like to use the features that are provided by spring security so I can easily work with roles.</p>
  
  <p>I managed to disable basic authentication. But when using <code>http.authorizeExchange().anyExchange().authenticated();</code> I still get a login prompt.<br>
  I would like to just give a 403 instead of the prompt. So overriding the login prompt by a "thing"(Is it a filter?) that checks the <code>Authorization</code> header for the token.</p>
  
  <p>The login I just want to do in a controller that will return a JWT token. But what spring security bean I should use for checking user credentials? I can build my own services and repositories, but I would like to use the features provided by spring security as much as possible.</p>
  
  <p>The short version of this question is just:<br>
  <strong>How can I customize spring security's authentication?</strong><br>
  What beans do I have to create?<br>
  Where do I have to put the configuration? (I now have a bean of <code>SecurityWebFilterChain</code>)</p>
  
  <p>The only documentation I could find about authentication in webflux with spring security is this: <a href="https://docs.spring.io/spring-security/site/docs/5.0.0.BUILD-SNAPSHOT/reference/htmlsingle/#jc-webflux" rel="noreferrer">https://docs.spring.io/spring-security/site/docs/5.0.0.BUILD-SNAPSHOT/reference/htmlsingle/#jc-webflux</a></p>