@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
class SecurityConfig() {

    @Bean
    fun securityWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
        http.httpBasic()
                .disable()
            .formLogin()
                .disable()
            .csrf()
                .disable()
            .logout()
                .disable()


            http.addFilterAt(authenticationFilter(), SecurityWebFiltersOrder.AUTHENTICATION)
                .authorizeExchange()
                    .pathMatchers("/api/ping")
                    .permitAll()
                    .pathMatchers("/favicon.ico")
                    .permitAll()
                    .pathMatchers(HttpMethod.OPTIONS)
                    .permitAll()
                .anyExchange()
                .authenticated()

        return http.build()
    }

    private fun authenticationFilter(): AuthenticationWebFilter {
        ...
    }
}