@EnableWebFluxSecurity
public class TestSecurityConfig {

    @Bean
    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http,
                                                         ServerSecurityContextRepository serverSecurityContextRepository) {
        return http.csrf().disable()
                   .formLogin().disable()
                   .httpBasic().disable()
                   .securityContextRepository(serverSecurityContextRepository)
                   .authorizeExchange()
                   .anyExchange().authenticated()
                   .and()
                   .build();
    }

    @Bean
    public ServerSecurityContextRepository serverSecurityContextRepository() {
        return new ServerSecurityContextRepository() {
            @Override
            public Mono<Void> save(ServerWebExchange exchange,
                                   SecurityContext context) {
                return Mono.empty();
            }

            @Override
            public Mono<SecurityContext> load(ServerWebExchange exchange) {
                // no authorities -> not authenticated
                final Authentication authentication = new UsernamePasswordAuthenticationToken("test", "test");
                return Mono.defer(() -> {
                    System.out.println("TestSecurityConfig: load"); // invoked twice
                    return Mono.just(new SecurityContextImpl(authentication));
                });
            }
        };
    }
}