Lazily Create Throwables

Fixes: gh-5040

core/src/main/java/org/springframework/security/access/prepost/PrePostAdviceReactiveMethodInterceptor.java

@@ -76,7 +76,7 @@ public class PrePostAdviceReactiveMethodInterceptor implements MethodInterceptor
 			.map(SecurityContext::getAuthentication)
 			.defaultIfEmpty(this.anonymous)
 			.filter( auth -> this.preInvocationAdvice.before(auth, invocation, preAttr))
-			.switchIfEmpty(Mono.error(new AccessDeniedException("Denied")));
+			.switchIfEmpty(Mono.defer(() -> Mono.error(new AccessDeniedException("Denied"))));
 
 
 		PostInvocationAttribute attr = findPostInvocationAttribute(attributes);

core/src/main/java/org/springframework/security/authentication/UserDetailsRepositoryReactiveAuthenticationManager.java

@@ -45,7 +45,7 @@ public class UserDetailsRepositoryReactiveAuthenticationManager implements React
 		return this.userDetailsService.findByUsername(username)
 				.publishOn(Schedulers.parallel())
 				.filter( u -> this.passwordEncoder.matches((String) authentication.getCredentials(), u.getPassword()))
-				.switchIfEmpty(  Mono.error(new BadCredentialsException("Invalid Credentials")) )
+				.switchIfEmpty(Mono.defer(() -> Mono.error(new BadCredentialsException("Invalid Credentials"))))
 				.map( u -> new UsernamePasswordAuthenticationToken(u, u.getPassword(), u.getAuthorities()) );
 	}
 

core/src/main/java/org/springframework/security/authorization/ReactiveAuthorizationManager.java

@@ -50,7 +50,7 @@ public interface ReactiveAuthorizationManager<T> {
 	default Mono<Void> verify(Mono<Authentication> authentication, T object) {
 		return check(authentication, object)
 			.filter( d -> d.isGranted())
-			.switchIfEmpty( Mono.error(new AccessDeniedException("Access Denied")) )
+			.switchIfEmpty(Mono.defer(() -> Mono.error(new AccessDeniedException("Access Denied"))))
 			.flatMap( d -> Mono.empty() );
 	}
 }

web/src/main/java/org/springframework/security/web/server/csrf/CsrfWebFilter.java

@@ -95,9 +95,9 @@ public class CsrfWebFilter implements WebFilter {
 
 	private Mono<Void> validateToken(ServerWebExchange exchange) {
 		return this.csrfTokenRepository.loadToken(exchange)
-			.switchIfEmpty(Mono.error(new CsrfException("CSRF Token has been associated to this client")))
+			.switchIfEmpty(Mono.defer(() -> Mono.error(new CsrfException("CSRF Token has been associated to this client"))))
 			.filterWhen(expected -> containsValidCsrfToken(exchange, expected))
-			.switchIfEmpty(Mono.error(new CsrfException("Invalid CSRF Token")))
+			.switchIfEmpty(Mono.defer(() -> Mono.error(new CsrfException("Invalid CSRF Token"))))
 			.then();
 	}