diff --git a/samples/javaconfig/hellowebflux/src/integration-test/java/sample/HelloWebfluxApplicationITests.java b/samples/javaconfig/hellowebflux/src/integration-test/java/sample/HelloWebfluxApplicationITests.java
index 510398e7fa..a9e282c166 100644
--- a/samples/javaconfig/hellowebflux/src/integration-test/java/sample/HelloWebfluxApplicationITests.java
+++ b/samples/javaconfig/hellowebflux/src/integration-test/java/sample/HelloWebfluxApplicationITests.java
@@ -16,6 +16,8 @@
 package sample;
 
 import java.time.Duration;
+import java.util.Map;
+import java.util.function.Consumer;
 
 import org.junit.Before;
 import org.junit.Test;
@@ -26,9 +28,9 @@ import org.springframework.test.context.ContextConfiguration;
 import org.springframework.test.context.TestPropertySource;
 import org.springframework.test.context.junit4.SpringRunner;
 import org.springframework.test.web.reactive.server.WebTestClient;
-import org.springframework.web.reactive.function.client.ExchangeFilterFunction;
 
 import static org.springframework.web.reactive.function.client.ExchangeFilterFunctions.basicAuthentication;
+import static org.springframework.web.reactive.function.client.ExchangeFilterFunctions.Credentials.basicAuthenticationCredentials;
 
 /**
  * @author Rob Winch
@@ -48,6 +50,7 @@ public class HelloWebfluxApplicationITests {
 		this.rest = WebTestClient.bindToServer()
 				.responseTimeout(Duration.ofDays(1))
 				.baseUrl("http://localhost:" + this.port)
+				.filter(basicAuthentication())
 				.build();
 	}
 
@@ -64,11 +67,9 @@ public class HelloWebfluxApplicationITests {
 	@Test
 	public void basicWhenValidCredentialsThenOk() throws Exception {
 		this.rest
-			.mutate()
-			.filter(userCredentials())
-			.build()
 			.get()
 			.uri("/")
+			.attributes(userCredentials())
 			.exchange()
 			.expectStatus().isOk()
 			.expectBody().json("{\"message\":\"Hello user!\"}");
@@ -77,21 +78,19 @@ public class HelloWebfluxApplicationITests {
 	@Test
 	public void basicWhenInvalidCredentialsThenUnauthorized() throws Exception {
 		this.rest
-			.mutate()
-			.filter(invalidPassword())
-			.build()
 			.get()
 			.uri("/")
+			.attributes(invalidCredentials())
 			.exchange()
 			.expectStatus().isUnauthorized()
 			.expectBody().isEmpty();
 	}
 
-	private ExchangeFilterFunction userCredentials() {
-		return basicAuthentication("user","user");
+	private Consumer<Map<String, Object>> userCredentials() {
+		return basicAuthenticationCredentials("user","user");
 	}
 
-	private ExchangeFilterFunction invalidPassword() {
-		return basicAuthentication("user","INVALID");
+	private Consumer<Map<String, Object>> invalidCredentials() {
+		return basicAuthenticationCredentials("user","INVALID");
 	}
 }
diff --git a/samples/javaconfig/hellowebflux/src/test/java/sample/HelloWebfluxApplicationTests.java b/samples/javaconfig/hellowebflux/src/test/java/sample/HelloWebfluxApplicationTests.java
index 62e286901b..632cc23e25 100644
--- a/samples/javaconfig/hellowebflux/src/test/java/sample/HelloWebfluxApplicationTests.java
+++ b/samples/javaconfig/hellowebflux/src/test/java/sample/HelloWebfluxApplicationTests.java
@@ -17,6 +17,9 @@
  */
 package sample;
 
+import java.util.Map;
+import java.util.function.Consumer;
+
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -27,11 +30,11 @@ import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.ContextConfiguration;
 import org.springframework.test.context.junit4.SpringRunner;
 import org.springframework.test.web.reactive.server.WebTestClient;
-import org.springframework.web.reactive.function.client.ExchangeFilterFunction;
 
 import static org.springframework.security.test.web.reactive.server.SecurityMockServerConfigurers.mockUser;
 import static org.springframework.security.test.web.reactive.server.SecurityMockServerConfigurers.springSecurity;
 import static org.springframework.web.reactive.function.client.ExchangeFilterFunctions.basicAuthentication;
+import static org.springframework.web.reactive.function.client.ExchangeFilterFunctions.Credentials.basicAuthenticationCredentials;
 
 /**
  * @author Rob Winch
@@ -51,6 +54,8 @@ public class HelloWebfluxApplicationTests {
 		this.rest = WebTestClient
 			.bindToApplicationContext(this.context)
 			.apply(springSecurity())
+			.configureClient()
+			.filter(basicAuthentication())
 			.build();
 	}
 
@@ -66,11 +71,9 @@ public class HelloWebfluxApplicationTests {
 	@Test
 	public void basicWhenValidCredentialsThenOk() throws Exception {
 		this.rest
-			.mutate()
-			.filter(userCredentials())
-			.build()
 			.get()
 			.uri("/")
+			.attributes(userCredentials())
 			.exchange()
 			.expectStatus().isOk()
 			.expectBody().json("{\"message\":\"Hello user!\"}");
@@ -79,11 +82,9 @@ public class HelloWebfluxApplicationTests {
 	@Test
 	public void basicWhenInvalidCredentialsThenUnauthorized() throws Exception {
 		this.rest
-			.mutate()
-			.filter(invalidPassword())
-			.build()
 			.get()
 			.uri("/")
+			.attributes(invalidCredentials())
 			.exchange()
 			.expectStatus().isUnauthorized()
 			.expectBody().isEmpty();
@@ -106,11 +107,11 @@ public class HelloWebfluxApplicationTests {
 			.expectStatus().isUnauthorized();
 	}
 
-	private ExchangeFilterFunction userCredentials() {
-		return basicAuthentication("user","user");
+	private Consumer<Map<String, Object>> userCredentials() {
+		return basicAuthenticationCredentials("user","user");
 	}
 
-	private ExchangeFilterFunction invalidPassword() {
-		return basicAuthentication("user","INVALID");
+	private Consumer<Map<String, Object>> invalidCredentials() {
+		return basicAuthenticationCredentials("user","INVALID");
 	}
 }
diff --git a/samples/javaconfig/hellowebfluxfn/src/integration-test/java/sample/HelloWebfluxFnApplicationITests.java b/samples/javaconfig/hellowebfluxfn/src/integration-test/java/sample/HelloWebfluxFnApplicationITests.java
index 7c02a819f1..385e7774ab 100644
--- a/samples/javaconfig/hellowebfluxfn/src/integration-test/java/sample/HelloWebfluxFnApplicationITests.java
+++ b/samples/javaconfig/hellowebfluxfn/src/integration-test/java/sample/HelloWebfluxFnApplicationITests.java
@@ -16,6 +16,8 @@
 package sample;
 
 import java.time.Duration;
+import java.util.Map;
+import java.util.function.Consumer;
 
 import org.junit.Before;
 import org.junit.Test;
@@ -26,9 +28,9 @@ import org.springframework.test.context.ContextConfiguration;
 import org.springframework.test.context.TestPropertySource;
 import org.springframework.test.context.junit4.SpringRunner;
 import org.springframework.test.web.reactive.server.WebTestClient;
-import org.springframework.web.reactive.function.client.ExchangeFilterFunction;
 
 import static org.springframework.web.reactive.function.client.ExchangeFilterFunctions.basicAuthentication;
+import static org.springframework.web.reactive.function.client.ExchangeFilterFunctions.Credentials.basicAuthenticationCredentials;
 
 /**
  * @author Rob Winch
@@ -48,6 +50,7 @@ public class HelloWebfluxFnApplicationITests {
 		this.rest = WebTestClient.bindToServer()
 				.responseTimeout(Duration.ofDays(1))
 				.baseUrl("http://localhost:" + this.port)
+				.filter(basicAuthentication())
 				.build();
 	}
 
@@ -63,11 +66,9 @@ public class HelloWebfluxFnApplicationITests {
 	@Test
 	public void basicWhenValidCredentialsThenOk() throws Exception {
 		this.rest
-			.mutate()
-			.filter(userCredentials())
-			.build()
 			.get()
 			.uri("/")
+			.attributes(userCredentials())
 			.exchange()
 			.expectStatus().isOk()
 			.expectBody().json("{\"message\":\"Hello user!\"}");
@@ -76,21 +77,19 @@ public class HelloWebfluxFnApplicationITests {
 	@Test
 	public void basicWhenInvalidCredentialsThenUnauthorized() throws Exception {
 		this.rest
-			.mutate()
-			.filter(invalidPassword())
-			.build()
 			.get()
 			.uri("/")
+			.attributes(invalidCredentials())
 			.exchange()
 			.expectStatus().isUnauthorized()
 			.expectBody().isEmpty();
 	}
 
-	private ExchangeFilterFunction userCredentials() {
-		return basicAuthentication("user","user");
+	private Consumer<Map<String, Object>> userCredentials() {
+		return basicAuthenticationCredentials("user","user");
 	}
 
-	private ExchangeFilterFunction invalidPassword() {
-		return basicAuthentication("user","INVALID");
+	private Consumer<Map<String, Object>> invalidCredentials() {
+		return basicAuthenticationCredentials("user","INVALID");
 	}
 }
diff --git a/samples/javaconfig/hellowebfluxfn/src/test/java/sample/HelloWebfluxFnApplicationTests.java b/samples/javaconfig/hellowebfluxfn/src/test/java/sample/HelloWebfluxFnApplicationTests.java
index 5558ee9528..68ea1d26b9 100644
--- a/samples/javaconfig/hellowebfluxfn/src/test/java/sample/HelloWebfluxFnApplicationTests.java
+++ b/samples/javaconfig/hellowebfluxfn/src/test/java/sample/HelloWebfluxFnApplicationTests.java
@@ -17,6 +17,9 @@
  */
 package sample;
 
+import java.util.Map;
+import java.util.function.Consumer;
+
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -27,11 +30,11 @@ import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.ContextConfiguration;
 import org.springframework.test.context.junit4.SpringRunner;
 import org.springframework.test.web.reactive.server.WebTestClient;
-import org.springframework.web.reactive.function.client.ExchangeFilterFunction;
 import org.springframework.web.reactive.function.server.RouterFunction;
 
 import static org.springframework.security.test.web.reactive.server.SecurityMockServerConfigurers.mockUser;
 import static org.springframework.security.test.web.reactive.server.SecurityMockServerConfigurers.springSecurity;
+import static org.springframework.web.reactive.function.client.ExchangeFilterFunctions.Credentials.basicAuthenticationCredentials;
 import static org.springframework.web.reactive.function.client.ExchangeFilterFunctions.basicAuthentication;
 
 /**
@@ -55,6 +58,8 @@ public class HelloWebfluxFnApplicationTests {
 			.bindToRouterFunction(this.routerFunction)
 			.webFilter(this.springSecurityFilterChain)
 			.apply(springSecurity())
+			.configureClient()
+			.filter(basicAuthentication())
 			.build();
 	}
 
@@ -70,11 +75,9 @@ public class HelloWebfluxFnApplicationTests {
 	@Test
 	public void basicWhenValidCredentialsThenOk() throws Exception {
 		this.rest
-			.mutate()
-			.filter(userCredentials())
-			.build()
 			.get()
 			.uri("/")
+			.attributes(userCredentials())
 			.exchange()
 			.expectStatus().isOk()
 			.expectBody().json("{\"message\":\"Hello user!\"}");
@@ -83,11 +86,9 @@ public class HelloWebfluxFnApplicationTests {
 	@Test
 	public void basicWhenInvalidCredentialsThenUnauthorized() throws Exception {
 		this.rest
-			.mutate()
-			.filter(invalidPassword())
-			.build()
 			.get()
 			.uri("/")
+			.attributes(invalidCredentials())
 			.exchange()
 			.expectStatus().isUnauthorized()
 			.expectBody().isEmpty();
@@ -110,11 +111,11 @@ public class HelloWebfluxFnApplicationTests {
 			.expectStatus().isUnauthorized();
 	}
 
-	private ExchangeFilterFunction userCredentials() {
-		return basicAuthentication("user","user");
+	private Consumer<Map<String, Object>> userCredentials() {
+		return basicAuthenticationCredentials("user","user");
 	}
 
-	private ExchangeFilterFunction invalidPassword() {
-		return basicAuthentication("user","INVALID");
+	private Consumer<Map<String, Object>> invalidCredentials() {
+		return basicAuthenticationCredentials("user","INVALID");
 	}
 }
diff --git a/webflux/src/test/java/org/springframework/security/web/server/authentication/AuthenticationWebFilterTests.java b/webflux/src/test/java/org/springframework/security/web/server/authentication/AuthenticationWebFilterTests.java
index 08eaeca09a..373a82d0aa 100644
--- a/webflux/src/test/java/org/springframework/security/web/server/authentication/AuthenticationWebFilterTests.java
+++ b/webflux/src/test/java/org/springframework/security/web/server/authentication/AuthenticationWebFilterTests.java
@@ -46,6 +46,7 @@ import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyZeroInteractions;
 import static org.mockito.Mockito.when;
 import static org.springframework.web.reactive.function.client.ExchangeFilterFunctions.basicAuthentication;
+import static org.springframework.web.reactive.function.client.ExchangeFilterFunctions.Credentials.basicAuthenticationCredentials;
 
 
 /**
@@ -102,14 +103,13 @@ public class AuthenticationWebFilterTests {
 
 		WebTestClient client = WebTestClientBuilder
 			.bindToWebFilters(this.filter)
+			.filter(basicAuthentication())
 			.build();
 
 		EntityExchangeResult<String> result = client
-			.mutate()
-			.filter(basicAuthentication("test","this"))
-			.build()
 			.get()
 			.uri("/")
+			.attributes(basicAuthenticationCredentials("test", "this"))
 			.exchange()
 			.expectStatus().isOk()
 			.expectBody(String.class).consumeWith(b -> assertThat(b.getResponseBody()).isEqualTo("ok"))
@@ -125,14 +125,13 @@ public class AuthenticationWebFilterTests {
 
 		WebTestClient client = WebTestClientBuilder
 			.bindToWebFilters(this.filter)
+			.filter(basicAuthentication())
 			.build();
 
 		EntityExchangeResult<Void> result = client
-			.mutate()
-			.filter(basicAuthentication("test", "this"))
-			.build()
 			.get()
 			.uri("/")
+			.attributes(basicAuthenticationCredentials("test", "this"))
 			.exchange()
 			.expectStatus().isUnauthorized()
 			.expectHeader().valueMatches("WWW-Authenticate", "Basic realm=\"Realm\"")
@@ -212,14 +211,13 @@ public class AuthenticationWebFilterTests {
 
 		WebTestClient client = WebTestClientBuilder
 			.bindToWebFilters(this.filter)
+			.filter(basicAuthentication())
 			.build();
 
 		EntityExchangeResult<String> result = client
-			.mutate()
-			.filter(basicAuthentication("test","this"))
-			.build()
 			.get()
 			.uri("/")
+			.attributes(basicAuthenticationCredentials("test", "this"))
 			.exchange()
 			.expectStatus().isOk()
 			.expectBody(String.class).consumeWith(b -> assertThat(b.getResponseBody()).isEqualTo("ok"))