When I created a Spring Boot 2.0.0.M3 project, I found the existing security starter did not include spring-secuirty-webflux. I had to add this artifact explicitly in pom.xml.
I think it is better to create a spring-boot-starter-security-webflux starter to add spring-security-webflux into project dependencies and take over the responsibility of @EnableWebFluxSecurity .