diff --git a/modules/json/src/org/apache/axis2/json/gson/JsonFormatter.java b/modules/json/src/org/apache/axis2/json/gson/JsonFormatter.java
index 776674f..6c42c44 100644
--- a/modules/json/src/org/apache/axis2/json/gson/JsonFormatter.java
+++ b/modules/json/src/org/apache/axis2/json/gson/JsonFormatter.java
@@ -101,7 +101,7 @@
                 try {
                     GsonBuilder gsonBuilder = new GsonBuilder(); 
                     // XSS protection, encode JSON Strings as HTML
-                    gsonBuilder.registerTypeAdapter(String.class, new JsonHtmlXssSerializer());
+                    gsonBuilder.registerTypeAdapter(String.class, new JsonHtmlEncoder());
                     Gson gson = gsonBuilder.create();
                     jsonWriter.beginObject();
                     jsonWriter.name(JsonConstant.RESPONSE);
diff --git a/modules/json/src/org/apache/axis2/json/gson/JsonHtmlXssSerializer.java b/modules/json/src/org/apache/axis2/json/gson/JsonHtmlEncoder.java
similarity index 94%
rename from modules/json/src/org/apache/axis2/json/gson/JsonHtmlXssSerializer.java
rename to modules/json/src/org/apache/axis2/json/gson/JsonHtmlEncoder.java
index 619c1ae..0b76443 100644
--- a/modules/json/src/org/apache/axis2/json/gson/JsonHtmlXssSerializer.java
+++ b/modules/json/src/org/apache/axis2/json/gson/JsonHtmlEncoder.java
@@ -27,7 +27,7 @@
 import com.google.gson.JsonSerializer;
 import java.lang.reflect.Type;
 
-public class JsonHtmlXssSerializer implements JsonSerializer<String> {
+public class JsonHtmlEncoder implements JsonSerializer<String> {
 
 	@Override
 	public JsonElement serialize(String src, Type typeOfSrc,
diff --git a/modules/json/src/org/apache/axis2/json/moshi/JsonFormatter.java b/modules/json/src/org/apache/axis2/json/moshi/JsonFormatter.java
index 941451e..1936873 100644
--- a/modules/json/src/org/apache/axis2/json/moshi/JsonFormatter.java
+++ b/modules/json/src/org/apache/axis2/json/moshi/JsonFormatter.java
@@ -60,7 +60,7 @@
         String msg;
 
         try {
-            Moshi moshi = new Moshi.Builder().add(String.class, new JsonHtmlXssSerializer()).add(Date.class, new Rfc3339DateJsonAdapter()).build();
+            Moshi moshi = new Moshi.Builder().add(String.class, new JsonHtmlEncoder()).add(Date.class, new Rfc3339DateJsonAdapter()).build();
             JsonAdapter<Object> adapter = moshi.adapter(Object.class);
             BufferedSink sink = Okio.buffer(Okio.sink(outputStream));
             jsonWriter = JsonWriter.of(sink);
diff --git a/modules/json/src/org/apache/axis2/json/moshi/JsonHtmlXssSerializer.java b/modules/json/src/org/apache/axis2/json/moshi/JsonHtmlEncoder.java
similarity index 95%
rename from modules/json/src/org/apache/axis2/json/moshi/JsonHtmlXssSerializer.java
rename to modules/json/src/org/apache/axis2/json/moshi/JsonHtmlEncoder.java
index 241a96e..3a7c906 100644
--- a/modules/json/src/org/apache/axis2/json/moshi/JsonHtmlXssSerializer.java
+++ b/modules/json/src/org/apache/axis2/json/moshi/JsonHtmlEncoder.java
@@ -26,7 +26,7 @@
 
 import org.owasp.encoder.Encode;
 
-public final class JsonHtmlXssSerializer extends JsonAdapter<String> {
+public final class JsonHtmlEncoder extends JsonAdapter<String> {
 
     @Override
     public synchronized String fromJson(JsonReader reader) throws IOException {
diff --git a/modules/samples/userguide/README.txt b/modules/samples/userguide/README.txt
index 0a38736..cf4d8d1 100644
--- a/modules/samples/userguide/README.txt
+++ b/modules/samples/userguide/README.txt
@@ -8,6 +8,9 @@
 The sample explains how to write a Web service and Web service client with 
 Apache Axis2 using XML based client APIs (Axis2's Primary APIs).
 
+For new applications, json-springboot-userguide.html brings Axis2 into 
+modern API's and contemporary servers. 
+
 Introduction
 ============
 
@@ -41,7 +44,7 @@
 Pre-Requisites
 ==============
 
-Apache Ant 1.6.2 or later
+Apache Ant 1.8.0 or later
 
 Building the Service
 ====================
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/pom.xml b/modules/samples/userguide/src/userguide/springbootdemo/pom.xml
new file mode 100644
index 0000000..731fdec
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/pom.xml
@@ -0,0 +1,405 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+  ~ Licensed to the Apache Software Foundation (ASF) under one
+  ~ or more contributor license agreements. See the NOTICE file
+  ~ distributed with this work for additional information
+  ~ regarding copyright ownership. The ASF licenses this file
+  ~ to you under the Apache License, Version 2.0 (the
+  ~ "License"); you may not use this file except in compliance
+  ~ with the License. You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing,
+  ~ software distributed under the License is distributed on an
+  ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  ~ KIND, either express or implied. See the License for the
+  ~ specific language governing permissions and limitations
+  ~ under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>userguide.springboot</groupId>
+    <artifactId>axis2-json-api</artifactId>
+    <version>0.0.1-SNAPSHOT</version>
+    <packaging>war</packaging>
+    <name>axis2-json-api</name>
+    <description>Spring Boot with Axis2 demo</description>
+
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>2.5.2</version>
+        <relativePath/> <!-- lookup parent from repository -->
+    </parent>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
+        <java.version>1.8</java.version>
+        <spring-boot.version>2.5.2</spring-boot.version>
+        <forceHttps>false</forceHttps>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <!-- Required in this userguide for 
+                 org.springframework.dao.DataAccessException 
+            -->
+            <artifactId>spring-boot-starter-data-jpa</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>com.zaxxer</groupId>
+                    <artifactId>HikariCP</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>3.12.0</version>
+        </dependency>
+        <dependency>
+            <groupId>com.sun.mail</groupId>
+            <artifactId>jakarta.mail</artifactId>
+            <version>1.6.7</version>
+        </dependency>
+        <dependency>
+            <groupId>jakarta.activation</groupId>
+            <artifactId>jakarta.activation-api</artifactId>
+            <version>1.2.1</version>
+        </dependency>
+        <dependency>
+            <groupId>org.glassfish.jaxb</groupId>
+            <artifactId>jaxb-runtime</artifactId>
+            <version>2.3.4</version>
+        </dependency>
+        <dependency>
+            <groupId>jakarta.xml.bind</groupId>
+            <artifactId>jakarta.xml.bind-api</artifactId>
+            <version>2.3.3</version>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-log4j2</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-jul</artifactId>
+            <version>2.14.1</version>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-devtools</artifactId>
+            <scope>runtime</scope>
+        </dependency>
+	<dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-collections4</artifactId>
+            <version>4.4</version>
+	</dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-configuration-processor</artifactId>
+            <optional>true</optional>
+        </dependency>
+	<dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-validation</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.springframework.boot</groupId>
+                    <artifactId>spring-boot-starter-logging</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>javax.servlet</groupId>
+            <artifactId>javax.servlet-api</artifactId>
+            <version>3.1.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+            <version>2.5.2</version>
+        </dependency>
+        <dependency>
+            <groupId>commons-io</groupId>
+            <artifactId>commons-io</artifactId>
+            <version>2.11.0</version>
+        </dependency>
+        <dependency>
+            <groupId>commons-codec</groupId>
+            <artifactId>commons-codec</artifactId>
+            <version>1.15</version>
+        </dependency>
+        <dependency>
+            <groupId>commons-lang</groupId>
+            <artifactId>commons-lang</artifactId>
+            <version>2.6</version>
+        </dependency>
+        <dependency>
+            <groupId>commons-validator</groupId>
+            <artifactId>commons-validator</artifactId>
+            <version>1.7</version>
+        </dependency>
+        <!-- axis2 -->
+        <dependency>
+            <groupId>commons-fileupload</groupId>
+            <artifactId>commons-fileupload</artifactId>
+            <version>1.4</version>
+        </dependency>
+        <dependency>
+                <groupId>org.apache.geronimo.specs</groupId>
+                <artifactId>geronimo-ws-metadata_2.0_spec</artifactId>
+                <version>1.1.3</version>
+        </dependency>
+        <dependency>
+                <groupId>org.apache.geronimo.specs</groupId>
+                <artifactId>geronimo-jaxws_2.2_spec</artifactId>
+                <version>1.2</version>
+        </dependency>
+	<dependency>
+		<groupId>org.apache.axis2</groupId>
+		<artifactId>axis2-kernel</artifactId>
+		<version>1.8.0</version>
+	</dependency>
+	<dependency>
+		<groupId>org.apache.axis2</groupId>
+		<artifactId>axis2-transport-http</artifactId>
+		<version>1.8.0</version>
+	</dependency>
+	<dependency>
+		<groupId>org.apache.axis2</groupId>
+		<artifactId>axis2-transport-local</artifactId>
+		<version>1.8.0</version>
+	</dependency>
+	<dependency>
+		<groupId>org.apache.axis2</groupId>
+		<artifactId>axis2-json</artifactId>
+		<version>1.8.0</version>
+	</dependency>
+        <dependency>
+            <groupId>org.apache.axis2</groupId>
+            <artifactId>axis2-ant-plugin</artifactId>
+	    <version>1.8.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.axis2</groupId>
+            <artifactId>axis2-adb</artifactId>
+	    <version>1.8.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.axis2</groupId>
+            <artifactId>axis2-java2wsdl</artifactId>
+	    <version>1.8.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.axis2</groupId>
+            <artifactId>axis2-metadata</artifactId>
+	    <version>1.8.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.axis2</groupId>
+            <artifactId>axis2-spring</artifactId>
+	    <version>1.8.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.axis2</groupId>
+            <artifactId>axis2-jaxws</artifactId>
+	    <version>1.8.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.neethi</groupId>
+            <artifactId>neethi</artifactId>
+	    <version>3.1.1</version>
+        </dependency>
+        <dependency>
+            <groupId>wsdl4j</groupId>
+            <artifactId>wsdl4j</artifactId>
+	    <version>1.6.3</version>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.woodstox</groupId>
+            <artifactId>woodstox-core-asl</artifactId>
+            <version>4.4.1</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.ws.xmlschema</groupId>
+            <artifactId>xmlschema-core</artifactId>
+            <version>2.2.5</version>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.woodstox</groupId>
+            <artifactId>stax2-api</artifactId>
+            <version>4.2.1</version>
+        </dependency>
+        <dependency>
+            <groupId>jaxen</groupId>
+            <artifactId>jaxen</artifactId>
+            <version>1.2.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.woden</groupId>
+            <artifactId>woden-core</artifactId>
+            <version>1.0M10</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.ws.commons.axiom</groupId>
+            <artifactId>axiom-api</artifactId>
+            <version>1.3.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.ws.commons.axiom</groupId>
+            <artifactId>axiom-dom</artifactId>
+            <version>1.3.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.ws.commons.axiom</groupId>
+            <artifactId>axiom-impl</artifactId>
+            <version>1.3.0</version>
+        </dependency>
+        <dependency>
+            <groupId>javax.ws.rs</groupId>
+            <artifactId>jsr311-api</artifactId>
+            <version>1.1.1</version>
+        </dependency>
+        <dependency>
+            <groupId>org.owasp.esapi</groupId>
+            <artifactId>esapi</artifactId>
+            <version>2.2.3.1</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpclient</artifactId>
+            <version>4.5.13</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpcore</artifactId>
+            <version>4.4.13</version>
+        </dependency>
+    </dependencies>
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-dependency-plugin</artifactId>
+                <version>3.2.0</version>
+                <executions>
+                    <execution>
+                        <id>unpack</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>unpack</goal>
+                        </goals>
+                        <configuration>
+                            <artifactItems>
+                                <artifactItem>
+                                    <groupId>userguide.springboot</groupId>
+                                    <artifactId>axis2-json-api</artifactId>
+                                    <version>0.0.1-SNAPSHOT</version>
+                                    <type>war</type>
+                                    <overWrite>false</overWrite>
+                                    <outputDirectory>${project.build.directory}/deploy/axis2-json-api.war</outputDirectory>
+                                    <includes>**/*.class,**/*.xml</includes>
+                                    <excludes>**/*test.class</excludes>
+                                </artifactItem>
+                            </artifactItems>
+                            <includes>**/*.java</includes>
+                            <excludes>**/*.properties</excludes>
+                            <overWriteReleases>true</overWriteReleases>
+                            <overWriteSnapshots>true</overWriteSnapshots>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>install</id>
+                        <phase>install</phase>
+                        <configuration>
+                            <tasks>
+                                <!--  used for local deploys, ignored otherwise -->
+                                <touch file="target/deploy/axis2-json-api.war.dodeploy">
+                                </touch>
+                                <jar jarfile="${project.build.directory}/deploy/axis2-json-api.war/WEB-INF/services/Login.aar">
+                                    <metainf file="resources-axis2/login_resources/services.xml"/>
+                                </jar>
+                                <jar jarfile="${project.build.directory}/deploy/axis2-json-api.war/WEB-INF/services/testws.aar">
+                                    <metainf file="resources-axis2/test_service_resources/services.xml"/>
+                                </jar>
+                                <copy todir="${project.build.directory}/deploy/axis2-json-api.war/WEB-INF/conf">
+                                    <fileset dir="resources-axis2/conf">
+                                        <include name="axis2.xml"/>
+                                    </fileset>
+                                </copy>
+                                <unzip src="${project.build.directory}/axis2-json-api-0.0.1-SNAPSHOT.war" dest="${project.build.directory}/exploded"/>
+                                <jar jarfile="${project.build.directory}/exploded/WEB-INF/services/Login.aar">
+                                    <metainf file="resources-axis2/login_resources/services.xml"/>
+                                </jar>
+                                <jar jarfile="${project.build.directory}/exploded/WEB-INF/services/testws.aar">
+                                    <metainf file="resources-axis2/test_service_resources/services.xml"/>
+                                </jar>
+                                <copy todir="${project.build.directory}/exploded/WEB-INF/conf">
+                                    <fileset dir="resources-axis2/conf">
+                                        <include name="axis2.xml"/>
+                                    </fileset>
+                                </copy>
+                            </tasks>
+                        </configuration>
+                        <goals>
+                            <goal>run</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-war-plugin</artifactId>
+                <version>3.3.1</version>
+                <configuration>
+                    <webResources>
+                        <resource>
+                            <directory>src/main/resources</directory>
+                            <includes>
+                                <include>**/*.xml</include>
+                                <include>**/application.properties</include>
+                            </includes>
+                            <targetPath>WEB-INF/classes</targetPath>
+                            <filtering>true</filtering>
+                        </resource>
+                    </webResources>
+                    <webappDirectory>${project.build.directory}/deploy/axis2-json-api.war</webappDirectory>
+                </configuration>
+                <executions>
+                    <execution>
+                        <id>enforce-java</id>
+                        <goals>
+                            <goal>exploded</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+
+    </build>
+
+</project>
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/resources-axis2/conf/axis2.xml b/modules/samples/userguide/src/userguide/springbootdemo/resources-axis2/conf/axis2.xml
new file mode 100644
index 0000000..dd06722
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/resources-axis2/conf/axis2.xml
@@ -0,0 +1,539 @@
+<!--
+  ~ Licensed to the Apache Software Foundation (ASF) under one
+  ~ or more contributor license agreements. See the NOTICE file
+  ~ distributed with this work for additional information
+  ~ regarding copyright ownership. The ASF licenses this file
+  ~ to you under the Apache License, Version 2.0 (the
+  ~ "License"); you may not use this file except in compliance
+  ~ with the License. You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing,
+  ~ software distributed under the License is distributed on an
+  ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  ~ KIND, either express or implied. See the License for the
+  ~ specific language governing permissions and limitations
+  ~ under the License.
+  -->
+
+<axisconfig name="AxisJava2.0">
+    <!-- ================================================= -->
+    <!-- Parameters -->
+    <!-- ================================================= -->
+    <parameter name="hotdeployment">true</parameter>
+    <parameter name="hotupdate">false</parameter>
+    <parameter name="enableMTOM">false</parameter>
+    <parameter name="enableSwA">false</parameter>
+
+    <!--Uncomment if you want to enable file caching for attachments -->
+    <!--parameter name="cacheAttachments">true</parameter>
+    <parameter name="attachmentDIR"></parameter>
+    <parameter name="sizeThreshold">4000</parameter-->
+
+    <parameter name="EnableChildFirstClassLoading">false</parameter>
+
+    <!--
+    The exposeServiceMetadata parameter decides whether the metadata (WSDL, schema, policy) of
+    the services deployed on Axis2 should be visible when ?wsdl, ?wsdl2, ?xsd, ?policy requests
+    are received.
+    This parameter can be defined in the axi2.xml file, in which case this will be applicable
+    globally, or in the services.xml files, in which case, it will be applicable to the
+    Service groups and/or services, depending on the level at which the parameter is declared.
+    This value of this parameter defaults to true.
+    -->
+    <parameter name="exposeServiceMetadata">true</parameter>
+
+
+    <!--Uncomment if you want to plugin your own attachments lifecycle implementation -->
+    <!--<attachmentsLifecycleManager class="org.apache.axiom.attachments.lifecycle.impl.LifecycleManagerImpl"/>-->
+
+
+    <!--Uncomment if you want to enable the reduction of the in-memory cache of WSDL definitions -->
+    <!--In some server environments, the available memory heap is limited and can fill up under load -->
+    <!--Since in-memory copies of WSDL definitions can be large, some steps can be taken-->
+    <!--to reduce the memory needed for the cached WSDL definitions. -->
+    <!--parameter name="reduceWSDLMemoryCache">true</parameter-->
+
+    <!--This will give out the timout of the configuration contexts, in milliseconds-->
+    <parameter name="ConfigContextTimeoutInterval">30000</parameter>
+
+    <!--During a fault, stack trace can be sent with the fault message. The following flag will control -->
+    <!--that behavior.-->
+    <parameter name="sendStacktraceDetailsWithFaults">false</parameter>
+
+    <!--If there aren't any information available to find out the fault reason, we set the message of the exception-->
+    <!--as the faultreason/Reason. But when a fault is thrown from a service or some where, it will be -->
+    <!--wrapped by different levels. Due to this the initial exception message can be lost. If this flag-->
+    <!--is set, then Axis2 tries to get the first exception and set its message as the faultreason/Reason.-->
+    <parameter name="DrillDownToRootCauseForFaultReason">false</parameter>
+
+    <parameter name="userName">admin</parameter>
+    <parameter name="password">axis2</parameter>
+
+    <!--To override repository/services you need to uncomment following parameter and value SHOULD be absolute file path.-->
+    <!--ServicesDirectory only works on the following cases-->
+    <!---File based configurator and in that case the value should be a file URL (http:// not allowed)-->
+    <!---When creating URL Based configurator with URL file:// -->
+    <!--- War based configurator with expanded case , -->
+
+    <!--All the other scenarios it will be ignored.-->
+    <!--<parameter name="ServicesDirectory">service</parameter>-->
+    <!--To override repository/modules you need to uncomment following parameter and value SHOULD be absolute file path-->
+    <!--<parameter name="ModulesDirectory">modules</parameter>-->
+
+
+    <!--Following params will set the proper context paths for invocations. All the endpoints will have a commons context-->
+    <!--root which can configured using the following contextRoot parameter-->
+    <!--<parameter name="contextRoot">axis2</parameter>-->
+
+    <!--Our HTTP endpoints can handle both REST and SOAP. Following parameters can be used to distinguiush those endpoints-->
+    <!--In case of a servlet, if you change this you have to manually change the settings of your servlet container to map this -->
+    <!--context path to proper Axis2 servlets-->
+    <!--<parameter name="servicePath">services</parameter>-->
+    <!--<parameter name="restPath">rest</parameter>-->
+
+    <!-- Following parameter will completely disable REST handling in Axis2-->
+    <parameter name="disableREST" locked="false">false</parameter>
+
+    <!-- Following parameter will suppress generation of SOAP 1.2 bindings in auto-generated WSDL files -->
+    <parameter name="disableSOAP12" locked="true">false</parameter>
+
+    <!-- ================================================= -->
+    <!-- Deployers -->
+    <!-- ================================================= -->
+
+    <!--Service deployer , this will alow users to deploy AAR or exploded AAR as axis2 services-->
+    <deployer extension=".aar" directory="services" class="org.apache.axis2.deployment.ServiceDeployer">
+        <serviceBuilderExtension name ="jwsbuilderExt" class="org.apache.axis2.jaxws.framework.JAXWSServiceBuilderExtension"/>
+        <serviceBuilderExtension name ="wsdlbuilderExt" class="org.apache.axis2.deployment.WSDLServiceBuilderExtension"/>
+    </deployer>
+    
+    <!--POJO deployer , this will alow users to drop .class file and make that into a service-->
+    <deployer extension=".class" directory="pojo" class="org.apache.axis2.deployment.POJODeployer"/>
+    <deployer extension=".jar" directory="servicejars"
+              class="org.apache.axis2.jaxws.framework.JAXWSDeployer"/>
+    <deployer extension=".jar" directory="transports"
+              class="org.apache.axis2.deployment.TransportDeployer"/>
+
+    <!--CORBA deployer , this will alow users to invoke remote CORBA services through Axis2-->
+    <!--<deployer extension=".xml" directory="corba" class="org.apache.axis2.corba.deployer.CorbaDeployer"/>-->
+
+    <!--<deployer extension=".jsa" directory="rmiservices" class="org.apache.axis2.rmi.deploy.RMIServiceDeployer"/>-->
+
+
+    <!-- Following parameter will set the host name for the epr-->
+    <!--<parameter name="hostname" locked="true">myhost.com</parameter>-->
+
+    <!-- If you have a front end host which exposes this webservice using a different public URL  -->
+    <!-- use this parameter to override autodetected url -->
+    <!--<parameter name="httpFrontendHostUrl">https://someotherhost/context</parameter>-->
+
+    <!--By default, JAXWS services are created by reading annotations. WSDL and schema are generated-->
+    <!--using a separate WSDL generator only when ?wsdl is called. Therefore, even if you engage-->
+    <!--policies etc.. to AxisService, it doesn't appear in the WSDL. By setting the following property-->
+    <!--to true, you can create the AxisService using the generated WSDL and remove the need for a-->
+    <!--WSDL generator. When ?wsdl is called, WSDL is generated in the normal way.-->
+    <parameter name="useGeneratedWSDLinJAXWS">false</parameter>
+
+    <!--    The way of adding listener to the system-->
+    <!--    <listener class="org.apache.axis2.ObserverIMPL">-->
+    <!--        <parameter name="RSS_URL">http://127.0.0.1/rss</parameter>-->
+    <!--    </listener>-->
+
+    <threadContextMigrators>
+        <threadContextMigrator listId="JAXWS-ThreadContextMigrator-List"
+                               class="org.apache.axis2.jaxws.addressing.migrator.EndpointContextMapMigrator"/>
+    </threadContextMigrators>
+
+    <!-- ================================================= -->
+    <!-- Message Receivers -->
+    <!-- ================================================= -->
+    <!--This is the default MessageReceiver for the system , if you want to have MessageReceivers for -->
+    <!--all the other MEP implement it and add the correct entry to here , so that you can refer from-->
+    <!--any operation -->
+    <!--Note : You can override this for a particular service by adding the same element with your requirement-->
+    <messageReceivers>        
+        <messageReceiver mep="http://www.w3.org/ns/wsdl/in-out"
+               class="org.apache.axis2.json.moshi.rpc.JsonRpcMessageReceiver"  />
+        <messageReceiver mep="http://www.w3.org/ns/wsdl/in-only"
+               class="org.apache.axis2.json.moshi.rpc.JsonInOnlyRPCMessageReceiver"/>
+    </messageReceivers>
+
+    <!-- ================================================= -->
+    <!-- Message Formatter -->
+    <!-- ================================================= -->
+    <!--Following content type to message formatter mapping can be used to implement support for different message -->
+    <!--format  serialization in Axis2. These message formats are expected to be resolved based on the content type. -->
+    <messageFormatters>
+        <messageFormatter contentType="application/x-www-form-urlencoded"
+                          class="org.apache.axis2.transport.http.XFormURLEncodedFormatter"/>
+        <messageFormatter contentType="multipart/form-data"
+                          class="org.apache.axis2.transport.http.MultipartFormDataFormatter"/>
+        <messageFormatter contentType="application/xml"
+                          class="org.apache.axis2.transport.http.ApplicationXMLFormatter"/>
+        <messageFormatter contentType="text/xml"
+                          class="org.apache.axis2.transport.http.SOAPMessageFormatter"/>
+        <messageFormatter contentType="application/soap+xml"
+                          class="org.apache.axis2.transport.http.SOAPMessageFormatter"/>
+        <messageFormatter contentType="application/json"
+                          class="org.apache.axis2.json.moshi.JsonFormatter"/>
+    </messageFormatters>
+
+    <!-- ================================================= -->
+    <!-- Message Builders -->
+    <!-- ================================================= -->
+    <!--Following content type to builder mapping can be used to implement support for different message -->
+    <!--formats in Axis2. These message formats are expected to be resolved based on the content type. -->
+    <messageBuilders>
+        <messageBuilder contentType="application/xml"
+                        class="org.apache.axis2.builder.ApplicationXMLBuilder"/>
+        <messageBuilder contentType="application/x-www-form-urlencoded"
+                        class="org.apache.axis2.builder.XFormURLEncodedBuilder"/>
+        <messageBuilder contentType="multipart/form-data"
+                        class="org.apache.axis2.builder.MultipartFormDataBuilder"/>
+        <messageBuilder contentType="application/json"
+                        class="org.apache.axis2.json.moshi.JsonBuilder"/>
+    </messageBuilders>
+
+    <!-- ================================================= -->
+    <!-- Transport Ins -->
+    <!-- ================================================= -->
+    <transportReceiver name="http"
+                       class="org.apache.axis2.transport.http.SimpleHTTPServer">
+        <parameter name="port">8080</parameter>
+        <!-- Here is the complete list of supported parameters (see example settings further below):
+            port: the port to listen on (default 6060)
+            hostname:  if non-null, url prefix used in reply-to endpoint references                                 (default null)
+            originServer:  value of http Server header in outgoing messages                                         (default "Simple-Server/1.1")
+            requestTimeout:  value in millis of time that requests can wait for data                                (default 20000)
+            requestTcpNoDelay:  true to maximize performance and minimize latency                                   (default true)
+                                false to minimize bandwidth consumption by combining segments
+            requestCoreThreadPoolSize:  number of threads available for request processing (unless queue fills up)  (default 25)
+            requestMaxThreadPoolSize:  number of threads available for request processing if queue fills up         (default 150)
+                                       note that default queue never fills up:  see HttpFactory
+            threadKeepAliveTime:  time to keep threads in excess of core size alive while inactive                  (default 180)
+                                  note that no such threads can exist with default unbounded request queue
+            threadKeepAliveTimeUnit:  TimeUnit of value in threadKeepAliveTime (default SECONDS)                    (default SECONDS)
+        -->
+        <!-- <parameter name="hostname">http://www.myApp.com/ws</parameter> -->
+        <!-- <parameter name="originServer">My-Server/1.1</parameter>           -->
+        <!-- <parameter name="requestTimeout">10000</parameter>                   -->
+        <!-- <parameter name="requestTcpNoDelay">false</parameter>                   -->
+        <!-- <parameter name="requestCoreThreadPoolSize">50</parameter>                      -->
+        <!-- <parameter name="requestMaxThreadPoolSize">100</parameter>                     -->
+        <!-- <parameter name="threadKeepAliveTime">240000</parameter>                  -->
+        <!-- <parameter name="threadKeepAliveTimeUnit">MILLISECONDS</parameter>            -->
+    </transportReceiver>
+
+    <!-- This is where you'd put custom transports.  See the transports project -->
+    <!-- for more.  http://ws.apache.org/commons/transport                      -->
+
+    <!-- ================================================= -->
+    <!-- Transport Outs -->
+    <!-- ================================================= -->
+
+    <transportSender name="local"
+                     class="org.apache.axis2.transport.local.LocalTransportSender"/>
+    <transportSender name="http"
+                     class="org.apache.axis2.transport.http.impl.httpclient4.HTTPClient4TransportSender">
+        <parameter name="PROTOCOL">HTTP/1.1</parameter>
+        <parameter name="Transfer-Encoding">chunked</parameter>
+
+        <!-- If following is set to 'true', optional action part of the Content-Type will not be added to the SOAP 1.2 messages -->
+        <!--  <parameter name="OmitSOAP12Action">true</parameter>  -->
+    </transportSender>
+
+    <transportSender name="https"
+                     class="org.apache.axis2.transport.http.impl.httpclient4.HTTPClient4TransportSender">
+        <parameter name="PROTOCOL">HTTP/1.1</parameter>
+        <parameter name="Transfer-Encoding">chunked</parameter>
+    </transportSender>
+
+    <!-- Please enable this if you need the java transport -->
+    <!-- <transportSender name="java"
+                     class="org.apache.axis2.transport.java.JavaTransportSender"/> -->
+
+    <!-- ================================================= -->
+    <!-- Global Modules  -->
+    <!-- ================================================= -->
+    <!-- Comment this to disable Addressing -->
+    <!-- commented out for the Axis2 spring boot demo that uses JSON -->
+    <!-- <module ref="addressing"/> -->
+
+    <!--Configuring module , providing parameters for modules whether they refer or not-->
+    <!--<moduleConfig name="addressing">-->
+    <!--<parameter name="addressingPara">N/A</parameter>-->
+    <!--</moduleConfig>-->
+
+    <!-- ================================================= -->
+    <!-- Clustering  -->
+    <!-- ================================================= -->
+    <!--
+     To enable clustering for this node, set the value of "enable" attribute of the "clustering"
+     element to "true". The initialization of a node in the cluster is handled by the class
+     corresponding to the "class" attribute of the "clustering" element. It is also responsible for
+     getting this node to join the cluster.
+     -->
+    <clustering class="org.apache.axis2.clustering.tribes.TribesClusteringAgent" enable="false">
+
+        <!--
+           This parameter indicates whether the cluster has to be automatically initalized
+           when the AxisConfiguration is built. If set to "true" the initialization will not be
+           done at that stage, and some other party will have to explictly initialize the cluster.
+        -->
+        <parameter name="AvoidInitiation">true</parameter>
+
+        <!--
+           The membership scheme used in this setup. The only values supported at the moment are
+           "multicast" and "wka"
+
+           1. multicast - membership is automatically discovered using multicasting
+           2. wka - Well-Known Address based multicasting. Membership is discovered with the help
+                    of one or more nodes running at a Well-Known Address. New members joining a
+                    cluster will first connect to a well-known node, register with the well-known node
+                    and get the membership list from it. When new members join, one of the well-known
+                    nodes will notify the others in the group. When a member leaves the cluster or
+                    is deemed to have left the cluster, it will be detected by the Group Membership
+                    Service (GMS) using a TCP ping mechanism.
+        -->
+        <parameter name="membershipScheme">multicast</parameter>
+
+        <!--
+         The clustering domain/group. Nodes in the same group will belong to the same multicast
+         domain. There will not be interference between nodes in different groups.
+        -->
+        <parameter name="domain">wso2.carbon.domain</parameter>
+
+        <!--
+           When a Web service request is received, and processed, before the response is sent to the
+           client, should we update the states of all members in the cluster? If the value of
+           this parameter is set to "true", the response to the client will be sent only after
+           all the members have been updated. Obviously, this can be time consuming. In some cases,
+           such this overhead may not be acceptable, in which case the value of this parameter
+           should be set to "false"
+        -->
+        <parameter name="synchronizeAll">true</parameter>
+
+        <!--
+          The maximum number of times we need to retry to send a message to a particular node
+          before giving up and considering that node to be faulty
+        -->
+        <parameter name="maxRetries">10</parameter>
+
+        <!-- The multicast address to be used -->
+        <parameter name="mcastAddress">228.0.0.4</parameter>
+
+        <!-- The multicast port to be used -->
+        <parameter name="mcastPort">45564</parameter>
+
+        <!-- The frequency of sending membership multicast messages (in ms) -->
+        <parameter name="mcastFrequency">500</parameter>
+
+        <!-- The time interval within which if a member does not respond, the member will be
+         deemed to have left the group (in ms)
+         -->
+        <parameter name="memberDropTime">3000</parameter>
+
+        <!--
+           The IP address of the network interface to which the multicasting has to be bound to.
+           Multicasting would be done using this interface.
+        -->
+        <parameter name="mcastBindAddress">127.0.0.1</parameter>
+
+        <!-- The host name or IP address of this member -->
+        <parameter name="localMemberHost">127.0.0.1</parameter>
+
+        <!--
+        The TCP port used by this member. This is the port through which other nodes will
+        contact this member
+         -->
+        <parameter name="localMemberPort">4000</parameter>
+
+        <!--
+        Preserve message ordering. This will be done according to sender order.
+        -->
+        <parameter name="preserveMessageOrder">true</parameter>
+
+        <!--
+        Maintain atmost-once message processing semantics
+        -->
+        <parameter name="atmostOnceMessageSemantics">true</parameter>
+
+        <!--
+        Properties specific to this member
+        -->
+        <parameter name="properties">
+            <property name="backendServerURL" value="https://${hostName}:${httpsPort}/services/"/>
+            <property name="mgtConsoleURL" value="https://${hostName}:${httpsPort}/"/>
+        </parameter>
+
+        <!--
+           The list of static or well-known members. These entries will only be valid if the
+           "membershipScheme" above is set to "wka"
+        -->
+        <members>
+            <member>
+                <hostName>127.0.0.1</hostName>
+                <port>4000</port>
+            </member>
+            <member>
+                <hostName>127.0.0.1</hostName>
+                <port>4001</port>
+            </member>
+        </members>
+
+        <!--
+        Enable the groupManagement entry if you need to run this node as a cluster manager.
+        Multiple application domains with different GroupManagementAgent implementations
+        can be defined in this section.
+        -->
+        <groupManagement enable="false">
+            <applicationDomain name="apache.axis2.application.domain"
+                               description="Axis2 group"
+                               agent="org.apache.axis2.clustering.management.DefaultGroupManagementAgent"/>
+        </groupManagement>
+
+        <!--
+           This interface is responsible for handling management of a specific node in the cluster
+           The "enable" attribute indicates whether Node management has been enabled
+        -->
+        <nodeManager class="org.apache.axis2.clustering.management.DefaultNodeManager"
+                         enable="true"/>
+
+        <!--
+           This interface is responsible for handling state replication. The property changes in
+           the Axis2 context hierarchy in this node, are propagated to all other nodes in the cluster.
+
+           The "excludes" patterns can be used to specify the prefixes (e.g. local_*) or
+           suffixes (e.g. *_local) of the properties to be excluded from replication. The pattern
+           "*" indicates that all properties in a particular context should not be replicated.
+
+            The "enable" attribute indicates whether context replication has been enabled
+        -->
+        <stateManager class="org.apache.axis2.clustering.state.DefaultStateManager"
+                      enable="true">
+            <replication>
+                <defaults>
+                    <exclude name="local_*"/>
+                    <exclude name="LOCAL_*"/>
+                </defaults>
+                <context class="org.apache.axis2.context.ConfigurationContext">
+                    <exclude name="local_*"/>
+                </context>
+                <context class="org.apache.axis2.context.ServiceGroupContext">
+                    <exclude name="local_*"/>
+                </context>
+                <context class="org.apache.axis2.context.ServiceContext">
+                    <exclude name="local_*"/>
+                </context>
+            </replication>
+        </stateManager>
+    </clustering>
+
+    <!-- ================================================= -->
+    <!-- Phases  -->
+    <!-- ================================================= -->
+    <phaseOrder type="InFlow">
+        <!--  System predefined phases       -->
+        <phase name="Transport">
+            <handler name="RequestURIBasedDispatcher"
+                     class="org.apache.axis2.dispatchers.RequestURIBasedDispatcher">
+                <order phase="Transport"/>
+            </handler>
+            <handler name="SOAPActionBasedDispatcher"
+                     class="org.apache.axis2.dispatchers.SOAPActionBasedDispatcher">
+                <order phase="Transport"/>
+            </handler>
+            <handler name="JSONMessageHandler"
+                     class="org.apache.axis2.json.moshi.JSONMessageHandler">
+                <order phase="Transport"/>
+            </handler>
+        </phase>
+        <phase name="Addressing">
+            <handler name="AddressingBasedDispatcher"
+                     class="org.apache.axis2.dispatchers.AddressingBasedDispatcher">
+                <order phase="Addressing"/>
+            </handler>
+        </phase>
+        <phase name="Security"/>
+        <phase name="PreDispatch"/>
+        <phase name="Dispatch" class="org.apache.axis2.engine.DispatchPhase">
+            <handler name="RequestURIBasedDispatcher"
+                     class="org.apache.axis2.dispatchers.RequestURIBasedDispatcher"/>
+            <handler name="SOAPActionBasedDispatcher"
+                     class="org.apache.axis2.dispatchers.SOAPActionBasedDispatcher"/>
+            <handler name="RequestURIOperationDispatcher"
+                     class="org.apache.axis2.dispatchers.RequestURIOperationDispatcher"/>
+            <handler name="SOAPMessageBodyBasedDispatcher"
+                     class="org.apache.axis2.dispatchers.SOAPMessageBodyBasedDispatcher"/>
+            <handler name="HTTPLocationBasedDispatcher"
+                     class="org.apache.axis2.dispatchers.HTTPLocationBasedDispatcher"/>
+            <handler name="GenericProviderDispatcher"
+                     class="org.apache.axis2.jaxws.dispatchers.GenericProviderDispatcher"/>
+            <handler name="MustUnderstandValidationDispatcher"
+                     class="org.apache.axis2.jaxws.dispatchers.MustUnderstandValidationDispatcher"/>
+        </phase>
+        <phase name="RMPhase"/>
+        <!--  System predefined phases       -->
+        <!--   After Postdispatch phase module author or service author can add any phase he want      -->
+        <phase name="OperationInPhase">
+            <handler name="MustUnderstandChecker"
+                     class="org.apache.axis2.jaxws.dispatchers.MustUnderstandChecker">
+                <order phase="OperationInPhase"/>
+            </handler>
+        </phase>
+        <phase name="soapmonitorPhase"/>
+    </phaseOrder>
+    <phaseOrder type="OutFlow">
+        <!--      user can add his own phases to this area  -->
+        <phase name="soapmonitorPhase"/>
+        <phase name="OperationOutPhase"/>
+        <!--system predefined phase-->
+        <!--these phase will run irrespective of the service-->
+        <phase name="RMPhase"/>
+        <phase name="PolicyDetermination"/>
+        <phase name="MessageOut"/>
+        <phase name="Security"/>
+    </phaseOrder>
+    <phaseOrder type="InFaultFlow">
+        <phase name="Addressing">
+            <handler name="AddressingBasedDispatcher"
+                     class="org.apache.axis2.dispatchers.AddressingBasedDispatcher">
+                <order phase="Addressing"/>
+            </handler>
+        </phase>
+        <phase name="Security"/>
+        <phase name="PreDispatch"/>
+        <phase name="Dispatch" class="org.apache.axis2.engine.DispatchPhase">
+            <handler name="RequestURIBasedDispatcher"
+                     class="org.apache.axis2.dispatchers.RequestURIBasedDispatcher"/>
+            <handler name="SOAPActionBasedDispatcher"
+                     class="org.apache.axis2.dispatchers.SOAPActionBasedDispatcher"/>
+            <handler name="RequestURIOperationDispatcher"
+                     class="org.apache.axis2.dispatchers.RequestURIOperationDispatcher"/>
+            <handler name="SOAPMessageBodyBasedDispatcher"
+                     class="org.apache.axis2.dispatchers.SOAPMessageBodyBasedDispatcher"/>
+            <handler name="HTTPLocationBasedDispatcher"
+                     class="org.apache.axis2.dispatchers.HTTPLocationBasedDispatcher"/>
+            <handler name="GenericProviderDispatcher"
+                     class="org.apache.axis2.jaxws.dispatchers.GenericProviderDispatcher"/>
+            <handler name="MustUnderstandValidationDispatcher"
+                     class="org.apache.axis2.jaxws.dispatchers.MustUnderstandValidationDispatcher"/>
+        </phase>
+        <phase name="RMPhase"/>
+        <!--      user can add his own phases to this area  -->
+        <phase name="OperationInFaultPhase"/>
+        <phase name="soapmonitorPhase"/>
+    </phaseOrder>
+    <phaseOrder type="OutFaultFlow">
+        <!--      user can add his own phases to this area  -->
+        <phase name="soapmonitorPhase"/>
+        <phase name="OperationOutFaultPhase"/>
+        <phase name="RMPhase"/>
+        <phase name="PolicyDetermination"/>
+        <phase name="MessageOut"/>
+        <phase name="Security"/>
+    </phaseOrder>
+</axisconfig>
+
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/resources-axis2/login_resources/services.xml b/modules/samples/userguide/src/userguide/springbootdemo/resources-axis2/login_resources/services.xml
new file mode 100755
index 0000000..64812c7
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/resources-axis2/login_resources/services.xml
@@ -0,0 +1,33 @@
+<!--
+  ~ Licensed to the Apache Software Foundation (ASF) under one
+  ~ or more contributor license agreements. See the NOTICE file
+  ~ distributed with this work for additional information
+  ~ regarding copyright ownership. The ASF licenses this file
+  ~ to you under the Apache License, Version 2.0 (the
+  ~ "License"); you may not use this file except in compliance
+  ~ with the License. You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing,
+  ~ software distributed under the License is distributed on an
+  ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  ~ KIND, either express or implied. See the License for the
+  ~ specific language governing permissions and limitations
+  ~ under the License.
+  -->
+<service name="loginService">
+    <description>
+        Login Resources
+    </description>
+    <parameter name="ServiceObjectSupplier">org.apache.axis2.extensions.spring.receivers.SpringServletContextObjectSupplier</parameter>
+    <parameter name="SpringBeanName">loginService</parameter>
+    <operation name="doLogin">
+        <messageReceivers>
+            <messageReceiver mep="http://www.w3.org/ns/wsdl/in-out"
+                class="org.apache.axis2.json.moshi.rpc.JsonRpcMessageReceiver"  />
+            <messageReceiver mep="http://www.w3.org/ns/wsdl/in-only"
+                class="org.apache.axis2.json.moshi.rpc.JsonInOnlyRPCMessageReceiver"/>
+    </messageReceivers>
+    </operation>
+</service>
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/resources-axis2/test_service_resources/services.xml b/modules/samples/userguide/src/userguide/springbootdemo/resources-axis2/test_service_resources/services.xml
new file mode 100755
index 0000000..6a202ff
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/resources-axis2/test_service_resources/services.xml
@@ -0,0 +1,33 @@
+<!--
+  ~ Licensed to the Apache Software Foundation (ASF) under one
+  ~ or more contributor license agreements. See the NOTICE file
+  ~ distributed with this work for additional information
+  ~ regarding copyright ownership. The ASF licenses this file
+  ~ to you under the Apache License, Version 2.0 (the
+  ~ "License"); you may not use this file except in compliance
+  ~ with the License. You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing,
+  ~ software distributed under the License is distributed on an
+  ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  ~ KIND, either express or implied. See the License for the
+  ~ specific language governing permissions and limitations
+  ~ under the License.
+  -->
+<service name="testws">
+    <description>
+        testws Resources
+    </description>
+    <parameter name="ServiceObjectSupplier">org.apache.axis2.extensions.spring.receivers.SpringServletContextObjectSupplier</parameter>
+    <parameter name="SpringBeanName">testwsService</parameter>
+    <operation name="doTestws">
+        <messageReceivers>
+            <messageReceiver mep="http://www.w3.org/ns/wsdl/in-out"
+                class="org.apache.axis2.json.moshi.rpc.JsonRpcMessageReceiver"  />
+            <messageReceiver mep="http://www.w3.org/ns/wsdl/in-only"
+                class="org.apache.axis2.json.moshi.rpc.JsonInOnlyRPCMessageReceiver"/>
+    </messageReceivers>
+    </operation>
+</service>
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/Axis2Application.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/Axis2Application.java
new file mode 100644
index 0000000..7aefd00
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/Axis2Application.java
@@ -0,0 +1,468 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.Filter;
+
+import java.io.PrintWriter;
+import java.io.IOException;
+import java.util.*;
+
+import org.springframework.context.annotation.Bean;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.builder.SpringApplicationBuilder;
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.web.servlet.support.SpringBootServletInitializer;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.security.access.AccessDecisionManager;
+import org.springframework.security.access.AccessDecisionVoter;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.access.ConfigAttribute;
+import org.springframework.security.access.vote.AffirmativeBased;
+import org.springframework.security.access.vote.RoleVoter;
+import org.springframework.security.access.SecurityConfig;
+import org.springframework.security.authentication.InsufficientAuthenticationException;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.access.AccessDeniedHandler;
+
+import org.springframework.security.web.access.ExceptionTranslationFilter;
+import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
+import org.springframework.security.web.context.HttpRequestResponseHolder;
+import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
+import org.springframework.security.web.firewall.HttpFirewall;
+import org.springframework.security.web.firewall.StrictHttpFirewall;
+import org.springframework.security.web.header.HeaderWriter;
+import org.springframework.security.web.header.HeaderWriterFilter;
+import org.springframework.security.web.session.SessionManagementFilter;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.security.web.FilterChainProxy;
+import org.springframework.security.web.FilterInvocation;
+import org.springframework.security.web.DefaultSecurityFilterChain;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.HttpStatusEntryPoint;
+import org.springframework.security.web.util.matcher.NegatedRequestMatcher;
+import org.springframework.security.web.util.matcher.RequestMatcher;
+import org.springframework.security.authentication.ProviderManager;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.PropertySource;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
+import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.web.filter.DelegatingFilterProxy;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.builders.WebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.crypto.password.NoOpPasswordEncoder;
+
+import static org.springframework.http.HttpStatus.FORBIDDEN;
+
+import userguide.springboot.security.webservices.WSLoginFilter;
+import userguide.springboot.security.webservices.JWTAuthenticationFilter;
+import userguide.springboot.security.webservices.JWTAuthenticationProvider;
+import userguide.springboot.security.webservices.HTTPPostOnlyRejectionFilter;
+import userguide.springboot.security.webservices.RequestAndResponseValidatorFilter;
+import userguide.springboot.security.webservices.RestAuthenticationEntryPoint;
+
+@SpringBootApplication
+@EnableAutoConfiguration
+@Configuration
+public class Axis2Application extends SpringBootServletInitializer {
+
+    private static final Logger logger = LogManager.getLogger(Axis2Application.class);
+    public static volatile boolean isRunning = false;
+
+    @Configuration
+    @EnableWebSecurity
+    @Order(1)
+    @PropertySource("classpath:application.properties")
+    public static class SecurityConfigurationTokenWebServices extends WebSecurityConfigurerAdapter {
+        private static final Logger logger = LogManager.getLogger(SecurityConfigurationTokenWebServices.class);
+
+        public SecurityConfigurationTokenWebServices() {
+            super(true);
+            String logPrefix = "SecurityConfigurationTokenWebServices , ";
+            logger.debug(logPrefix + "inside constructor, defaults disabled via super(true) ...");
+        }
+
+        class AnonRequestMatcher implements RequestMatcher {
+            
+            @Override
+            public boolean matches(HttpServletRequest request) {
+                String logPrefix = "AnonRequestMatcher.matches , ";
+                boolean result = request.getRequestURI().contains(
+                        "/services/loginService");
+                logger.debug(logPrefix
+                        + "inside AnonRequestMatcher.matches, will return result: "
+                        + result + " , on request.getRequestURI() : "
+                        + request.getRequestURI() + " , request.getMethod() : "
+                        + request.getMethod());
+                return result;
+            }
+            
+        }
+
+        class AuthorizationFailHandler implements AccessDeniedHandler {
+
+            @Override
+            public void handle(final HttpServletRequest request, final HttpServletResponse response, final AccessDeniedException accessDeniedException)
+                    throws IOException, ServletException {
+                String logPrefix = "AuthorizationFailHandler.handle() , ";
+                response.setContentType("application/json");
+                try (PrintWriter writer = response.getWriter()) {
+                    logger.error(logPrefix + "found error: " + accessDeniedException.getMessage());
+                    writer.write("{\"msg\":\" Access Denied\"}");
+                }
+            }
+        }
+
+	// this is about where Spring SEC HTTPInterceptor would go however it was too flaky and inflexible for this use case
+        class SecureResouceMetadataSource implements FilterInvocationSecurityMetadataSource {
+
+            @Override
+            public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
+                String logPrefix = "SecureResouceMetadataSource.getAttributes , ";
+
+                final HttpServletRequest request = ((FilterInvocation) object).getRequest();
+                final String url = request.getRequestURI();
+                final String method = request.getMethod();
+                    
+                String[] roles = new String[] { String.format("%s|%s", url, method) };
+                logger.debug(logPrefix + "found roles: " + Arrays.toString(roles));
+                return SecurityConfig.createList(roles);
+            }
+
+            @Override
+            public Collection<ConfigAttribute> getAllConfigAttributes() {
+                String logPrefix = "SecureResouceMetadataSource.getAllConfigAttributes , ";
+                logger.debug(logPrefix + "returning ROLE_USER ...");
+                List<ConfigAttribute> attrs = SecurityConfig.createList("ROLE_USER");
+                return attrs;
+            }
+
+            /**
+             * true if the implementation can process the indicated class
+             */
+            @Override
+            public boolean supports(final Class<?> clazz) {
+                return true;
+            }
+
+        }
+        
+        class StatelessSecurityContextRepository extends HttpSessionSecurityContextRepository {
+
+            @Override
+            public SecurityContext loadContext(HttpRequestResponseHolder requestResponseHolder) {
+                String logPrefix = "StatelessSecurityContextRepository.loadContext , ";
+                logger.debug(logPrefix + "inside loadContext() ... invoking createEmptyContext()");
+                return SecurityContextHolder.createEmptyContext();
+            }
+
+            @Override
+            public void saveContext(SecurityContext context,
+                HttpServletRequest request, HttpServletResponse response) {
+                String logPrefix = "StatelessSecurityContextRepository.saveContext , ";
+                logger.debug(logPrefix + "inside saveContext() ... no action taken");
+            }
+
+            @Override
+            public boolean containsContext(final HttpServletRequest request) {
+                String logPrefix = "StatelessSecurityContextRepository.containsContext , ";
+                logger.debug(logPrefix + "inside containsContext() ... returning false");
+                return false;
+            }
+
+        }
+
+        class GenericAccessDecisionManager implements AccessDecisionManager {
+
+            @Override
+            public void decide(final Authentication authentication, final Object object, final Collection<ConfigAttribute> configAttributes)
+                    throws AccessDeniedException, InsufficientAuthenticationException {
+        
+                /* TODO role based auth can go here 
+                boolean allowAccess = false;
+        
+                for (final GrantedAuthority grantedAuthority : authentication.getAuthorities()) {
+        
+                    for (final ConfigAttribute attribute : configAttributes) {
+                        allowAccess = attribute.getAttribute().equals(grantedAuthority.getAuthority());
+                        if (allowAccess) {
+                            break;// this loop
+                        }
+                    }
+        
+                }
+        
+                if (!allowAccess) {
+                    logger.warn("Throwing access denied exception");
+                    throw new AccessDeniedException("Access is denied");
+                }
+                */
+            }
+
+            @Override
+            public boolean supports(final ConfigAttribute attribute) {
+                return true;
+            }
+        
+            @Override
+            public boolean supports(final Class<?> clazz) {
+                return true;
+            }
+        }
+
+        @Autowired
+        private JWTAuthenticationProvider jwtAuthenticationProvider;
+
+        @Autowired
+        private RestAuthenticationEntryPoint restAuthenticationEntryPoint;
+
+        @Autowired
+        public void configureGlobal(final AuthenticationManagerBuilder auth) throws Exception {
+            auth.authenticationProvider(jwtAuthenticationProvider);
+        }
+        
+        @Override
+        protected void configure(final HttpSecurity http) throws Exception {
+            String logPrefix = "StatelessSecurityContextRepository.configure(final HttpSecurity http) , ";
+            logger.debug(logPrefix + "inside Spring Boot filter config ...");
+        }
+        
+        @Bean
+        WSLoginFilter wsLoginFilter() throws Exception {
+          final WSLoginFilter filter = new WSLoginFilter();
+          return filter;
+        }
+
+        @Bean
+        JWTAuthenticationFilter jwtAuthenticationFilter() throws Exception {
+          final JWTAuthenticationFilter filter = new JWTAuthenticationFilter();
+          return filter;
+        }
+      
+        @Bean
+        HTTPPostOnlyRejectionFilter httpPostOnlyRejectionFilter() throws Exception {
+          final HTTPPostOnlyRejectionFilter filter = new HTTPPostOnlyRejectionFilter();
+          return filter;
+        }
+
+        @Bean
+        public ProviderManager authenticationManager() {
+            return new ProviderManager(Arrays.asList(jwtAuthenticationProvider));
+        }
+
+        public ExceptionTranslationFilter exceptionTranslationFilter() {
+            final ExceptionTranslationFilter exceptionTranslationFilter = new ExceptionTranslationFilter(restAuthenticationEntryPoint);
+            exceptionTranslationFilter.setAccessDeniedHandler(new AuthorizationFailHandler());
+            return exceptionTranslationFilter;
+        }
+    
+        @Bean
+        public SecureResouceMetadataSource secureResouceMetadataSource() {
+            return new SecureResouceMetadataSource();// gives allowed roles
+        }
+
+        @Bean
+        AffirmativeBased accessDecisionManager() {
+            List<AccessDecisionVoter<? extends Object>> voters = new ArrayList<>();
+            voters.add(new RoleVoter());
+            AffirmativeBased decisionManager = new AffirmativeBased(voters);
+            decisionManager.setAllowIfAllAbstainDecisions(false);
+            return decisionManager;
+        }
+
+        @Bean
+        public GenericAccessDecisionManager genericAccessDecisionManager() {
+            return new GenericAccessDecisionManager();
+        }
+    
+        public FilterSecurityInterceptor filterSecurityInterceptor() throws Exception {
+            final FilterSecurityInterceptor filterSecurityInterceptor = new FilterSecurityInterceptor();
+            filterSecurityInterceptor.setAuthenticationManager(authenticationManager());
+            filterSecurityInterceptor.setAccessDecisionManager(genericAccessDecisionManager());
+            filterSecurityInterceptor.setSecurityMetadataSource(secureResouceMetadataSource());
+            return filterSecurityInterceptor;
+        }
+
+        @Bean
+        public StatelessSecurityContextRepository statelessSecurityContextRepository() {
+            return new StatelessSecurityContextRepository();
+        }
+
+        @Bean
+        public Filter sessionManagementFilter() {
+            StatelessSecurityContextRepository repo = statelessSecurityContextRepository();
+            repo.setAllowSessionCreation(false); 
+            SessionManagementFilter filter = new SessionManagementFilter(repo);
+            return filter;
+        }
+
+        @Bean
+        public HeaderWriterFilter headerWriterFilter() {
+            HeaderWriter headerWriter = new HeaderWriter() {
+                public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
+                    response.setHeader("Cache-Control", "no-cache, no-store, max-age=0, must-revalidate");
+                    response.setHeader("Expires", "0");
+                    response.setHeader("Pragma", "no-cache");
+                    response.setHeader("X-Frame-Options", "SAMEORIGIN");
+                    response.setHeader("X-XSS-Protection", "1; mode=block");
+                    response.setHeader("x-content-type-options", "nosniff");
+                }
+            };
+            List<HeaderWriter> headerWriterFilterList = new ArrayList<HeaderWriter>();
+            headerWriterFilterList.add(headerWriter);
+            HeaderWriterFilter headerFilter = new HeaderWriterFilter(headerWriterFilterList);
+            return headerFilter;
+        }
+      
+        @Bean(name = "springSecurityFilterChain")
+        public FilterChainProxy springSecurityFilterChain() throws ServletException, Exception {
+            String logPrefix = "GenericAccessDecisionManager.springSecurityFilterChain , ";
+            logger.debug(logPrefix + "inside main filter config ...");
+
+            final List<SecurityFilterChain> listOfFilterChains = new ArrayList<SecurityFilterChain>();
+
+	    // these two chains are a binary choice. 
+	    // A login url will match, otherwise invoke jwtAuthenticationFilter
+            listOfFilterChains.add(new DefaultSecurityFilterChain(new AnonRequestMatcher(), headerWriterFilter(), httpPostOnlyRejectionFilter(), requestAndResponseValidatorFilter(), wsLoginFilter(), sessionManagementFilter()));
+
+            listOfFilterChains.add(new DefaultSecurityFilterChain(new NegatedRequestMatcher(new AnonRequestMatcher()), headerWriterFilter(), httpPostOnlyRejectionFilter(), requestAndResponseValidatorFilter(), jwtAuthenticationFilter(), sessionManagementFilter(), exceptionTranslationFilter(), filterSecurityInterceptor()));
+
+            final FilterChainProxy filterChainProxy = new FilterChainProxy(listOfFilterChains);
+
+            return filterChainProxy;
+        }
+
+        /**
+         * Disable Spring boot automatic filter registration since we are using FilterChainProxy.
+         */
+        @Bean
+        FilterRegistrationBean disableWSLoginFilterAutoRegistration(final WSLoginFilter wsLoginFilter) {
+            String logPrefix = "GenericAccessDecisionManager.disableWSLoginFilterAutoRegistration , ";
+            logger.debug(logPrefix + "executing registration.setEnabled(false) on wsLoginFilter ...");
+            final FilterRegistrationBean registration = new FilterRegistrationBean(wsLoginFilter);
+            registration.setEnabled(false);
+            return registration;
+        }
+
+        /**
+         * Disable Spring boot automatic filter registration since we are using FilterChainProxy.
+         */
+        @Bean
+        FilterRegistrationBean disableJWTAuthenticationFilterAutoRegistration(final JWTAuthenticationFilter filter) {
+            String logPrefix = "GenericAccessDecisionManager.disableJWTAuthenticationFilterAutoRegistration , ";
+            logger.debug(logPrefix + "executing registration.setEnabled(false) on JWTAuthenticationFilter ...");
+            final FilterRegistrationBean registration = new FilterRegistrationBean(filter);
+            registration.setEnabled(false);
+            return registration;
+        }
+      
+        /**
+         * Disable Spring boot automatic filter registration since we are using FilterChainProxy.
+         */
+        @Bean
+        FilterRegistrationBean disableHTTPPostOnlyRejectionFilterAutoRegistration(final HTTPPostOnlyRejectionFilter filter) {
+            String logPrefix = "GenericAccessDecisionManager.disableHTTPPostOnlyRejectionFilterAutoRegistration , ";
+            logger.debug(logPrefix + "executing registration.setEnabled(false) on HTTPPostOnlyRejectionFilter ...");
+            final FilterRegistrationBean registration = new FilterRegistrationBean(filter);
+            registration.setEnabled(false);
+            return registration;
+        }
+
+        /**
+         * Disable Spring boot automatic filter registration since we are using FilterChainProxy.
+         */
+        @Bean
+        FilterRegistrationBean disableRequestAndResponseValidatorFilterAutoRegistration(final RequestAndResponseValidatorFilter filter) {
+            String logPrefix = "GenericAccessDecisionManager.disableRequestAndResponseValidatorFilterAutoRegistration , ";
+            logger.debug(logPrefix + "executing registration.setEnabled(false) on RequestLoggingFilter ...");
+            final FilterRegistrationBean registration = new FilterRegistrationBean(filter);
+            registration.setEnabled(false);
+            return registration;
+        }
+        
+        @Bean
+        public RequestAndResponseValidatorFilter requestAndResponseValidatorFilter() {
+            RequestAndResponseValidatorFilter filter = new RequestAndResponseValidatorFilter();
+            return filter;
+        }
+        
+        @Bean()
+        FilterRegistrationBean FilterRegistrationBean() {
+            final FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();
+            filterRegistrationBean.setFilter(new DelegatingFilterProxy("springSecurityFilterChain"));
+            filterRegistrationBean.setOrder(Ordered.LOWEST_PRECEDENCE);
+            filterRegistrationBean.setName("springSecurityFilterChain");
+            filterRegistrationBean.addUrlPatterns("/*");
+            return filterRegistrationBean;
+        }
+
+        @Bean
+        AuthenticationEntryPoint forbiddenEntryPoint() {
+           return new HttpStatusEntryPoint(FORBIDDEN);
+        }
+
+        // demo purposes only
+        @SuppressWarnings("deprecation")
+        @Bean
+        public static NoOpPasswordEncoder passwordEncoder() {
+            return (NoOpPasswordEncoder) NoOpPasswordEncoder.getInstance();
+        }
+
+    }
+
+    @Override
+    protected SpringApplicationBuilder configure(SpringApplicationBuilder application) {
+        setRegisterErrorPageFilter(false);
+        return application.sources(Axis2Application.class);
+    }
+
+    public static void main(String[] args) throws Exception {
+        String logPrefix = "Axis2Application.main , ";
+        if (!isRunning) {
+            SpringApplication ctx = new SpringApplication(Axis2Application.class);
+            ApplicationContext applicationContext = ctx.run(args);
+            String[] activeProfiles = applicationContext.getEnvironment().getActiveProfiles();
+            for (String profile : activeProfiles) {
+                logger.debug(logPrefix + "Spring Boot profile: " + profile);
+            }
+        }
+        isRunning = true;
+    }
+
+
+
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/configuration/Axis2WebAppInitializer.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/configuration/Axis2WebAppInitializer.java
new file mode 100644
index 0000000..0d3acce
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/configuration/Axis2WebAppInitializer.java
@@ -0,0 +1,72 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.configuration;
+ 
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.apache.axis2.transport.http.AxisServlet;
+import org.springframework.boot.web.servlet.ServletContextInitializer;
+import org.springframework.context.annotation.Configuration; 
+import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;   
+import org.springframework.core.annotation.Order;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.PropertySource;
+import org.springframework.context.support.PropertySourcesPlaceholderConfigurer;
+
+import javax.servlet.ServletContext; 
+import javax.servlet.ServletRegistration; 
+
+import java.util.Set; 
+ 
+@Configuration
+@Order(4)
+public class Axis2WebAppInitializer implements ServletContextInitializer { 
+ 
+    private static final Logger logger = LogManager.getLogger(Axis2WebAppInitializer.class); 
+    private static final String SERVICES_MAPPING = "/services/*"; 
+ 
+    @Override 
+    public void onStartup(ServletContext container) { 
+        logger.warn("inside onStartup() ...");
+        // Create the 'root' Spring application context 
+        AnnotationConfigWebApplicationContext ctx = new AnnotationConfigWebApplicationContext(); 
+ 
+        addAxis2Servlet(container, ctx); 
+        logger.warn("onStartup() completed ...");
+    }
+ 
+    private void addAxis2Servlet(ServletContext container, AnnotationConfigWebApplicationContext ctx) { 
+
+        ServletRegistration.Dynamic dispatcher = container.addServlet(
+          "AxisServlet", new AxisServlet());
+        dispatcher.setLoadOnStartup(1);
+        Set<String> mappingConflicts = dispatcher.addMapping(SERVICES_MAPPING);
+        if (!mappingConflicts.isEmpty()) { 
+            for (String s : mappingConflicts) { 
+                logger.error("Mapping conflict: " + s); 
+            } 
+            throw new IllegalStateException("'AxisServlet' could not be mapped to '" + SERVICES_MAPPING + "'"); 
+        }
+    }
+
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/hibernate/dao/SpringSecurityDAOImpl.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/hibernate/dao/SpringSecurityDAOImpl.java
new file mode 100755
index 0000000..37d9545
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/hibernate/dao/SpringSecurityDAOImpl.java
@@ -0,0 +1,115 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.hibernate.dao;
+
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.Set;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.stereotype.Service;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.springframework.dao.DataAccessException;
+
+import userguide.springboot.requestactivity.Axis2UserDetails;
+import userguide.springboot.security.webservices.WSSecUtils;
+import userguide.springboot.security.webservices.LoginDTO;
+
+@Service
+public class SpringSecurityDAOImpl implements UserDetailsService {
+
+    private static final Logger logger = LogManager.getLogger(SpringSecurityDAOImpl.class);
+    
+    @Autowired
+    private WSSecUtils wssecutils;
+
+    /** Everyone needs this role. **/
+    public static final String ROLE_USER = "ROLE_USER";
+
+    /**
+     * Spring Security invokes this method to get the credentials from the DB.
+     */
+    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException, DataAccessException {
+
+        String logPrefix = "SpringSecurityDAOImpl.loadUserByUsername() , ";
+        Axis2UserDetails userDetails = null;
+        
+        logger.debug("user attempting Spring Security login: " + username);
+        if (username == null || username.equals("")) {
+            throw new BadCredentialsException("user login FAILED: username empty or null.");
+        }    
+        LoginDTO persistedUser = null;
+        try {
+            persistedUser = wssecutils.findUserByEmail(username);
+        } catch (Exception ex) {
+            logger.error(logPrefix + "cannot create LoginDTO from email: " + username + " , " + ex.getMessage(), ex);
+        }
+        if (persistedUser == null) {
+            throw new BadCredentialsException("Can't find username: " + username);
+        }    
+
+        Set<String> roles = new HashSet<String>();
+        // adding permissions - put Roles here
+        // Every user must have the ROLE_USER to navigate the application:
+        if (!roles.contains(ROLE_USER)) {
+            roles.add(ROLE_USER);
+        }
+        Iterator<String> it = roles.iterator();
+
+        Collection<GrantedAuthority> authorities = new HashSet<GrantedAuthority>();
+
+        int xx = 0;
+        while (it.hasNext()) {
+            String role = it.next();
+            GrantedAuthority authority = new SimpleGrantedAuthority(role);
+            authorities.add(authority);
+            if (logger.isDebugEnabled()) {
+                logger.debug("user: " + username + ", "
+                             + "authorities : " + (xx - 1) + ", value:"
+                             + authority.toString());
+            }
+        }
+
+        // Give these fields to Spring Security so it can compare with credentials passed in via the login page
+        userDetails = new Axis2UserDetails(persistedUser,
+                // username == email 
+                persistedUser.getEmail().toLowerCase(),
+                persistedUser.getPassword(),
+                persistedUser.getEnabled(),
+                persistedUser.getAccountNonExpired(),
+                persistedUser.getCredentialsNonExpired(),
+                persistedUser.getAccountNonLocked(),
+                authorities);
+            
+    
+        return userDetails;
+
+    }
+    
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/requestactivity/Axis2UserDetails.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/requestactivity/Axis2UserDetails.java
new file mode 100644
index 0000000..cc5db11
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/requestactivity/Axis2UserDetails.java
@@ -0,0 +1,64 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.requestactivity;
+
+import java.util.Collection;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.userdetails.User;
+
+public class Axis2UserDetails extends User {
+
+    private static final long serialVersionUID = 2041888514077783198L;
+    /**  User entity which is Stored by Spring's SecurityContext per every login. */
+    private Object userDomain;
+    
+    /**
+     * @return Returns the userDomain.
+     */
+    public Object getUserDomain() {
+        return userDomain;
+    }
+    
+    /** 
+     * Override SPRING SECURITY Constructor to inform it about the  User entity.
+     * 
+     * @param userDomain Authenticated  User entity
+     * @param username from DB
+     * @param password from DB
+     * @param enabled Indicates whether the user is enabled or disabled
+     * @param accountNonExpired Indicates whether the user's account has expired
+     * @param credentialsNonExpired Indicates whether the user's credentials 
+     *   (password) has expired.
+     * @param accountNonLocked Indicates whether the user is locked or unlocked.
+     * @param authorities the authorities granted to the user
+     * @throws IllegalArgumentException Invalid argument was found 
+     */
+    public Axis2UserDetails(Object userDomain, 
+            String username, String password, boolean enabled, 
+            boolean accountNonExpired, boolean credentialsNonExpired, 
+            boolean accountNonLocked,
+            Collection<? extends GrantedAuthority> authorities)
+        throws IllegalArgumentException  {
+         
+        super(username, password, enabled, accountNonExpired, 
+                credentialsNonExpired, accountNonLocked, authorities);
+        this.userDomain = userDomain;
+    }
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/BadRequestMatcher.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/BadRequestMatcher.java
new file mode 100644
index 0000000..8adb2a1
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/BadRequestMatcher.java
@@ -0,0 +1,258 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.security.webservices;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.security.web.util.matcher.RequestMatcher;
+
+import java.util.Arrays;
+import java.util.Enumeration;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Set;
+
+public class BadRequestMatcher implements RequestMatcher {
+
+    /** commons logging declaration. **/
+    private static Log logger = LogFactory.getLog(BadRequestMatcher.class);
+          
+    private Set<String> encodedUrlBlacklist = new HashSet<String>();
+
+    private Set<String> decodedUrlBlacklist = new HashSet<String>();
+    
+    private static final String ENCODED_PERCENT = "%25";
+
+    private static final String PERCENT = "%";
+
+    private List<String> FORBIDDEN_ENCODED_PERIOD = Collections.unmodifiableList(Arrays.asList("%2e", "%2E"));
+
+    private List<String> FORBIDDEN_SEMICOLON = Collections.unmodifiableList(Arrays.asList(";", "%3b", "%3B"));
+
+    private List<String> FORBIDDEN_FORWARDSLASH = Collections.unmodifiableList(Arrays.asList("%2f", "%2F"));
+
+    private List<String> FORBIDDEN_BACKSLASH = Collections.unmodifiableList(Arrays.asList("\\", "%5c", "%5C"));
+
+    private int requestDebuggingActivated;
+
+    public BadRequestMatcher(int requestDebuggingActivated) {
+        
+	this.requestDebuggingActivated = requestDebuggingActivated;
+        // this is a 'defense in depth' strategy as Cloudflare or another load balancer should reject this stuff
+        urlBlacklistsAddAll(FORBIDDEN_SEMICOLON);
+        urlBlacklistsAddAll(FORBIDDEN_FORWARDSLASH);
+        urlBlacklistsAddAll(FORBIDDEN_BACKSLASH);
+
+        this.encodedUrlBlacklist.add(ENCODED_PERCENT);
+        this.encodedUrlBlacklist.addAll(FORBIDDEN_ENCODED_PERIOD);
+        this.decodedUrlBlacklist.add(PERCENT);
+    }
+    
+    private void urlBlacklistsAddAll(Collection<String> values) {
+        this.encodedUrlBlacklist.addAll(values);
+        this.decodedUrlBlacklist.addAll(values);
+    }
+
+    public boolean validate(HttpServletRequest request) {
+        return matches(request);	    
+    }        
+    @Override
+    public boolean matches(HttpServletRequest request) {
+        String logPrefix = "BadRequestMatcher.matches , ";
+	boolean foundElements = false;
+        for (Enumeration en = request.getParameterNames(); en
+                .hasMoreElements();) {
+
+            foundElements = true;
+
+            Object obj = en.nextElement();
+            String value = request.getParameterValues((String) obj)[0];
+            if (!isNormalized(value)) {
+                logger.error(logPrefix + 
+		    "found illegal String: " +value+ " , returning false because the request has parameters that are not 'normalized i.e. paths contain dir traversal or illegal chars'");
+		return false;
+                
+            }
+            if (!rejectedBlacklistedValues(value)) {
+                logger.error(logPrefix + 
+		    "found illegal String: " +value+ " , returning false because the request has rejected black list values");
+		return false;
+                
+            }
+            if (requestDebuggingActivated == 1) {
+                logger.error(logPrefix + 
+		    "on requestDebuggingActivated=1 found String: " +value);
+                
+            }
+        }
+        if (!foundElements) {
+            logger.warn(logPrefix + "on requestDebuggingActivated=1 , no HTTP elements found!");
+        }
+        rejectedBlacklistedUrls(request);
+        if (!isNormalized(request)) {
+            logger.error(logPrefix + 
+	        "inside BadRequestMatcher.matches, returning false because the request was not 'normalized i.e. paths contain dir traversal or illegal chars'");
+            return false;
+        }
+        String requestUri = request.getRequestURI();
+        if (!containsOnlyPrintableAsciiCharacters(requestUri)) {
+            logger.error(logPrefix +
+                "The requestURI was rejected because it can only contain printable ASCII characters.");
+            return false;
+
+        }
+        return true;
+    }
+    
+    private boolean containsOnlyPrintableAsciiCharacters(String uri) {
+        int length = uri.length();
+        for (int i = 0; i < length; i++) {
+            char c = uri.charAt(i);
+            if (c < '\u0020' || c > '\u007e') {
+                return false;
+            }
+        }
+
+        return true;
+    }
+    
+    private boolean rejectedBlacklistedUrls(HttpServletRequest request) {
+        String logPrefix = "BadRequestMatcher.rejectedBlacklistedUrls , ";
+        for (String forbidden : this.encodedUrlBlacklist) {
+            if (encodedUrlContains(request, forbidden)) {
+                logger.error(logPrefix + 
+	            "returning false, The request was rejected because the URL contained a potentially malicious String \"" + forbidden + "\"");
+		return false;
+            }
+        }
+        for (String forbidden : this.decodedUrlBlacklist) {
+            if (decodedUrlContains(request, forbidden)) {
+                logger.error(logPrefix + 
+                    "The request was rejected because the URL contained a potentially malicious String \"" + forbidden + "\"");
+		return false;
+            }
+        }
+        return true;
+    }
+    
+    private boolean rejectedBlacklistedValues(String value) {
+        String logPrefix = "BadRequestMatcher.matches , ";
+        for (String forbidden : this.encodedUrlBlacklist) {
+            if (valueContains(value, forbidden)) {
+                logger.error(logPrefix + "found illegal String: " +value+ " , returning false because the request has parameters that are not 'normalized i.e. paths contain dir traversal or illegal chars'");
+		return false;
+            }
+        }    
+        return true;
+    }
+    
+    private boolean valueContains(String value, String contains) {
+        return value != null && value.contains(contains);
+    }
+
+    private boolean encodedUrlContains(HttpServletRequest request, String value) {
+        if (valueContains(request.getContextPath(), value)) {
+            return true;
+        }
+        return valueContains(request.getRequestURI(), value);
+    }
+
+    private boolean decodedUrlContains(HttpServletRequest request, String value) {
+        if (valueContains(request.getServletPath(), value)) {
+            return true;
+        }
+        if (valueContains(request.getPathInfo(), value)) {
+            return true;
+        }
+        return false;
+    }
+    
+    /**
+     * This should be done by Spring Security StrictHttpFirewall but isn't working as expected, 
+     * turns out its not as detailed as we need. 
+     * Instead of sub-classing it to add logging - there is none - and features, just do the important parts here
+     *  
+     * Checks whether a path is normalized (doesn't contain path traversal
+     * sequences like "./", "/../" or "/.")
+     *
+     * @param path
+     *            the path to test
+     * @return true if the path doesn't contain any path-traversal character
+     *         sequences.
+     */
+    private boolean isNormalized(HttpServletRequest request) {
+        String logPrefix = "BadRequestMatcher.isNormalized , ";
+        if (!isNormalized(request.getRequestURI())) {
+            logger.error(logPrefix + "returning false on request.getRequestURI() : " + request.getRequestURI());
+            return false;
+        }
+        if (!isNormalized(request.getContextPath())) {
+            logger.error(logPrefix + "returning false on request.getContextPath() : " + request.getContextPath());
+            return false;
+        }
+        if (!isNormalized(request.getServletPath())) {
+            logger.error(logPrefix + "returning false on request.getServletPath() : " + request.getServletPath());
+            return false;
+        }
+        if (!isNormalized(request.getPathInfo())) {
+            logger.error(logPrefix + "returning false on request.getPathInfo() : " + request.getPathInfo());
+            return false;
+        }
+        return true;
+    }
+    
+    private boolean isNormalized(String path) {
+        
+        String logPrefix = "BadRequestMatcher.isNormalized(String path) , ";
+        
+        logger.warn(logPrefix + "evaluating path : " + path);
+        
+        if (path == null) {
+            return true;
+        }
+
+        if (path.indexOf("//") > -1) {
+            return false;
+        }
+
+        for (int j = path.length(); j > 0;) {
+            int i = path.lastIndexOf('/', j - 1);
+            int gap = j - i;
+
+            if (gap == 2 && path.charAt(i + 1) == '.') {
+                // ".", "/./" or "/."
+                return false;
+            } else if (gap == 3 && path.charAt(i + 1) == '.' && path.charAt(i + 2) == '.') {
+                return false;
+            }
+
+            j = i;
+        }
+
+          return true;
+      }
+
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/HTTPPostOnlyRejectionFilter.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/HTTPPostOnlyRejectionFilter.java
new file mode 100644
index 0000000..9b9dd58
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/HTTPPostOnlyRejectionFilter.java
@@ -0,0 +1,89 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.security.webservices;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.http.server.ServletServerHttpRequest;
+import org.springframework.web.filter.OncePerRequestFilter;
+import org.springframework.web.util.ContentCachingRequestWrapper;
+import org.springframework.web.util.ContentCachingResponseWrapper;
+import org.springframework.web.util.WebUtils;
+import org.springframework.security.web.RedirectStrategy;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import java.util.UUID;
+
+public class HTTPPostOnlyRejectionFilter extends OncePerRequestFilter {
+ 
+    private static Log logger = LogFactory.getLog(HTTPPostOnlyRejectionFilter.class);
+    
+    private final RedirectStrategy redirectStrategy = new NoRedirectStrategy();
+
+    public HTTPPostOnlyRejectionFilter() {
+        super();
+    }
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
+
+        String uuid = UUID.randomUUID().toString();
+        String logPrefix = "HTTPPostOnlyRejectionFilter.doFilterInternal , uuid: " + uuid + " , ";
+        
+        logger.trace(logPrefix + "starting ... ");
+        
+        if (!request.getMethod().equals("POST")) {
+
+	    String ip = "unknown";
+            if (request.getHeader("X-Forwarded-For") != null) { 
+	        ip = request.getHeader("X-Forwarded-For");
+            }
+            logger.trace(logPrefix +
+                "this is not a POST request, ignoring with an HTTP 200 response, " +
+                " , on IP from X-Forwarded-For: " + request.getRequestURI() + 
+                " , request.getRequestURI() : " + request.getRequestURI() + 
+		" , request.getMethod() : " + request.getMethod());
+
+            response.setContentType("application/json;charset=UTF-8");
+            response.getWriter().print("HTTP requests that are not POST are ignored");
+            response.getWriter().flush();
+            this.redirectStrategy.sendRedirect((HttpServletRequest) request, (HttpServletResponse) response, "/");
+
+        } else {
+            filterChain.doFilter(request, response);
+        }
+    }
+
+    protected class NoRedirectStrategy implements RedirectStrategy {
+
+        @Override
+        public void sendRedirect(HttpServletRequest request, HttpServletResponse response, String url)
+                throws IOException {
+            // do nothing
+        }
+
+    }
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTAuthenticationFilter.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTAuthenticationFilter.java
new file mode 100644
index 0000000..e46c9c7
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTAuthenticationFilter.java
@@ -0,0 +1,136 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.security.webservices;
+
+import java.io.IOException;
+import java.util.UUID;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.PropertySource;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
+import org.owasp.esapi.ESAPI;
+import org.owasp.esapi.Validator;
+
+public class JWTAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
+    
+    @Autowired
+    private WSSecUtils wssecutils;
+
+    public JWTAuthenticationFilter() {
+        super("/**");
+    }
+
+    @Override
+    @Autowired
+    public void setAuthenticationManager(AuthenticationManager authenticationManager) {
+        super.setAuthenticationManager(authenticationManager);
+    }
+
+    @Override
+    protected boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response) {
+        return true;
+    }
+
+    @Override
+    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
+        String logPrefix = "JWTAuthenticationFilter.attemptAuthentication() , ";
+
+        // if this fails it will throw a fatal error, don't catch it since it could be evil data
+        String authToken = getBearerToken(request);
+
+        JWTAuthenticationToken authRequest = new JWTAuthenticationToken(authToken);
+
+        return getAuthenticationManager().authenticate(authRequest);
+    }
+
+    public String getBearerToken(HttpServletRequest request) throws AuthenticationException {
+        String logPrefix = "JWTAuthenticationFilter.getBearerToken() , ";
+        String header = request.getHeader("Authorization");
+
+        if (header == null || !header.startsWith("Bearer ")) {
+            throw new JWTTokenMissingException("No JWT token found in request headers");
+        }
+        Validator validator = ESAPI.validator();
+        boolean headerstatus = validator.isValidInput("userInput", header, "HTTPHeaderValue", 1000 , false);
+        if (!headerstatus) {
+            logger.error(logPrefix + "returning with failure status on invalid header: " + header);
+            throw new JWTTokenMissingException("invalid header");
+        }
+
+        String authToken = header.substring(7);
+
+        return authToken;
+    }
+
+    @Override
+    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
+            
+        String logPrefix = "JWTAuthenticationFilter.successfulAuthentication() , ";
+
+        String authToken = getBearerToken(request);
+        JWTUserDTO parsedUser = null; 
+        try{
+            parsedUser = wssecutils.getParsedUser(authToken);
+        } catch (Exception ex) {
+            logger.error(logPrefix +  ex.getMessage(), ex );
+        }
+
+        if (parsedUser == null) {
+            throw new ServletException("JWT token is not valid, cannot find user");
+        }
+        String uuid = parsedUser.getUuid();
+        if (uuid == null) {
+            throw new ServletException("JWT token is not valid, cannot find uuid");
+        }
+        logger.warn(logPrefix + "found uuid from token: " + uuid);
+        String usernameFromToken = parsedUser.getUsername();
+        if (usernameFromToken == null) {
+            throw new ServletException("JWT token is not valid, cannot find username");
+        }
+        usernameFromToken = usernameFromToken.trim();
+
+        String currentUserIPAddress = null;
+
+	String newuuid = UUID.randomUUID().toString();
+
+        // As this authentication is in the HTTP header, after success we need to continue 
+        // the request normally and return the response as if the resource was not secured at all
+
+        // set some vars that may be helpful to the webservices
+        request.setAttribute("email", usernameFromToken);
+        request.setAttribute("uuid", newuuid);
+        request.setAttribute("currentUserIPAddress", currentUserIPAddress);
+
+        SecurityContextHolder.getContext().setAuthentication(authResult);
+   
+        chain.doFilter(request, response);
+    }
+ 
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTAuthenticationProvider.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTAuthenticationProvider.java
new file mode 100644
index 0000000..7137858
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTAuthenticationProvider.java
@@ -0,0 +1,108 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.security.webservices;
+
+import java.util.List;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.stereotype.Component;
+
+import userguide.springboot.requestactivity.Axis2UserDetails;
+
+@Component
+public class JWTAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {
+
+    private static final Logger log = LogManager.getLogger(JWTAuthenticationProvider.class);
+    
+    @Autowired
+    private WSSecUtils wssecutils;
+
+    @Override
+    public boolean supports(Class<?> authentication) {
+        return (JWTAuthenticationToken.class.isAssignableFrom(authentication));
+    }
+
+    @Override
+    protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
+    }
+
+    @Override
+    protected UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
+        String logPrefix = "JWTAuthenticationProvider.retrieveUser() , username: " +username+ " , ";
+        JWTAuthenticationToken jwtAuthenticationToken = (JWTAuthenticationToken) authentication;
+        String token = jwtAuthenticationToken.getToken();
+
+        try {
+            JWTUserDTO parsedUser = wssecutils.getParsedUser(token);
+    
+            if (parsedUser == null) {
+                throw new JWTTokenMalformedException("JWT token is not valid, cannot find user");
+            }
+            logger.warn(logPrefix + "found parsedUser: " + parsedUser.toString());
+            String uuid = parsedUser.getUuid();
+            if (uuid == null) {
+                throw new JWTTokenMalformedException("JWT token is not valid, cannot find uuid");
+            }
+            if (parsedUser.getUsername() == null) {
+                throw new JWTTokenMalformedException("JWT token is not valid, cannot find email");
+            }
+            logger.warn(logPrefix + "found uuid from token: " + uuid);
+
+            LoginDTO persistedUser = null;
+            try {
+                persistedUser = wssecutils.findUserByEmail(parsedUser.getUsername());
+            } catch (Exception ex) {
+                logger.error(logPrefix + "cannot create LoginDTO from email: " + parsedUser.getUsername() + " , " + ex.getMessage(), ex);
+                throw new JWTTokenMalformedException("JWT token is not valid, cannot create LoginDTO from email: " + parsedUser.getUsername());
+            }
+            if (persistedUser == null) {
+                logger.error(logPrefix + "returning with failure status on failed creation of LoginDTO from email: " + parsedUser.getUsername());
+                throw new JWTTokenMalformedException("JWT token is not valid, LoginDTO is null from email: " + parsedUser.getUsername());
+            }
+            List<GrantedAuthority> authorityList = AuthorityUtils.commaSeparatedStringToAuthorityList(parsedUser.getRole());
+
+            Boolean isNonLocked;
+
+            if (persistedUser.getAccountNonLocked()) {
+                isNonLocked = true;
+            } else {
+                isNonLocked = false;
+            }
+
+            Axis2UserDetails userDetails = new Axis2UserDetails(persistedUser, parsedUser.getUsername(), token, persistedUser.getEnabled(), persistedUser.getAccountNonExpired(), persistedUser.getCredentialsNonExpired(), isNonLocked, authorityList);
+
+            return userDetails;
+        
+        } catch (Exception ex) {
+            logger.error(logPrefix + "failed: " + ex.getMessage(), ex);
+            throw new JWTTokenMalformedException("unexpected error parsing token");
+        }
+            
+    }
+
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTAuthenticationSuccessHandler.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTAuthenticationSuccessHandler.java
new file mode 100644
index 0000000..ae0a6cd
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTAuthenticationSuccessHandler.java
@@ -0,0 +1,35 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.security.webservices;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+
+public class JWTAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
+	
+	@Override
+    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
+        // We do not need to do anything extra on REST authentication success, because there is no page to redirect to
+    }
+
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTAuthenticationToken.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTAuthenticationToken.java
new file mode 100644
index 0000000..60f654f
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTAuthenticationToken.java
@@ -0,0 +1,48 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.security.webservices;
+
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+
+public class JWTAuthenticationToken extends UsernamePasswordAuthenticationToken {
+    
+    private static final long serialVersionUID = -5031102661066770894L;
+
+    private String token;
+
+    public JWTAuthenticationToken(String token) {
+        super(null, null);
+        this.token = token;
+    }
+
+    public String getToken() {
+        return token;
+    }
+
+    @Override
+    public Object getCredentials() {
+        return null;
+    }
+
+    @Override
+    public Object getPrincipal() {
+        return null;
+    }
+}
diff --git a/modules/json/src/org/apache/axis2/json/gson/JsonHtmlXssSerializer.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTTokenAuthenticationException.java
similarity index 61%
copy from modules/json/src/org/apache/axis2/json/gson/JsonHtmlXssSerializer.java
copy to modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTTokenAuthenticationException.java
index 619c1ae..ea35763 100644
--- a/modules/json/src/org/apache/axis2/json/gson/JsonHtmlXssSerializer.java
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTTokenAuthenticationException.java
@@ -1,3 +1,4 @@
+
 /*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements. See the NOTICE file
@@ -16,24 +17,16 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+package userguide.springboot.security.webservices;
 
-package org.apache.axis2.json.gson;
+import org.springframework.security.core.AuthenticationException;
 
-import org.owasp.encoder.Encode;
+public class JWTTokenAuthenticationException extends AuthenticationException {
 
-import com.google.gson.JsonElement;
-import com.google.gson.JsonPrimitive;
-import com.google.gson.JsonSerializationContext;
-import com.google.gson.JsonSerializer;
-import java.lang.reflect.Type;
+    private static final long serialVersionUID = -659063016840102545L;
 
-public class JsonHtmlXssSerializer implements JsonSerializer<String> {
+        public JWTTokenAuthenticationException(String msg) {
+        super(msg);
+    }
 
-	@Override
-	public JsonElement serialize(String src, Type typeOfSrc,
-			JsonSerializationContext context) {
-
-		return new JsonPrimitive(Encode.forHtmlContent(src));
-
-	}
 }
diff --git a/modules/json/src/org/apache/axis2/json/gson/JsonHtmlXssSerializer.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTTokenMalformedException.java
similarity index 61%
copy from modules/json/src/org/apache/axis2/json/gson/JsonHtmlXssSerializer.java
copy to modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTTokenMalformedException.java
index 619c1ae..df9a3c3 100644
--- a/modules/json/src/org/apache/axis2/json/gson/JsonHtmlXssSerializer.java
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTTokenMalformedException.java
@@ -1,3 +1,4 @@
+
 /*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements. See the NOTICE file
@@ -16,24 +17,16 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+package userguide.springboot.security.webservices;
 
-package org.apache.axis2.json.gson;
+import org.springframework.security.core.AuthenticationException;
 
-import org.owasp.encoder.Encode;
+public class JWTTokenMalformedException extends AuthenticationException {
+	
+	private static final long serialVersionUID = 4207020475526562507L;
 
-import com.google.gson.JsonElement;
-import com.google.gson.JsonPrimitive;
-import com.google.gson.JsonSerializationContext;
-import com.google.gson.JsonSerializer;
-import java.lang.reflect.Type;
+	public JWTTokenMalformedException(String msg) {
+        super(msg);
+    }
 
-public class JsonHtmlXssSerializer implements JsonSerializer<String> {
-
-	@Override
-	public JsonElement serialize(String src, Type typeOfSrc,
-			JsonSerializationContext context) {
-
-		return new JsonPrimitive(Encode.forHtmlContent(src));
-
-	}
 }
diff --git a/modules/json/src/org/apache/axis2/json/gson/JsonHtmlXssSerializer.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTTokenMissingException.java
similarity index 61%
copy from modules/json/src/org/apache/axis2/json/gson/JsonHtmlXssSerializer.java
copy to modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTTokenMissingException.java
index 619c1ae..3acd5af 100644
--- a/modules/json/src/org/apache/axis2/json/gson/JsonHtmlXssSerializer.java
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTTokenMissingException.java
@@ -1,3 +1,4 @@
+
 /*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements. See the NOTICE file
@@ -16,24 +17,16 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+package userguide.springboot.security.webservices;
 
-package org.apache.axis2.json.gson;
+import org.springframework.security.core.AuthenticationException;
 
-import org.owasp.encoder.Encode;
+public class JWTTokenMissingException extends AuthenticationException {
 
-import com.google.gson.JsonElement;
-import com.google.gson.JsonPrimitive;
-import com.google.gson.JsonSerializationContext;
-import com.google.gson.JsonSerializer;
-import java.lang.reflect.Type;
+	private static final long serialVersionUID = -659063016840102545L;
 
-public class JsonHtmlXssSerializer implements JsonSerializer<String> {
-
-	@Override
-	public JsonElement serialize(String src, Type typeOfSrc,
-			JsonSerializationContext context) {
-
-		return new JsonPrimitive(Encode.forHtmlContent(src));
-
+	public JWTTokenMissingException(String msg) {
+		super(msg);
 	}
+
 }
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTUserDTO.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTUserDTO.java
new file mode 100644
index 0000000..dae5d35
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/JWTUserDTO.java
@@ -0,0 +1,55 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.security.webservices;
+
+public class JWTUserDTO {
+    
+    private String uuid;
+
+    private String username;
+
+    private String role;
+
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    public String getRole() {
+        return role;
+    }
+
+    public void setRole(String role) {
+        this.role = role;
+    }
+
+    public void setUuid(String uuid) {
+             
+    this.uuid = uuid;
+    }
+
+    public String getUuid() {
+        return uuid;
+    }
+
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/LoginDTO.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/LoginDTO.java
new file mode 100644
index 0000000..04614e8
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/LoginDTO.java
@@ -0,0 +1,105 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.security.webservices;
+
+public class LoginDTO {
+    
+    private String email;
+
+    private String password;
+
+    private Boolean enabled;
+
+    private Boolean accountNonExpired;
+
+    private Boolean credentialsNonExpired;
+    
+    private Boolean accountNonLocked;
+    
+
+    public Boolean getAccountNonLocked() {
+        return accountNonLocked;
+    }
+
+    public void setAccountNonLocked(Boolean accountNonLocked) {
+        this.accountNonLocked = accountNonLocked;
+    }
+
+    public String getEmail() {
+        return email;
+    }
+
+    public void setEmail(String email) {
+        this.email = email;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    public void setPassword(String password) {
+        this.password = password;
+    }
+
+    public Boolean getEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(Boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public Boolean getAccountNonExpired() {
+        return accountNonExpired;
+    }
+
+    public void setAccountNonExpired(Boolean accountNonExpired) {
+        this.accountNonExpired = accountNonExpired;
+    }
+
+    public Boolean getCredentialsNonExpired() {
+        return credentialsNonExpired;
+    }
+
+    public void setCredentialsNonExpired(Boolean credentialsNonExpired) {
+        this.credentialsNonExpired = credentialsNonExpired;
+    }
+
+    public LoginDTO(String email, String password, Boolean enabled, Boolean accountNonExpired, Boolean credentialsNonExpired, Boolean accountNonLocked) {
+        super();
+        this.email = email;
+        this.password = password;
+        this.enabled = enabled;
+        this.accountNonExpired = accountNonExpired;
+        this.credentialsNonExpired = credentialsNonExpired;
+        this.accountNonLocked = accountNonLocked;
+    }
+
+    @Override
+    public String toString() {
+        return "LoginDTO [email=" + email 
+                + ", enabled=" + enabled + ", accountNonExpired="
+                + accountNonExpired + ", credentialsNonExpired="
+                + credentialsNonExpired + ", accountNonLocked="
+                + accountNonLocked + "]";
+    }
+    
+        
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/RequestAndResponseValidatorFilter.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/RequestAndResponseValidatorFilter.java
new file mode 100644
index 0000000..95a2e47
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/RequestAndResponseValidatorFilter.java
@@ -0,0 +1,200 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.security.webservices;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.http.server.ServletServerHttpRequest;
+import org.springframework.web.filter.OncePerRequestFilter;
+import org.springframework.web.util.ContentCachingRequestWrapper;
+import org.springframework.web.util.ContentCachingResponseWrapper;
+import org.springframework.web.util.WebUtils;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.PropertySource;
+import org.springframework.context.support.PropertySourcesPlaceholderConfigurer;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import java.util.UUID;
+
+@PropertySource("classpath:application.properties")
+public class RequestAndResponseValidatorFilter extends OncePerRequestFilter {
+ 
+    private static Log logger = LogFactory.getLog(RequestAndResponseValidatorFilter.class);
+    
+    private static ThreadLocal<Long> requestBeginTime = new ThreadLocal<>();
+    private static final int DEFAULT_MAX_PAYLOAD_LENGTH = 16384;
+
+    private int maxPayloadLength = DEFAULT_MAX_PAYLOAD_LENGTH;
+
+    @Value("${requestDebuggingActivated}")
+    private int requestDebuggingActivated;
+
+    public RequestAndResponseValidatorFilter() {
+        super();
+    }
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
+
+        String uuid = UUID.randomUUID().toString();
+        String logPrefix = "RequestAndResponseValidatorFilter.doFilterInternal , uuid: " + uuid + " , request.getRequestURI():" + request.getRequestURI() + " , ";
+        
+        logger.debug(logPrefix + "starting ... ");
+        
+        BadRequestMatcher bad = new BadRequestMatcher(requestDebuggingActivated);
+        if (!bad.validate(request)) {
+            throw new ServletException("request is invalid, it contains a potentially malicious String");
+        }
+        
+        boolean isFirstRequest = !isAsyncDispatch(request);
+        HttpServletRequest requestToUse = request;
+
+        if (isFirstRequest && !(request instanceof ContentCachingRequestWrapper)) {
+            requestToUse = new ContentCachingRequestWrapper(request, getMaxPayloadLength());
+        }
+
+        HttpServletResponse responseToUse = response;
+        if (!(response instanceof ContentCachingResponseWrapper)) {
+            responseToUse = new ContentCachingResponseWrapper(response);
+        }
+
+        requestBeginTime.set(System.currentTimeMillis());
+
+        String currentUserIPAddress = null;
+        if (requestToUse.getHeader("X-Forwarded-For") != null) {
+            currentUserIPAddress = requestToUse.getHeader("X-Forwarded-For");
+        } else {
+            logger.warn(logPrefix + "cannot find X-Forwarded-For header, this field is required for proper IP auditing");
+            logger.warn(logPrefix + "Because no X-Forwarded-For header was found, setting 'currentUserIPAddress = requestToUse.getRemoteAddr()' which is typically an internal address");
+            currentUserIPAddress = requestToUse.getRemoteAddr();
+        }
+
+        if (currentUserIPAddress == null || currentUserIPAddress.length() == 0 || "unknown".equalsIgnoreCase(currentUserIPAddress)) {
+            logger.warn(logPrefix + "cannot find valid currentUserIPAddress");
+        } else {
+            logger.warn(logPrefix + "proceeding on currentUserIPAddress: " + currentUserIPAddress);
+            // rate limiting and extra validation can go here
+        }
+        
+        try {
+            filterChain.doFilter(requestToUse, responseToUse);
+        } finally {
+            logRequest(createRequestMessage(requestToUse,uuid));
+            logRequest(createResponseMessage(responseToUse,uuid));
+        }
+    }
+
+    protected String createRequestMessage(HttpServletRequest request, String uuid) throws ServletException {
+        
+        StringBuilder msg = new StringBuilder();
+        msg.append("HTTP request with uuid: " + uuid + " , ");
+        msg.append(request.getMethod());
+        msg.append(" uri=").append(request.getRequestURI());
+
+        String queryString = request.getQueryString();
+        if (queryString != null) {
+            msg.append('?').append(queryString);
+        }
+
+        String user = request.getRemoteUser();
+        if (user != null) {
+            msg.append(";user=").append(user);
+        }
+
+        
+        return msg.toString();
+    }
+
+    protected String createResponseMessage(HttpServletResponse resp, String uuid) throws ServletException{
+
+        StringBuilder msg = new StringBuilder();
+        msg.append("HTTP response with uuid: " + uuid + " , ");
+
+        ContentCachingResponseWrapper responseWrapper = WebUtils.getNativeResponse(resp, ContentCachingResponseWrapper.class);
+        if (responseWrapper != null) {
+            byte[] buf = responseWrapper.getContentAsByteArray();
+            try {
+                responseWrapper.copyBodyToResponse();
+            } catch (IOException e) {
+                logger.error("Fail to write response body back", e);
+            }
+            if (buf.length > 0) {
+                String payload;
+                try {
+                    payload = new String(buf, 0, buf.length, responseWrapper.getCharacterEncoding());
+                } catch (UnsupportedEncodingException ex) {
+                    payload = "[unknown]";
+                }
+                msg.append(";response=").append(payload);
+            }
+        }
+        
+        return msg.toString();
+    }
+
+    public static boolean validate(String msg) {
+        // Input validation is inferior to output sanitation as its impossible to think of 
+        // everything. See JsonHtmlXssSerializer for html encoding of the output
+        
+        if (msg != null && msg.toUpperCase().contains("DOCTYPE")) {
+            logger.error("DOCTYPE keyword is disallowed");
+            return false;
+        }
+	
+        // reflected XSS
+        if (msg != null && msg.toUpperCase().indexOf("SCRIPT") != -1) {
+            logger.error("SCRIPT keyword is disallowed");
+            return false;
+        }
+        // reflected XSS without script tag, sneaky ... <img onerror=alert(1)/>
+        if (msg != null && msg.toUpperCase().indexOf("ALERT") != -1) {
+            logger.error("ALERT keyword is disallowed");
+            return false;
+        }
+                
+        return true;
+        
+    }
+
+    public int getMaxPayloadLength() {
+        return maxPayloadLength;
+    }
+
+    protected void logRequest(String message) {
+
+        String logPrefix = "RequestAndResponseValidatorFilter.logRequest() , ";
+        long begin = requestBeginTime.get();
+        long end = System.currentTimeMillis();
+ 
+        long duration = end - begin;
+        if (message != null && message.toString().toUpperCase().indexOf("CREDENTIALS") != -1) {
+            logger.info(logPrefix + " , not logging credentials ... request time:" + duration);
+        } else {
+            logger.info(logPrefix + message + ", request time:" + duration);
+        }
+    }
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/RestAuthenticationEntryPoint.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/RestAuthenticationEntryPoint.java
new file mode 100644
index 0000000..c7c3e68
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/RestAuthenticationEntryPoint.java
@@ -0,0 +1,39 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.security.webservices;
+
+import java.io.IOException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.stereotype.Component;
+
+@Component
+public class RestAuthenticationEntryPoint implements AuthenticationEntryPoint {
+	@Override
+    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
+        // This is invoked when user tries to access a secured REST resource without supplying any credentials
+        // We should just send a 401 Unauthorized response because there is no 'login page' to redirect to
+        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
+    }
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/WSLoginFilter.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/WSLoginFilter.java
new file mode 100644
index 0000000..c1df12e
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/WSLoginFilter.java
@@ -0,0 +1,93 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.security.webservices;
+
+import java.io.IOException;
+import java.util.Enumeration;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.filter.GenericFilterBean;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.PropertySource;
+import org.springframework.context.support.PropertySourcesPlaceholderConfigurer;
+
+@PropertySource("classpath:application.properties")
+public class WSLoginFilter extends GenericFilterBean  {
+    
+    @Value("${requestDebuggingActivated}")
+    private int requestDebuggingActivated;
+
+    @Override
+    public void doFilter(
+        ServletRequest request, 
+        ServletResponse response,
+        FilterChain chain) throws IOException, ServletException {
+              
+        final String logPrefix = "WSLoginFilter.doFilter() , requestDebuggingActivated: " + requestDebuggingActivated + " , ";
+
+        logger.debug(logPrefix + "starting ... ");
+
+        HttpServletRequest requestToUse = (HttpServletRequest) request;
+        HttpServletResponse responseToUse = (HttpServletResponse) response;
+
+        String currentUserIPAddress = null;
+        if (requestToUse.getHeader("X-Forwarded-For") != null) {
+            currentUserIPAddress = requestToUse.getHeader("X-Forwarded-For");
+        } else {
+            logger.warn(logPrefix + "cannot find X-Forwarded-For header, this field is required for proper IP auditing");
+            logger.warn(logPrefix + "Because no X-Forwarded-For header was found, setting 'currentUserIPAddress = requestToUse.getRemoteAddr()' which is typically an internal address");
+            currentUserIPAddress = requestToUse.getRemoteAddr();
+        }
+
+        if (currentUserIPAddress == null || currentUserIPAddress.length() == 0 || "unknown".equalsIgnoreCase(currentUserIPAddress)) {
+            logger.warn(logPrefix + "cannot find valid currentUserIPAddress");
+        } else {
+            logger.warn(logPrefix + "IP validation and rate limiting can go here, on currentUserIPAddress: " + currentUserIPAddress);
+        }
+
+        if (requestDebuggingActivated == 1) {
+	    boolean foundElements = false;
+            for (Enumeration en = requestToUse.getParameterNames(); en
+                    .hasMoreElements();) {
+    
+                foundElements = true;
+
+                Object obj = en.nextElement();
+                String value = request.getParameterValues((String) obj)[0];
+                logger.warn(logPrefix + "on requestDebuggingActivated=1 found String: " +value);
+                    
+            }
+            if (!foundElements) {
+                logger.warn(logPrefix + "on requestDebuggingActivated=1 , no HTTP elements found!");
+            }
+        }
+
+        chain.doFilter(request, response);
+    }
+
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/WSSecUtils.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/WSSecUtils.java
new file mode 100644
index 0000000..2f5c98b
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/security/webservices/WSSecUtils.java
@@ -0,0 +1,83 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.security.webservices;
+
+import java.util.UUID;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.springframework.stereotype.Component;
+
+@Component
+public class WSSecUtils {
+
+    private static final Logger logger = LogManager.getLogger(WSSecUtils.class);
+    
+    protected JWTUserDTO getParsedUser(String token) throws Exception {
+        String logPrefix = "WSSecUtils.getParsedUser() , ";
+
+        // JWT and JWE are specifications to generate and validate tokens 
+        // securely, however they require a public / private key pair using
+        // elliptic curve cryptography and that is beyond the scope of this
+        // userguide.
+        // See below:
+        // https://datatracker.ietf.org/doc/html/rfc7516
+        // https://datatracker.ietf.org/doc/html/rfc7519
+
+        // token generated via RandomStringUtils.randomAlphanumeric(20);
+        // Do not use this for production code. 
+        if (token == null || token.length() != 20) {
+            throw new Exception("Invalid Token");
+        }
+        try {
+            // All of this info is available in the JWT spec
+            // however that is beyond the scope of this userguide
+            JWTUserDTO user = new JWTUserDTO();
+            user.setUsername("java-dev@axis.apache.org");
+            user.setRole("ROLE_USER");
+            // JWT ID that could be from the "Claimset" i.e.
+            // jwt.getJWTClaimsSet().getJWTID());
+            user.setUuid(UUID.randomUUID().toString());
+                       
+            return user;
+        
+        } catch (Exception ex) {
+            logger.error(logPrefix + "failed: " + ex.getMessage(), ex);
+            throw new JWTTokenMalformedException("unexpected error parsing token");
+        }
+        
+    }
+
+    public final LoginDTO findUserByEmail(String email) {
+
+        String logPrefix = "WSSecUtils.findUserByEmail() , " ;
+
+        if (email != null && email.equals("java-dev@axis.apache.org")) {
+            LoginDTO persistedUser = new LoginDTO("java-dev@axis.apache.org", "userguide", true, true, true, true);
+            return persistedUser;
+        }
+
+        logger.error(logPrefix + "Unknown email: " + email);
+
+        return null;
+
+    }
+
+}
diff --git a/modules/json/src/org/apache/axis2/json/gson/JsonHtmlXssSerializer.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/TestwsRequest.java
similarity index 61%
copy from modules/json/src/org/apache/axis2/json/gson/JsonHtmlXssSerializer.java
copy to modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/TestwsRequest.java
index 619c1ae..fbd1636 100644
--- a/modules/json/src/org/apache/axis2/json/gson/JsonHtmlXssSerializer.java
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/TestwsRequest.java
@@ -1,3 +1,4 @@
+
 /*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements. See the NOTICE file
@@ -16,24 +17,28 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+package userguide.springboot.webservices;
 
-package org.apache.axis2.json.gson;
+public class TestwsRequest {
+    
+    String messagein;
+    
+    public String getMessagein() {
+        return messagein;
+    }
 
-import org.owasp.encoder.Encode;
+    public void setMessagein(String messagein) {
+        this.messagein = messagein;
+    }
 
-import com.google.gson.JsonElement;
-import com.google.gson.JsonPrimitive;
-import com.google.gson.JsonSerializationContext;
-import com.google.gson.JsonSerializer;
-import java.lang.reflect.Type;
+    public TestwsRequest(String messagein) {
+        this.messagein = messagein;
+    }
 
-public class JsonHtmlXssSerializer implements JsonSerializer<String> {
-
-	@Override
-	public JsonElement serialize(String src, Type typeOfSrc,
-			JsonSerializationContext context) {
-
-		return new JsonPrimitive(Encode.forHtmlContent(src));
-
-	}
+    @Override
+    public String toString() {
+        return "TestwsRequest [messagein="
+                + messagein + "]";
+    }
+    
 }
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/TestwsResponse.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/TestwsResponse.java
new file mode 100644
index 0000000..dbd42d9
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/TestwsResponse.java
@@ -0,0 +1,56 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.webservices;
+
+public class TestwsResponse {
+
+    String messageout;
+    String status;
+    
+    public String getMessageout() {
+        return messageout;
+    }
+
+    public void setMessageout(String messageout) {
+        this.messageout = messageout;
+    }
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public TestwsResponse() {
+    }
+
+    public TestwsResponse(String messageout, String status) {
+        this.messageout = messageout;
+        this.status = status;
+    }
+
+    @Override
+    public String toString() {
+        return "TestwsResponse [messageout="
+                + messageout + " , status=" + status + "]";
+    }
+
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/TestwsService.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/TestwsService.java
new file mode 100644
index 0000000..7fd14c5
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/TestwsService.java
@@ -0,0 +1,71 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.webservices;
+
+import java.util.UUID;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import org.owasp.esapi.ESAPI;
+import org.owasp.esapi.Validator;
+
+import org.springframework.stereotype.Component;
+
+@Component
+public class TestwsService {
+
+    private static final Logger logger = LogManager.getLogger(TestwsService.class);
+
+    @SuppressWarnings({ "unchecked", "rawtypes" })
+    public TestwsResponse doTestws(TestwsRequest request) {
+
+        String uuid = UUID.randomUUID().toString();
+
+        String logPrefix = "TestwsService.doTestws() , uuid: " + uuid + " , ";
+
+        logger.warn(logPrefix + "starting on request: " + request.toString());
+        TestwsResponse response = new TestwsResponse();
+
+        try {
+            // All data is evil!
+            Validator validator = ESAPI.validator();
+            boolean messageinstatus = validator.isValidInput("userInput", request.getMessagein(), "SafeString", 100 , false);
+            if (!messageinstatus) {
+                logger.error(logPrefix + "returning with failure status on invalid messagein: " + request.getMessagein());
+                response.setStatus("FAILED");
+                return response;
+            }
+            response.setStatus("OK");
+            String evil = "<script xmlns=\"http://www.w3.org/1999/xhtml\">alert('Hello');</script> \">";
+            response.setMessageout(evil);
+            
+            logger.warn(logPrefix + "returning response: " + response.toString());
+            return response;
+
+        } catch (Exception ex) {
+            logger.error(logPrefix + "failed: " + ex.getMessage(), ex);
+            response.setStatus("FAILED");
+            return response;
+        }
+
+    }
+
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/secure/LoginRequest.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/secure/LoginRequest.java
new file mode 100644
index 0000000..1e6d5bb
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/secure/LoginRequest.java
@@ -0,0 +1,55 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.webservices.secure;
+
+public class LoginRequest {
+    
+    String email;
+    
+    String credentials;
+
+    public String getEmail() {
+        return  email != null ? email.trim() : null;
+    }
+
+    public void setEmail(String email) {
+        this.email = email;
+    }
+
+    public String getCredentials() {
+        return credentials;
+    }
+
+    public void setCredentials(String credentials) {
+        this.credentials = credentials;
+    }
+
+
+    public LoginRequest(String email, String credentials) {
+        this.email = email;
+        this.credentials = credentials;
+    }
+    
+    @Override
+    public String toString() {
+	// implement toString() for debugging in trace mode of axis2
+        return "LoginRequest [email=" + email + ", credentials=not_shown ]";
+    }
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/secure/LoginResponse.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/secure/LoginResponse.java
new file mode 100644
index 0000000..c140b5d
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/secure/LoginResponse.java
@@ -0,0 +1,63 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.webservices.secure;
+
+public class LoginResponse {
+
+    String status;
+    
+    String token;
+    
+    String uuid;
+    
+    public String getUuid() {
+        return uuid;
+    }
+
+    public void setUuid(String uuid) {
+        this.uuid = uuid;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public String getToken() {
+        return token;
+    }
+
+    public void setToken(String token) {
+        this.token = token;
+    }
+
+    public LoginResponse(String status, String token) {
+        this.status = status;
+        this.token = token;
+    }
+    
+    public LoginResponse() {
+        
+    }
+
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/secure/LoginService.java b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/secure/LoginService.java
new file mode 100644
index 0000000..7bddf44
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/java/userguide/springboot/webservices/secure/LoginService.java
@@ -0,0 +1,238 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package userguide.springboot.webservices.secure;
+
+import java.util.UUID;
+import java.math.BigDecimal;
+import java.time.LocalDateTime;
+import java.time.ZoneId;
+
+import org.apache.commons.lang3.RandomStringUtils; 
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.crypto.password.NoOpPasswordEncoder;
+
+import userguide.springboot.security.webservices.WSSecUtils;
+import userguide.springboot.security.webservices.LoginDTO;
+import userguide.springboot.security.webservices.RequestAndResponseValidatorFilter;
+import userguide.springboot.hibernate.dao.SpringSecurityDAOImpl;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.apache.axis2.context.MessageContext;
+import org.apache.axis2.transport.http.HTTPConstants;
+import org.apache.commons.lang.StringEscapeUtils;
+import org.owasp.esapi.ESAPI;
+import org.owasp.esapi.Validator;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+@Component
+public class LoginService {
+
+    private static final Logger logger = LogManager.getLogger(LoginService.class);
+
+    @Autowired
+    SpringSecurityDAOImpl springSecurityDAOImpl;
+
+    @Autowired
+    NoOpPasswordEncoder passwordEncoder;
+
+    @Autowired
+    private WSSecUtils wssecutils;
+
+    @SuppressWarnings({ "unchecked", "rawtypes" })
+    public LoginResponse doLogin(LoginRequest request) {
+
+        Long startTime = System.currentTimeMillis();
+
+        String uuid = UUID.randomUUID().toString();
+
+        String logPrefix = "LoginService.doLogin() , "
+                + " , uuid: " + uuid + " , request: " + request.toString() + " , ";
+
+        logger.warn(logPrefix + "starting ... ");
+        LoginResponse response = new LoginResponse();
+
+        try {
+            if (request == null) {
+                logger.error(logPrefix + "returning with failure status on null LoginRequest");
+                response.setStatus("FAILED");
+                return response;
+            }
+            if (request.getEmail() == null) {
+                logger.error(logPrefix + "returning with failure status on null email");
+                response.setStatus("FAILED");
+                return response;
+            }
+            request.email = request.email.trim();
+
+            MessageContext ctx = MessageContext.getCurrentMessageContext();
+            HttpServletRequest httpServletRequest = (HttpServletRequest) ctx.getProperty(HTTPConstants.MC_HTTP_SERVLETREQUEST);
+            if (httpServletRequest == null) {
+                logger.error(logPrefix + "returning with failure status on null httpServletRequest");
+                response.setStatus("FAILED");
+                return response;
+            }
+            String currentUserIPAddress = null;
+
+            if (httpServletRequest.getHeader("X-Forwarded-For") != null) {
+                currentUserIPAddress = httpServletRequest.getHeader("X-Forwarded-For");
+            } else {
+                logger.warn(logPrefix + "cannot find X-Forwarded-For header, this field is required for proper IP auditing");
+                currentUserIPAddress = httpServletRequest.getRemoteAddr();
+                logger.warn(logPrefix + "found currentUserIPAddress from httpServletRequest.getRemoteAddr() :" + currentUserIPAddress);
+            }
+            // All data is evil!
+            Validator validator = ESAPI.validator();
+
+            String email = request.getEmail().trim();
+            boolean emailstatus = validator.isValidInput("userInput", email, "Email", 100 , false);
+            if (!emailstatus) {
+                logger.error(logPrefix + "returning with failure status on invalid email (in quotes): '" + email +  "'");
+                response.setStatus("FAILED");
+                return response;
+            }
+
+            String creds = "";
+            // handle unicode escaped chars that were sent that way for '@' etc
+            if (request.getCredentials().contains("u00")) {
+                String uu = request.getCredentials();
+                String uut = uu.replaceAll("u00", "\\\\u00");
+                creds = StringEscapeUtils.unescapeJava(uut); 
+            } else {
+                creds = request.getCredentials(); 
+                if (logger.isTraceEnabled()) { 
+                   logger.trace(logPrefix + "found creds: " +creds); 
+                }
+            }
+            // passwords require special char's ... just do some minimal validation
+            boolean credentialsstatus = RequestAndResponseValidatorFilter.validate(creds);
+            if (!credentialsstatus || creds.length() > 100) {
+                logger.error(logPrefix + "returning with failure status, credentials failed validation, credentialsstatus: " + credentialsstatus + " , length: " + creds.length());
+                response.setStatus("FAILED");
+
+                return response;
+            }
+
+            LoginDTO loginDTO = null;
+            try {
+                loginDTO = wssecutils.findUserByEmail(email);
+            } catch (Exception ex) {
+                logger.error(logPrefix + "cannot create LoginDTO from email: " + email + " , " + ex.getMessage(), ex);
+                response.setStatus("FAILED");
+                return response;
+            }
+
+            if (loginDTO == null) {
+                logger.error(logPrefix + "returning with failure status on failed creation of LoginDTO from email: " + email);
+                response.setStatus("FAILED");
+                return response;
+            }
+
+            logger.warn(logPrefix + "found loginDTO: " + loginDTO.toString());
+
+            response.setUuid(uuid);
+            UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(email, creds);
+
+            logger.warn(logPrefix
+                    + "calling authenticate(authRequest) with username: " + email);
+
+            boolean hasFailedLogin = false;
+            String failedStr = "";
+            try {
+                // will throw an Exception if it fails
+                DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
+                daoAuthenticationProvider.setUserDetailsService(springSecurityDAOImpl);
+                daoAuthenticationProvider.setPasswordEncoder(passwordEncoder);
+                Authentication authResult = daoAuthenticationProvider.authenticate(authRequest);
+                logger.warn(logPrefix + "authenticate(authRequest) completed successfully with username: " + email);
+            } catch (Exception ex) {
+                if (ex.getMessage() == null) {
+                    failedStr = "Authentication Exception failed state is undefined";
+                } else {
+                    failedStr = ex.getMessage();
+                }
+                logger.error(logPrefix + "failed: " + failedStr, ex);
+                hasFailedLogin = true;
+            }
+
+            if (hasFailedLogin) {
+                logger.error(logPrefix + "returning with failure status on failed login");
+                response.setStatus("LOGIN FAILED");
+                return response;
+            }
+
+
+            if (!generateTokenForReturn(httpServletRequest, request, response, currentUserIPAddress, email, uuid)) {
+                logger.warn(logPrefix + "generateTokenForReturn() failed, goodbye");
+                response.setStatus("TOKEN GENERION FAILED");
+            }
+
+            return response;
+
+        } catch (Exception ex) {
+            logger.error(logPrefix + "failed: " + ex.getMessage(), ex);
+            response.setStatus("FAILED");
+            return response;
+        }
+
+    }
+
+    @SuppressWarnings({ "unchecked", "rawtypes" })
+    private boolean generateTokenForReturn(HttpServletRequest httpServletRequest, LoginRequest request, LoginResponse response, String currentUserIPAddress, String email, String uuid) {
+
+        String logPrefix = "LoginService.generateTokenForReturn() , "
+                + " , uuid: " + uuid + " , ";
+
+        try {
+            String token = null;
+            
+            // JWT and JWE are specifications to generate and validate tokens 
+            // securely, however they require a public / private key pair using
+            // elliptic curve cryptography and that is beyond the scope of this
+            // userguide.
+            // See below:
+            // https://datatracker.ietf.org/doc/html/rfc7516
+            // https://datatracker.ietf.org/doc/html/rfc7519
+
+            // this is an example only for demo purposes - do not use this for 
+            // production code
+            token = RandomStringUtils.randomAlphanumeric(20);
+
+            response.setStatus("OK");
+            response.setToken(token);
+            
+            return true;
+
+        } catch (Exception ex) {
+            logger.error(logPrefix + "failed: " + ex.getMessage(), ex);
+            response.setStatus("FAILED");
+            return false;
+        }
+
+    }
+
+
+}
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/resources/ESAPI.properties b/modules/samples/userguide/src/userguide/springbootdemo/src/main/resources/ESAPI.properties
new file mode 100644
index 0000000..710a84e
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/resources/ESAPI.properties
@@ -0,0 +1,461 @@
+#
+# OWASP Enterprise Security API (ESAPI) Properties file -- PRODUCTION Version
+# 
+# This file is part of the Open Web Application Security Project (OWASP)
+# Enterprise Security API (ESAPI) project. For details, please see
+# http://www.owasp.org/index.php/ESAPI.
+#
+# Copyright (c) 2008,2009 - The OWASP Foundation
+#
+# DISCUSS: This may cause a major backwards compatibility issue, etc. but
+#		   from a name space perspective, we probably should have prefaced
+#		   all the property names with ESAPI or at least OWASP. Otherwise
+#		   there could be problems is someone loads this properties file into
+#		   the System properties.  We could also put this file into the
+#		   esapi.jar file (perhaps as a ResourceBundle) and then allow an external
+#		   ESAPI properties be defined that would overwrite these defaults.
+#		   That keeps the application's properties relatively simple as usually
+#		   they will only want to override a few properties. If looks like we
+#		   already support multiple override levels of this in the
+#		   DefaultSecurityConfiguration class, but I'm suggesting placing the
+#		   defaults in the esapi.jar itself. That way, if the jar is signed,
+#		   we could detect if those properties had been tampered with. (The
+#		   code to check the jar signatures is pretty simple... maybe 70-90 LOC,
+#		   but off course there is an execution penalty (similar to the way
+#		   that the separate sunjce.jar used to be when a class from it was
+#		   first loaded). Thoughts?
+###############################################################################
+#
+# WARNING: Operating system protection should be used to lock down the .esapi
+# resources directory and all the files inside and all the directories all the
+# way up to the root directory of the file system.  Note that if you are using
+# file-based implementations, that some files may need to be read-write as they
+# get updated dynamically.
+#
+# Before using, be sure to update the MasterKey and MasterSalt as described below.
+# N.B.: If you had stored data that you have previously encrypted with ESAPI 1.4,
+#		you *must* FIRST decrypt it using ESAPI 1.4 and then (if so desired)
+#		re-encrypt it with ESAPI 2.0. If you fail to do this, you will NOT be
+#		able to decrypt your data with ESAPI 2.0.
+#
+#		YOU HAVE BEEN WARNED!!! More details are in the ESAPI 2.0 Release Notes.
+#
+#===========================================================================
+# ESAPI Configuration
+#
+# If true, then print all the ESAPI properties set here when they are loaded.
+# If false, they are not printed. Useful to reduce output when running JUnit tests.
+# If you need to troubleshoot a properties related problem, turning this on may help.
+# This is 'false' in the src/test/resources/.esapi version. It is 'true' by
+# default for reasons of backward compatibility with earlier ESAPI versions.
+ESAPI.printProperties=true
+
+# ESAPI is designed to be easily extensible. You can use the reference implementation
+# or implement your own providers to take advantage of your enterprise's security
+# infrastructure. The functions in ESAPI are referenced using the ESAPI locator, like:
+#
+#    String ciphertext =
+#		ESAPI.encryptor().encrypt("Secret message");   // Deprecated in 2.0
+#    CipherText cipherText =
+#		ESAPI.encryptor().encrypt(new PlainText("Secret message")); // Preferred
+#
+# Below you can specify the classname for the provider that you wish to use in your
+# application. The only requirement is that it implement the appropriate ESAPI interface.
+# This allows you to switch security implementations in the future without rewriting the
+# entire application.
+#
+# ExperimentalAccessController requires ESAPI-AccessControlPolicy.xml in .esapi directory
+ESAPI.AccessControl=org.owasp.esapi.reference.DefaultAccessController
+# FileBasedAuthenticator requires users.txt file in .esapi directory
+ESAPI.Authenticator=org.owasp.esapi.reference.FileBasedAuthenticator
+ESAPI.Encoder=org.owasp.esapi.reference.DefaultEncoder
+ESAPI.Encryptor=org.owasp.esapi.reference.crypto.JavaEncryptor
+
+ESAPI.Executor=org.owasp.esapi.reference.DefaultExecutor
+ESAPI.HTTPUtilities=org.owasp.esapi.reference.DefaultHTTPUtilities
+ESAPI.IntrusionDetector=org.owasp.esapi.reference.DefaultIntrusionDetector
+ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory
+
+ESAPI.Randomizer=org.owasp.esapi.reference.DefaultRandomizer
+ESAPI.Validator=org.owasp.esapi.reference.DefaultValidator
+
+#===========================================================================
+# ESAPI Authenticator
+#
+Authenticator.AllowedLoginAttempts=3
+Authenticator.MaxOldPasswordHashes=13
+Authenticator.UsernameParameterName=username
+Authenticator.PasswordParameterName=password
+# RememberTokenDuration (in days)
+Authenticator.RememberTokenDuration=14
+# Session Timeouts (in minutes)
+Authenticator.IdleTimeoutDuration=20
+Authenticator.AbsoluteTimeoutDuration=120
+
+#===========================================================================
+# ESAPI Encoder
+#
+# ESAPI canonicalizes input before validation to prevent bypassing filters with encoded attacks.
+# Failure to canonicalize input is a very common mistake when implementing validation schemes.
+# Canonicalization is automatic when using the ESAPI Validator, but you can also use the
+# following code to canonicalize data.
+#
+#      ESAPI.Encoder().canonicalize( "%22hello world&#x22;" );
+#  
+# Multiple encoding is when a single encoding format is applied multiple times. Allowing
+# multiple encoding is strongly discouraged.
+Encoder.AllowMultipleEncoding=false
+
+# Mixed encoding is when multiple different encoding formats are applied, or when 
+# multiple formats are nested. Allowing multiple encoding is strongly discouraged.
+Encoder.AllowMixedEncoding=false
+
+# The default list of codecs to apply when canonicalizing untrusted data. The list should include the codecs
+# for all downstream interpreters or decoders. For example, if the data is likely to end up in a URL, HTML, or
+# inside JavaScript, then the list of codecs below is appropriate. The order of the list is not terribly important.
+Encoder.DefaultCodecList=HTMLEntityCodec,PercentCodec,JavaScriptCodec
+
+
+#===========================================================================
+# ESAPI Encryption
+#
+# The ESAPI Encryptor provides basic cryptographic functions with a simplified API.
+# To get started, generate a new key using java -classpath esapi.jar org.owasp.esapi.reference.crypto.JavaEncryptor
+# There is not currently any support for key rotation, so be careful when changing your key and salt as it
+# will invalidate all signed, encrypted, and hashed data.
+#
+# WARNING: Not all combinations of algorithms and key lengths are supported.
+# If you choose to use a key length greater than 128, you MUST download the
+# unlimited strength policy files and install in the lib directory of your JRE/JDK.
+# See http://java.sun.com/javase/downloads/index.jsp for more information.
+#
+# Backward compatibility with ESAPI Java 1.4 is supported by the two deprecated API
+# methods, Encryptor.encrypt(String) and Encryptor.decrypt(String). However, whenever
+# possible, these methods should be avoided as they use ECB cipher mode, which in almost
+# all circumstances a poor choice because of it's weakness. CBC cipher mode is the default
+# for the new Encryptor encrypt / decrypt methods for ESAPI Java 2.0.  In general, you
+# should only use this compatibility setting if you have persistent data encrypted with
+# version 1.4 and even then, you should ONLY set this compatibility mode UNTIL
+# you have decrypted all of your old encrypted data and then re-encrypted it with
+# ESAPI 2.0 using CBC mode. If you have some reason to mix the deprecated 1.4 mode
+# with the new 2.0 methods, make sure that you use the same cipher algorithm for both
+# (256-bit AES was the default for 1.4; 128-bit is the default for 2.0; see below for
+# more details.) Otherwise, you will have to use the new 2.0 encrypt / decrypt methods
+# where you can specify a SecretKey. (Note that if you are using the 256-bit AES,
+# that requires downloading the special jurisdiction policy files mentioned above.)
+#
+#		***** IMPORTANT: Do NOT forget to replace these with your own values! *****
+# To calculate these values, you can run:
+#		java -classpath esapi.jar org.owasp.esapi.reference.crypto.JavaEncryptor
+#
+#Encryptor.MasterKey=
+#Encryptor.MasterSalt=
+
+# Provides the default JCE provider that ESAPI will "prefer" for its symmetric
+# encryption and hashing. (That is it will look to this provider first, but it
+# will defer to other providers if the requested algorithm is not implemented
+# by this provider.) If left unset, ESAPI will just use your Java VM's current
+# preferred JCE provider, which is generally set in the file
+# "$JAVA_HOME/jre/lib/security/java.security".
+#
+# The main intent of this is to allow ESAPI symmetric encryption to be
+# used with a FIPS 140-2 compliant crypto-module. For details, see the section
+# "Using ESAPI Symmetric Encryption with FIPS 140-2 Cryptographic Modules" in
+# the ESAPI 2.0 Symmetric Encryption User Guide, at:
+# http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/esapi4java-core-2.0-symmetric-crypto-user-guide.html
+# However, this property also allows you to easily use an alternate JCE provider
+# such as "Bouncy Castle" without having to make changes to "java.security".
+# See Javadoc for SecurityProviderLoader for further details. If you wish to use
+# a provider that is not known to SecurityProviderLoader, you may specify the
+# fully-qualified class name of the JCE provider class that implements
+# java.security.Provider. If the name contains a '.', this is interpreted as
+# a fully-qualified class name that implements java.security.Provider.
+#
+# NOTE: Setting this property has the side-effect of changing it in your application
+#       as well, so if you are using JCE in your application directly rather than
+#       through ESAPI (you wouldn't do that, would you? ;-), it will change the
+#       preferred JCE provider there as well.
+#
+# Default: Keeps the JCE provider set to whatever JVM sets it to.
+Encryptor.PreferredJCEProvider=
+
+# AES is the most widely used and strongest encryption algorithm. This
+# should agree with your Encryptor.CipherTransformation property.
+# By default, ESAPI Java 1.4 uses "PBEWithMD5AndDES" and which is
+# very weak. It is essentially a password-based encryption key, hashed
+# with MD5 around 1K times and then encrypted with the weak DES algorithm
+# (56-bits) using ECB mode and an unspecified padding (it is
+# JCE provider specific, but most likely "NoPadding"). However, 2.0 uses
+# "AES/CBC/PKCSPadding". If you want to change these, change them here.
+# Warning: This property does not control the default reference implementation for
+#		   ESAPI 2.0 using JavaEncryptor. Also, this property will be dropped
+#		   in the future.
+# @deprecated
+Encryptor.EncryptionAlgorithm=AES
+#		For ESAPI Java 2.0 - New encrypt / decrypt methods use this.
+Encryptor.CipherTransformation=AES/CBC/PKCS5Padding
+
+# Applies to ESAPI 2.0 and later only!
+# Comma-separated list of cipher modes that provide *BOTH*
+# confidentiality *AND* message authenticity. (NIST refers to such cipher
+# modes as "combined modes" so that's what we shall call them.) If any of these
+# cipher modes are used then no MAC is calculated and stored
+# in the CipherText upon encryption. Likewise, if one of these
+# cipher modes is used with decryption, no attempt will be made
+# to validate the MAC contained in the CipherText object regardless
+# of whether it contains one or not. Since the expectation is that
+# these cipher modes support support message authenticity already,
+# injecting a MAC in the CipherText object would be at best redundant.
+#
+# Note that as of JDK 1.5, the SunJCE provider does not support *any*
+# of these cipher modes. Of these listed, only GCM and CCM are currently
+# NIST approved. YMMV for other JCE providers. E.g., Bouncy Castle supports
+# GCM and CCM with "NoPadding" mode, but not with "PKCS5Padding" or other
+# padding modes.
+Encryptor.cipher_modes.combined_modes=GCM,CCM,IAPM,EAX,OCB,CWC
+
+# Applies to ESAPI 2.0 and later only!
+# Additional cipher modes allowed for ESAPI 2.0 encryption. These
+# cipher modes are in _addition_ to those specified by the property
+# 'Encryptor.cipher_modes.combined_modes'.
+# Note: We will add support for streaming modes like CFB & OFB once
+# we add support for 'specified' to the property 'Encryptor.ChooseIVMethod'
+# (probably in ESAPI 2.1).
+# DISCUSS: Better name?
+Encryptor.cipher_modes.additional_allowed=CBC
+
+# 128-bit is almost always sufficient and appears to be more resistant to
+# related key attacks than is 256-bit AES. Use '_' to use default key size
+# for cipher algorithms (where it makes sense because the algorithm supports
+# a variable key size). Key length must agree to what's provided as the
+# cipher transformation, otherwise this will be ignored after logging a
+# warning.
+#
+# NOTE: This is what applies BOTH ESAPI 1.4 and 2.0. See warning above about mixing!
+Encryptor.EncryptionKeyLength=128
+
+# Because 2.0 uses CBC mode by default, it requires an initialization vector (IV).
+# (All cipher modes except ECB require an IV.) There are two choices: we can either
+# use a fixed IV known to both parties or allow ESAPI to choose a random IV. While
+# the IV does not need to be hidden from adversaries, it is important that the
+# adversary not be allowed to choose it. Also, random IVs are generally much more
+# secure than fixed IVs. (In fact, it is essential that feed-back cipher modes
+# such as CFB and OFB use a different IV for each encryption with a given key so
+# in such cases, random IVs are much preferred. By default, ESAPI 2.0 uses random
+# IVs. If you wish to use 'fixed' IVs, set 'Encryptor.ChooseIVMethod=fixed' and
+# uncomment the Encryptor.fixedIV.
+#
+# Valid values:		random|fixed|specified		'specified' not yet implemented; planned for 2.1
+Encryptor.ChooseIVMethod=random
+# If you choose to use a fixed IV, then you must place a fixed IV here that
+# is known to all others who are sharing your secret key. The format should
+# be a hex string that is the same length as the cipher block size for the
+# cipher algorithm that you are using. The following is an *example* for AES
+# from an AES test vector for AES-128/CBC as described in:
+# NIST Special Publication 800-38A (2001 Edition)
+# "Recommendation for Block Cipher Modes of Operation".
+# (Note that the block size for AES is 16 bytes == 128 bits.)
+#
+Encryptor.fixedIV=0x000102030405060708090a0b0c0d0e0f
+
+# Whether or not CipherText should use a message authentication code (MAC) with it.
+# This prevents an adversary from altering the IV as well as allowing a more
+# fool-proof way of determining the decryption failed because of an incorrect
+# key being supplied. This refers to the "separate" MAC calculated and stored
+# in CipherText, not part of any MAC that is calculated as a result of a
+# "combined mode" cipher mode.
+#
+# If you are using ESAPI with a FIPS 140-2 cryptographic module, you *must* also
+# set this property to false.
+Encryptor.CipherText.useMAC=true
+
+# Whether or not the PlainText object may be overwritten and then marked
+# eligible for garbage collection. If not set, this is still treated as 'true'.
+Encryptor.PlainText.overwrite=true
+
+# Do not use DES except in a legacy situations. 56-bit is way too small key size.
+#Encryptor.EncryptionKeyLength=56
+#Encryptor.EncryptionAlgorithm=DES
+
+# TripleDES is considered strong enough for most purposes.
+#	Note:	There is also a 112-bit version of DESede. Using the 168-bit version
+#			requires downloading the special jurisdiction policy from Sun.
+#Encryptor.EncryptionKeyLength=168
+#Encryptor.EncryptionAlgorithm=DESede
+
+Encryptor.HashAlgorithm=SHA-512
+Encryptor.HashIterations=1024
+Encryptor.DigitalSignatureAlgorithm=SHA1withDSA
+Encryptor.DigitalSignatureKeyLength=1024
+Encryptor.RandomAlgorithm=SHA1PRNG
+Encryptor.CharacterEncoding=UTF-8
+
+# This is the Pseudo Random Function (PRF) that ESAPI's Key Derivation Function
+# (KDF) normally uses. Note this is *only* the PRF used for ESAPI's KDF and
+# *not* what is used for ESAPI's MAC. (Currently, HmacSHA1 is always used for
+# the MAC, mostly to keep the overall size at a minimum.)
+#
+# Currently supported choices for JDK 1.5 and 1.6 are:
+#	HmacSHA1 (160 bits), HmacSHA256 (256 bits), HmacSHA384 (384 bits), and
+#	HmacSHA512 (512 bits).
+# Note that HmacMD5 is *not* supported for the PRF used by the KDF even though
+# the JDKs support it.  See the ESAPI 2.0 Symmetric Encryption User Guide
+# further details.
+Encryptor.KDF.PRF=HmacSHA256
+#===========================================================================
+# ESAPI HttpUtilties
+#
+# The HttpUtilities provide basic protections to HTTP requests and responses. Primarily these methods 
+# protect against malicious data from attackers, such as unprintable characters, escaped characters,
+# and other simple attacks. The HttpUtilities also provides utility methods for dealing with cookies,
+# headers, and CSRF tokens.
+#
+# Default file upload location (remember to escape backslashes with \\)
+# HttpUtilities.UploadDir=C:\\ESAPI\\testUpload
+# HttpUtilities.UploadTempDir=C:\\temp
+# Force flags on cookies, if you use HttpUtilities to set cookies
+HttpUtilities.ForceHttpOnlySession=false
+HttpUtilities.ForceSecureSession=false
+HttpUtilities.ForceHttpOnlyCookies=true
+HttpUtilities.ForceSecureCookies=true
+# Maximum size of HTTP headers
+HttpUtilities.MaxHeaderSize=4096
+# File upload configuration
+HttpUtilities.ApprovedUploadExtensions=.zip,.pdf,.doc,.docx,.ppt,.pptx,.tar,.gz,.tgz,.rar,.war,.jar,.ear,.xls,.rtf,.properties,.java,.class,.txt,.xml,.jsp,.jsf,.exe,.dll
+HttpUtilities.MaxUploadFileBytes=500000000
+# Using UTF-8 throughout your stack is highly recommended. That includes your database driver,
+# container, and any other technologies you may be using. Failure to do this may expose you
+# to Unicode transcoding injection attacks. Use of UTF-8 does not hinder internationalization.
+HttpUtilities.ResponseContentType=text/html; charset=UTF-8
+# This is the name of the cookie used to represent the HTTP session
+# Typically this will be the default "JSESSIONID" 
+HttpUtilities.HttpSessionIdName=JSESSIONID
+
+
+
+#===========================================================================
+# ESAPI Executor
+# CHECKME - This should be made OS independent. Don't use unsafe defaults.
+# # Examples only -- do NOT blindly copy!
+#   For Windows:
+#     Executor.WorkingDirectory=C:\\Windows\\Temp
+#     Executor.ApprovedExecutables=C:\\Windows\\System32\\cmd.exe,C:\\Windows\\System32\\runas.exe
+#   For *nux, MacOS:
+#     Executor.WorkingDirectory=/tmp
+#     Executor.ApprovedExecutables=/bin/bash
+Executor.WorkingDirectory=
+Executor.ApprovedExecutables=
+
+
+#===========================================================================
+# ESAPI Logging
+# Set the application name if these logs are combined with other applications
+Logger.ApplicationName=DPT
+# If you use an HTML log viewer that does not properly HTML escape log data, you can set LogEncodingRequired to true
+Logger.LogEncodingRequired=false
+# Determines whether ESAPI should log the application name. This might be clutter in some single-server/single-app environments.
+Logger.LogApplicationName=true
+# Determines whether ESAPI should log the server IP and port. This might be clutter in some single-server environments.
+Logger.LogServerIP=true
+# Determines whether ESAPI should log the user info.
+Logger.UserInfo=true
+# Determines whether ESAPI should log the session id and client IP.
+Logger.ClientInfo=true
+
+
+#===========================================================================
+# ESAPI Intrusion Detection
+#
+# Each event has a base to which .count, .interval, and .action are added
+# The IntrusionException will fire if we receive "count" events within "interval" seconds
+# The IntrusionDetector is configurable to take the following actions: log, logout, and disable
+#  (multiple actions separated by commas are allowed e.g. event.test.actions=log,disable
+#
+# Custom Events
+# Names must start with "event." as the base
+# Use IntrusionDetector.addEvent( "test" ) in your code to trigger "event.test" here
+# You can also disable intrusion detection completely by changing
+# the following parameter to true
+#
+IntrusionDetector.Disable=false
+#
+IntrusionDetector.event.test.count=2
+IntrusionDetector.event.test.interval=10
+IntrusionDetector.event.test.actions=disable,log
+
+# Exception Events
+# All EnterpriseSecurityExceptions are registered automatically
+# Call IntrusionDetector.getInstance().addException(e) for Exceptions that do not extend EnterpriseSecurityException
+# Use the fully qualified classname of the exception as the base
+
+# any intrusion is an attack
+IntrusionDetector.org.owasp.esapi.errors.IntrusionException.count=1
+IntrusionDetector.org.owasp.esapi.errors.IntrusionException.interval=1
+IntrusionDetector.org.owasp.esapi.errors.IntrusionException.actions=log,disable,logout
+
+# for test purposes
+# CHECKME: Shouldn't there be something in the property name itself that designates
+#		   that these are for testing???
+IntrusionDetector.org.owasp.esapi.errors.IntegrityException.count=10
+IntrusionDetector.org.owasp.esapi.errors.IntegrityException.interval=5
+IntrusionDetector.org.owasp.esapi.errors.IntegrityException.actions=log,disable,logout
+
+# rapid validation errors indicate scans or attacks in progress
+# org.owasp.esapi.errors.ValidationException.count=10
+# org.owasp.esapi.errors.ValidationException.interval=10
+# org.owasp.esapi.errors.ValidationException.actions=log,logout
+
+# sessions jumping between hosts indicates session hijacking
+IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.count=2
+IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.interval=10
+IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.actions=log,logout
+
+
+#===========================================================================
+# ESAPI Validation
+#
+# The ESAPI Validator works on regular expressions with defined names. You can define names
+# either here, or you may define application specific patterns in a separate file defined below.
+# This allows enterprises to specify both organizational standards as well as application specific
+# validation rules.
+#
+Validator.ConfigurationFile=validation.properties
+
+# Validators used by ESAPI
+Validator.AccountName=^[a-zA-Z0-9]{3,20}$
+Validator.SystemCommand=^[a-zA-Z\\-\\/]{1,64}$
+Validator.RoleName=^[a-z]{1,20}$
+
+#the word TEST below should be changed to your application 
+#name - only relative URL's are supported
+Validator.Redirect=^\\/test.*$
+
+# Global HTTP Validation Rules
+# Values with Base64 encoded data (e.g. encrypted state) will need at least [a-zA-Z0-9\/+=]
+Validator.HTTPScheme=^(http|https)$
+Validator.HTTPServerName=^[a-zA-Z0-9_.\\-]*$
+Validator.HTTPParameterName=^[a-zA-Z0-9_]{1,32}$
+Validator.HTTPParameterValue=^[a-zA-Z0-9.\\-\\/+=@_,:\\\\ ]*$
+Validator.HTTPParameterTransactionValue=^[a-zA-Z0-9.\\-\\/+=@_<>:\\"\\-, ]*$
+Validator.HTTPCookieName=^[a-zA-Z0-9\\-_]{1,32}$
+Validator.HTTPCookieValue=^[a-zA-Z0-9\\-\\/+=_ ]*$
+Validator.HTTPHeaderName=^[a-zA-Z0-9\\-_]{1,32}$
+Validator.HTTPHeaderValue=^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:&_ ]*$
+Validator.HTTPContextPath=^\\/?[a-zA-Z0-9.\\-\\/_]*$
+Validator.HTTPServletPath=^[a-zA-Z0-9.\\-\\/_]*$
+Validator.HTTPPath=^[a-zA-Z0-9.\\-_]*$
+Validator.HTTPQueryString=^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:&_ %]*$
+Validator.HTTPURI=^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:&_ ]*$
+Validator.HTTPURL=^.*$
+Validator.HTTPJSESSIONID=^[A-Z0-9]{10,30}$
+Validator.SafeString=^[.\\p{Alnum}\\p{Space}]{0,1024}$
+Validator.Email=^[A-Za-z0-9._%'\\-+]+@[A-Za-z0-9.-]+\\.[a-zA-Z]{2,4}$
+Validator.IPAddress=^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
+
+# Validation of file related input
+Validator.FileName=^[a-zA-Z0-9!@#$%^&{}\\[\\]()_+\\-=,.~'` ]{1,255}$
+Validator.DirectoryName=^[a-zA-Z0-9:/\\\\!@#$%^&{}\\[\\]()_+\\-=,.~'` ]{1,255}$
+
+# Validation of dates. Controls whether or not 'lenient' dates are accepted.
+# See DataFormat.setLenient(boolean flag) for further details.
+Validator.AcceptLenientDates=false
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/resources/application.properties b/modules/samples/userguide/src/userguide/springbootdemo/src/main/resources/application.properties
new file mode 100644
index 0000000..b59217d
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/resources/application.properties
@@ -0,0 +1,2 @@
+requestDebuggingActivated=1
+spring.main.allow-bean-definition-overriding=true
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/resources/esapi-java-logging.properties b/modules/samples/userguide/src/userguide/springbootdemo/src/main/resources/esapi-java-logging.properties
new file mode 100644
index 0000000..c5f619b
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/resources/esapi-java-logging.properties
@@ -0,0 +1,6 @@
+handlers= java.util.logging.ConsoleHandler
+.level= INFO
+java.util.logging.ConsoleHandler.level = INFO
+java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
+java.util.logging.SimpleFormatter.format=[%1$tF %1$tT] [%3$-7s] %5$s %n
+#https://www.logicbig.com/tutorials/core-java-tutorial/logging/customizing-default-format.html
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/resources/log4j2.xml b/modules/samples/userguide/src/userguide/springbootdemo/src/main/resources/log4j2.xml
new file mode 100644
index 0000000..fe37cbd
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/resources/log4j2.xml
@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Configuration status="warn" name="MyApp" packages="">
+    <Appenders>
+        <Console name="Console" target="SYSTEM_OUT">
+            <PatternLayout pattern="%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n"/>
+        </Console>
+        <RollingFile name="RollingFile" fileName="axis2-json-api.log"
+                     filePattern="axis2-json-api-%d{MM-dd-yyyy}-%i.log">
+            <PatternLayout>
+                <Pattern>%d %p %c{1.} [%t] %m%n</Pattern>
+            </PatternLayout>
+            <Policies>
+                <TimeBasedTriggeringPolicy />
+                <SizeBasedTriggeringPolicy size="20 MB"/>
+            </Policies>
+            <DefaultRolloverStrategy max="20"/>
+        </RollingFile>
+    </Appenders>
+    <Loggers>
+        <Logger name="userguide.springboot" level="debug" additivity="false" >
+            <AppenderRef ref="RollingFile"/>
+            <AppenderRef ref="Console"/>
+        </Logger>
+        <Logger name="org.apache" level="warn" additivity="false" >
+            <AppenderRef ref="RollingFile"/>
+            <AppenderRef ref="Console"/>
+        </Logger>
+        <Logger name="org.apache.axis2" level="warn" additivity="false" >
+            <AppenderRef ref="RollingFile"/>
+            <AppenderRef ref="Console"/>
+        </Logger>
+        <Logger name="org.springframework" level="warn" additivity="false" >
+            <AppenderRef ref="RollingFile"/>
+            <AppenderRef ref="Console"/>
+        </Logger>
+        <Root level="debug">
+            <AppenderRef ref="RollingFile"/>
+        </Root>
+    </Loggers>
+</Configuration>
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/webapp/WEB-INF/jboss-deployment-structure.xml b/modules/samples/userguide/src/userguide/springbootdemo/src/main/webapp/WEB-INF/jboss-deployment-structure.xml
new file mode 100644
index 0000000..6840eea
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/webapp/WEB-INF/jboss-deployment-structure.xml
@@ -0,0 +1,13 @@
+<jboss-deployment-structure>
+    <deployment>
+        <exclude-subsystems>
+            <subsystem name="jaxrs" />
+        </exclude-subsystems>
+        <exclusions>
+            <module name="org.apache.log4j" /> <module name="org.apache.commons.logging" />
+        </exclusions>
+        <dependencies> 
+            <module name="jdk.unsupported" slot="main" export="true" />
+        </dependencies>
+    </deployment>
+</jboss-deployment-structure>
diff --git a/modules/samples/userguide/src/userguide/springbootdemo/src/main/webapp/WEB-INF/jboss-web.xml b/modules/samples/userguide/src/userguide/springbootdemo/src/main/webapp/WEB-INF/jboss-web.xml
new file mode 100755
index 0000000..4259d75
--- /dev/null
+++ b/modules/samples/userguide/src/userguide/springbootdemo/src/main/webapp/WEB-INF/jboss-web.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0"?>                                                                                                                                                               
+<!DOCTYPE jboss-web PUBLIC                                                                                                                                                          
+   "-//JBoss//DTD Web Application 5.0//EN"                                                                                                                                          
+   "http://www.jboss.org/j2ee/dtd/jboss-web_5_0.dtd">                                                                                                                               
+<!-- force JBoss home page to the one and only war file that has this file defined on each server.
+     There can only be one root context per server.
+-->
+<jboss-web>
+ <!--deleteThisCommentForRootContext <context-root>/</context-root> deleteThisCommentForRootContext-->
+</jboss-web>
diff --git a/modules/webapp/src/main/webapp/WEB-INF/include/footer.inc b/modules/webapp/src/main/webapp/WEB-INF/include/footer.inc
index da9e51d..de42cb3 100644
--- a/modules/webapp/src/main/webapp/WEB-INF/include/footer.inc
+++ b/modules/webapp/src/main/webapp/WEB-INF/include/footer.inc
@@ -31,7 +31,7 @@
 				</tr>
 				<tr>
 					<td align="center">
-					Copyright &#169; 1999-2006, The Apache Software Foundation<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.
+					Copyright &#169; 1999-2021, The Apache Software Foundation<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.
 					</td>
 				</tr>
 			</table>
diff --git a/modules/webapp/src/main/webapp/axis2-web/Error/GenError.html b/modules/webapp/src/main/webapp/axis2-web/Error/GenError.html
index 748fbb2..de5355d 100644
--- a/modules/webapp/src/main/webapp/axis2-web/Error/GenError.html
+++ b/modules/webapp/src/main/webapp/axis2-web/Error/GenError.html
@@ -41,4 +41,4 @@
    </tr>
 </table>
  </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/modules/webapp/src/main/webapp/axis2-web/Error/error404.jsp b/modules/webapp/src/main/webapp/axis2-web/Error/error404.jsp
index b57fc76..c64576b 100644
--- a/modules/webapp/src/main/webapp/axis2-web/Error/error404.jsp
+++ b/modules/webapp/src/main/webapp/axis2-web/Error/error404.jsp
@@ -51,7 +51,7 @@
         <table summary="embedded footer table">
           <tr><td><hr size="1" noshade="noshade"></td></tr>
           <tr>
-            <td align="center">Copyright &#169; 1999-2006, The Apache Software Foundation<br>Licensed under the <a
+            <td align="center">Copyright &#169; 1999-2021, The Apache Software Foundation<br>Licensed under the <a
               href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</td>
           </tr>
         </table>
diff --git a/modules/webapp/src/main/webapp/axis2-web/Error/error500.jsp b/modules/webapp/src/main/webapp/axis2-web/Error/error500.jsp
index 696c95f..886f55d 100644
--- a/modules/webapp/src/main/webapp/axis2-web/Error/error500.jsp
+++ b/modules/webapp/src/main/webapp/axis2-web/Error/error500.jsp
@@ -52,7 +52,7 @@
         <table summary="embedded footer table">
           <tr><td><hr></td></tr>
           <tr>
-            <td style="align: center">Copyright &#169; 1999-2006, The Apache Software Foundation<br>Licensed under the <a
+            <td style="align: center">Copyright &#169; 1999-2021, The Apache Software Foundation<br>Licensed under the <a
               href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</td>
           </tr>
         </table>
diff --git a/src/site/xdoc/docs/userguide.xml b/src/site/xdoc/docs/userguide.xml
index 551d92b..c9a130c 100644
--- a/src/site/xdoc/docs/userguide.xml
+++ b/src/site/xdoc/docs/userguide.xml
@@ -35,8 +35,10 @@
 use Axis2 to create and deploy Web services as well as how to use
 WSDL to generate both clients and services.</p>
 For experienced users of Apache Axis2, we recommend the <a href=
-"adv-userguide.html">Advanced User's Guide.</a> <a name="intro" id=
-"intro"></a>
+"adv-userguide.html">Advanced User's Guide.</a> 
+For users of JSON and Spring Boot, see the sample application in the <a href=
+"json-springboot-userguide.html">JSON and Spring Boot User's Guide.</a> 
+<a name="intro" id= "intro"></a>
 <h1>Introducing Axis2</h1>
 <p>This section introduces Axis2 and its structure, including an
 explanation of various directories/files included in the latest