all tests before spring boot 2.0 can be added through
pom

    <!--spring security-->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <!--spring security test-->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-test</artifactId>
        <scope>test</scope>
    </dependency>

, all 403 is reported. Is there any default configuration for spring security?
added a simple

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/").permitAll()
                .anyRequest().authenticated();
    }
}

doesn"t change anything. It"s no use adding @ WithMockUser to the test class, and adding @ Import (WebSecurityConfig.class) to the test class.