SecurityConfig.java:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
  http
    .csrf(CsrfConfigurer::disable)
    .authorizeHttpRequests(authorize -> {  // /h2-console authorization
      authorize
        .requestMatchers(PathRequest.toH2Console())
        .permitAll();
    })
    .headers(headers -> headers.frameOptions(HeadersConfigurer.FrameOptionsConfig::disable))  // Allows access to /h2-console frameset/frame pages
// ...
}

application.yml:

spring:
  h2:
    console:
      enabled: true  # UI available at /h2-console


H2 Console UI at /h2-console Spring Boot 3, Spring Security 6 - H2 Console UI at /h2-console