Spring Boot actuator health endpoint not accessible after upgrading to Boot 1.2

Question

I'm having trouble upgrading Spring Boot from 1.1.12 to 1.2.5 but have the same issue in all versions of 1.2.x. The /health endpoint provided by Actuator is now returning 401 Unauthorized to an integration test that used to work. No code has changed while upgrading the dependency.

Here's the test case:

@Test
public void testNoUserForStatusEndpoint() throws Exception {
    HttpEntity<String> entity = new HttpEntity<>(null, headers);
    ResponseEntity<String> response = template
            .exchange(base + "/health", HttpMethod.GET, entity, String.class);
    assertEquals(HttpStatus.OK, response.getStatusCode());
    assertEquals("{\"status\":\"UP\"}", response.getBody());
}

I expect to see the basic "UP" status but no further details as the user is anonymous and not authenticated.

Setting management.security.enabled=false in application.properties causes the endpoint to return the complete health information. This is not desirable.

Setting endpoints.health.sensitive=false does nothing.

The security configuration has not changed. It is based on Apache termination and a certificate whitelist, which also hasn't changed.

@Override
public void configure(HttpSecurity http) throws Exception {
    http.csrf().disable();
    http.addFilterBefore(new CustomAuthenticationFilter(authenticationManager(), Environment.getUserWhitelist()), BasicAuthenticationFilter.class);
}

How can I make the test pass?

Updates:

Originally the only relevant setting in application.properties that was defined is endpoints.health.enabled=true.

Adding management.health.status.order=UP,DOWN,OUT_OF_SERVICE,UNKNOWN to application.properties makes no difference.

Using all three properties results in a 401 (doesn't work):

endpoints.health.enabled=true
endpoints.health.sensitive=false
management.health.status.order=UP,DOWN,OUT_OF_SERVICE,UNKNOWN

The main class is just a stripped down Spring Boot application launcher:

@Configuration
@EnableAutoConfiguration
@ComponentScan
public class Application {
    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }
}

I have tried adding http.authorizeRequests().antMatchers("/health**").permitAll(); to the first line of the security configuration method detailed above. It did not make a difference.

According to Spring Boot issue 2120, The endpoints.health.sensitive property is ignored when using custom security. I found no mention of this in the documentation.

Similar to this question but the security details are different. — Ian Gilham

IKo IKo · Accepted Answer · 2017-06-25T17:50:16

4

votes

Or add management.security.enabled=false to the application.properties

Spring Boot actuator health endpoint not accessible after upgrading to Boot 1.2

4 Answers