What is the proper way using random ports so security configuration is reliably applied?

[pskowronek]

When using port: -1 for endpoints, the security configuration is not properly set. Micronaut has also ${random.port} which works better with security configuration, but imho is not 100% reliable (the port can already be taken - race condition).

Both ways of setting random port are stated in the documentation, but what worries me the most is that -1 may not properly set the security for endpoint, because apparently the filtering done in EndpointsFilter.java is using port from configuration not the real/final one chosen by netty.

More details can be found in my comment to this bug: #9822

[pskowronek]

Anyone?

[TatyOko28]

This looks like a valid concern.

Using:

micronaut:
  server:
    port: -1