Health Endpoint No Longer Accessible Since 1.2.0 Upgrade

[davidgoate]

Since upgrading from 1.1.9 to 1.2.0 the /health endpoint is no longer accessible.

I see from the release notes that the default is to deny anonymous access but even by adding the property endpoints.health.sensitive=false access is still being forbidden.

I do have Spring Security on the classpath and I have configured the WebSecurityConfigurerAdapter with http.authorizeRequests().anyRequest().authenticated(). When using 1.1.9 I was able to access /health without authenticating.

[snicoll]

As you have seen in the release notes, the health endpoint is no longer accessible anonymously by default, yes. Regarding your other question, I don't think there's so much we can do since you configured Spring security yourself. The sensitive flag only applies with the default configuration that backs off with you configuration.

Does that make sense?

[davidgoate]

Thanks for the response. Yes, what you are saying makes sense but I'm still not entirely clear about why this worked before in that case, since I haven't changed any other code or configuration. Now I think about it perhaps it really was a bug in 1.1.9 that it allowed me to access /health without authenticating when my security configuration was http.authorizeRequests().anyRequest().authenticated().

Either way, setting that property doesn't seem to restore the old behaviour, but as I've said above - perhaps this really was a bug in 1.1.9 that's now been fixed.

[snicoll]

This was probably a bug in 1.x, yes. You should really update your security config accordingly.

[philwebb]

Reopening because I want to look at this some more at why the property doesn't allow access even with custom security.

[snicoll]

Good point, I thought we did not support overriding when the property is set. I had a look and I believe 24e71e8 should be the thing that introduced the regression.

[philwebb]

I'm having some trouble replicating this. Could you provide your complete @Configuration (including the security configuration)? Even better would be a sample application if you have the time?

[snicoll]

Hey @philwebb, here is the project I used to debug this. If you flip to 1.2.1.BUILD-SNAPSHOT you'll indeed need to log in.

[philwebb]

It seems like this might be an ordering issue. If the security is configured with @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) then the sample works. I think this is because http.authorizeRequests().anyRequest().authenticated(); is indicating that all requests must be authenticated, but calls to non-sensitive /healthendpoints are not.

With the @Order annotation your rules are applied before Boot's, rather than replacing them.

[philwebb]

I think the @Order annotation should fix things. Please re-open if that's not the case.

[igilham]

For reference I had this same issue. The @Order annotation fixed it for me. See my Stack Overflow question for details.