Spring Boot application with Actuator - rest

Question

I have an SpringBoot app. 2.1.3.RELEASE securized by JWT, I want to add an actuator. I added this dependency
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
this is my configFile:
#Profile("api")
#Configuration
#EnableWebSecurity
#EnableGlobalMethodSecurity(prePostEnabled = true)
public class ApiWebSecurityConfig extends WebSecurityConfigurerAdapter {
private static final Logger LOG = LoggerFactory.getLogger(ApiWebSecurityConfig.class);
#Autowired
private JwtAuthenticationEntryPoint unauthorizedHandler;
#Autowired
private JwtTokenUtil jwtTokenUtil;
#Autowired
private UserSecurityService userSecurityService;
#Value("${jwt.header}")
private String tokenHeader;
#Value("${server.servlet.context-path}")
private String serverContextPath;
/** The encryption SALT. */
private static final String SALT = "fd&eekj§sfs23#$1*(_)nof";
#Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth
.userDetailsService(userSecurityService)
.passwordEncoder(passwordEncoder());
}
#Bean
public BCryptPasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder(12, new SecureRandom(SALT.getBytes()));
}
#Bean
#Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
#Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity
// we don't need CSRF because our token is invulnerable
.csrf().disable()
.exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
// don't create session
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
.authorizeRequests()
// Un-secure H2 Database
.antMatchers("/h2-console/**/**").permitAll()
.antMatchers("/auth/**").permitAll()
.anyRequest().authenticated();
// Custom JWT based security filter
JwtAuthorizationTokenFilter authenticationTokenFilter = new JwtAuthorizationTokenFilter(userDetailsService(), jwtTokenUtil, tokenHeader);
httpSecurity
.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
// disable page caching
httpSecurity
.headers()
.frameOptions().sameOrigin() // required to set for H2 else H2 Console will be blank.
.cacheControl();
}
#Override
public void configure(WebSecurity web) throws Exception {
// AuthenticationTokenFilter will ignore the below paths
web
.ignoring()
.antMatchers(
HttpMethod.POST,
"/auth"
)
.antMatchers(
HttpMethod.GET,
"/actuator"
)
.antMatchers(
HttpMethod.POST,
"/reg"
);
}
}
but when I access in the postman to http://127.0.0.1:8080/myApp/actuator/
I got a
{
"timestamp": "2019-03-21T16:39:47.877+0000",
"status": 401,
"error": "Unauthorized",
"message": "Unauthorized",
"path": "/myApp/actuator/"
}
and HTTP Status 404 – Not Found
when accessing http://127.0.0.1:8080/actuator/

Answer 1

By default the URL is:
http://localhost:8080/actuator
try to change your config from
.antMatchers(
HttpMethod.GET,
"/actuator"
)
to
.antMatchers(
HttpMethod.GET,
"/actuator/**"
)

Answer 2

The Spring boot actuator contains multiple endpoints which include health, metrics, etc.
The endpoints are accessed as follows;
http://{baseUrl}/autuator/health
http://{baseUrl}/autuator/metrics
so get all the endpoints - http://{baseUrl}/autuator/** [GET Request]
so to permit access to this endpoint in your security configuration, change your config from.
.antMatchers(
HttpMethod.GET,
"/actuator"
)
to
.antMatchers(
HttpMethod.GET,
"/actuator/**"
)