title: Disable security for Springboot actuator endpoint /env
body: <p><strong>Requirement :<br/></strong>
  I have a small springboot 2 , config-server project with just one java file (SpringBootApplication). My requirement is that actuator endpoint /actuator/env alone should be not challenged with spring security.</p>
  
  <p><strong>What I am able to do:<br/></strong>
  I am able to bypass security for /actuator/health by using <code>http.csrf().disable().authorizeRequests().antMatchers("/actuator/health").permitAll()</code> - [WebSecurityConfigurerAdapter] , so that opening that link will not ask credentials.</p>
  
  <p><strong>What I'd like to do:<br/></strong>
  But if I do the same for /env (<code>.antMatchers("/actuator/env").permitAll()</code>) , it still shows the default spring security credentials page. Please help.</p>
  
  <p><strong>Actuators Config in application.yml</strong> <br/>
  <code>management:
        endpoints:
          web:
            base-path: /actuator
            exposure:
              include: health,env
        endpoint:
          health:
            show-details: always</code></p>
  
  <p><strong>Security Config:<br/></strong></p>
  
  <pre><code>`@Configuration
  @EnableWebSecurity
  public class SecurityConfigurer extends WebSecurityConfigurerAdapter {
      @Override
      public void configure(HttpSecurity http) throws Exception{
          http.csrf().disable().authorizeRequests()
          .antMatchers("/actuator/env").permitAll()
          .antMatchers("/actuator/env/**").permitAll()
          .antMatchers("/actuator/health").permitAll();
          super.configure(http);
      }
  }`
  </code></pre>