title: Configure actuator endpoints security
body: <p>The Spring Boot Actuator Endpoints are by default protected by basic http security.</p>
  
  <p>Can this be changed to use Spring Security?
  I've setup Spring Security successfully and use this to protect my other pages.</p>
  
  <p>I tried <code>security.basic.enabled: false</code> and adding <code>.antMatchers("/manage/**").hasRole("ADMIN")</code> in my authorize requests (note I'm using a different url as root for the endpoints) but this didn't help.
  I keep getting a basic http auth log, which does not users configured in the AuthenticationManager.</p>
  
  <p>Any idea?</p>
  
  <p><strong>EDIT - providing more details -</strong></p>
  
  <p>My Application.java looks like:</p>
  
  <pre><code>@Configuration
  @ComponentScan
  @EnableAutoConfiguration
  public class Application extends WebMvcConfigurerAdapter {
  
  
      public static void main(String[] args) {
          SpringApplication.run(Application.class, args);
      }
  
      @Override
      public void addViewControllers(ViewControllerRegistry registry) {
          registry.addViewController("/app").setViewName("app/index");
          registry.addViewController("/app/login").setViewName("app/login");
      }
  
      @Bean
      public ApplicationSecurity applicationSecurity() {
          return new ApplicationSecurity();
      }
  
      @Order(Ordered.LOWEST_PRECEDENCE - 8)
      protected static class ApplicationSecurity extends WebSecurityConfigurerAdapter {
  
          @Override
          protected void configure(AuthenticationManagerBuilder auth) throws Exception {
              // @formatter:off
              auth.inMemoryAuthentication()
                  .withUser("test1")
                      .password("test1pw")
                      .roles("USER", "ADMIN")
                      .and()
                  .withUser("test2")
                      .password("test2pw")
                      .roles("USER");
              // @formatter:on
          }
  
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              // @formatter:off
              http
                  .csrf()
                      .disable()
                  .authorizeRequests()
                      .antMatchers("/app/login").permitAll()
                      .antMatchers("/app/**").hasRole("USER")
                      .antMatchers("/manage/**").hasRole("ADMIN")
                      .and()
                  .formLogin()
                      .loginPage("/app/login")
                      .failureUrl("/app/login?error")
                      .defaultSuccessUrl("/app")
                      .permitAll()
                      .and()
                  .logout()
                      .logoutUrl("/app/logout")
                      .logoutSuccessUrl("/app/login?logout");
              // @formatter:on
          }
  
          @Override
          public void configure(WebSecurity web) throws Exception {
              // @formatter:off
              web
                  .ignoring()
                      .antMatchers("/assets/**");
              // @formatter:on
          }
      }
  }
  </code></pre>
  
  <p>In my <code>application.yml</code> I also have:</p>
  
  <pre><code>management:
    context-path: /management
  </code></pre>
  
  <p>Note that is setup is the same as you the guide you mentioned.</p>
  
  <p>Now what I would expect - or like to configure - is that the /manage endpoints like health, mappings etc would be protected with users from the customized AuthenticationManager.</p>
  
  <p>I also tried to add <code>management.security.enabled=false</code>and this indeed switches off authentication for e.g. /manage/mappings.
  The problematic thing however is that I explicitly told Spring Security to protect these urls's via:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      // @formatter:off
      http
          .authorizeRequests()
              .antMatchers("/app/login").permitAll()
              .antMatchers("/app/**").hasRole("USER")
              .antMatchers("/manage/**").hasRole("ADMIN")
  </code></pre>
  
  <p>but this does not work. Note other authorize matchers do work.
  I wonder if has something to do within timing/order. I copied <code>@Order(Ordered.LOWEST_PRECEDENCE - 8)</code> from the sample but I don't know why - 8 is used.</p>
  
  <p>To delve a little bit deeper I've also run the sample (<a href="https://github.com/spring-projects/spring-boot/blob/master/spring-boot-samples/spring-boot-sample-web-method-security">https://github.com/spring-projects/spring-boot/blob/master/spring-boot-samples/spring-boot-sample-web-method-security</a>) myself and I see the same behaviour in the sample application.
  The management security is seems completely independent of the <code>user</code> and <code>admin</code> users configured in the sample's in memory authentication.</p>