title: springboot actuator returns 401 for actuator endpoints
body: <p>I am refactoring an old java spring project into springboot, and deploy it in a traditional war style. For some reason I have to stick to traditional web.xml to start the application. Thanks to Springboot legacy, I can achieve this with a web.xml: </p>
  
  <pre><code>&lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;com.MyServerServletConfig&lt;/param-value&gt;
  &lt;/context-param&gt;
  
  &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.boot.legacy.context.web.SpringBootContextLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt;
  
  &lt;servlet&gt;
      &lt;servlet-name&gt;myservlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;myservlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  </code></pre>
  
  <p>In addition, I add springboot actuator dependency. The <code>application.properties</code> is like below:</p>
  
  <pre><code>endpoints.enabled=true
  endpoints.sensitive=true
  management.security.enabled=true
  management.context-path=/manage
  security.user.password=myserver
  security.user.name=myserver
  </code></pre>
  
  <p>The application can start normally, but when I try to visit endpoints from browser it just returns a <code>401 Full authentication is required to access this resource</code> error without asking me to type in username and password. Related logs are below: </p>
  
  <pre><code>16:00:04.264 DEBUG [resin-port-8081-19] org.springframework.web.servlet.DispatcherServlet: DispatcherServlet with name 'myservlet' processing GET request for [/manage/health]
  16:00:04.264 DEBUG [resin-port-8081-19] org.springframework.boot.actuate.endpoint.mvc.EndpointHandlerMapping: Looking up handler method for path /manage/health
  16:00:04.264 DEBUG [resin-port-8081-19] org.springframework.boot.actuate.endpoint.mvc.EndpointHandlerMapping: Returning handler method [public java.lang.Object org.springframework.boot.actuate.endpoint.mvc.HealthMvcEndpoint.invoke(javax.servlet.http.HttpServletRequest,java.security.Principal)]
  16:00:04.264 DEBUG [resin-port-8081-19] org.springframework.web.servlet.DispatcherServlet: Last-Modified value for [/manage/health] is: -1
  16:00:04.264 DEBUG [resin-port-8081-19] org.springframework.core.env.PropertySourcesPropertyResolver: Found key 'endpoints.sensitive' in [applicationConfig: [classpath:../conf/application.properties]] with type [String]
  16:00:04.265 DEBUG [resin-port-8081-19] org.springframework.web.servlet.DispatcherServlet: Successfully completed request
  </code></pre>
  
  <p>What might be the reason for this problem? Is there any difference between a DispatherServlet auto constructed by springboot and one explicitly defined in a web.xml? For security considerations <code>management.security.enabled=true</code> is a necessity.</p>