title: Why does Spring Boot Actuator return a 404 instead of 401?
body: <p>This is a very dumb question but, I don't understand why actuator gives me a 404 instead of a 401 when I try to access a secured endpoint.</p>
  
  <p>I added the dependency</p>
  
  <pre><code>&lt;dependency&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
  &lt;/dependency&gt;
  </code></pre>
  
  <p>And disabled the security for non-sensitive endpoints</p>
  
  <pre><code>security.basic.enabled=false
  </code></pre>
  
  <p>Now, I can access the application, and (a crippled version of) <code>/health</code> but when I go to <code>/metrics</code>, it gives me a <code>WWW-Authenticate</code> header, good, but with a 404, so my browser doesn't prompt me for user and password.</p>
  
  <pre><code>$ curl -v http://localhost:8081/metrics
  * STATE: INIT =&gt; CONNECT handle 0x6000572d0; line 1090 (connection #-5000)
  * Added connection 0. The cache now contains 1 members
  *   Trying ::1...
  * STATE: CONNECT =&gt; WAITCONNECT handle 0x6000572d0; line 1143 (connection #0)
  *   Trying 127.0.0.1...
  * Connected to localhost (127.0.0.1) port 8081 (#0)
  * STATE: WAITCONNECT =&gt; SENDPROTOCONNECT handle 0x6000572d0; line 1240 (connection #0)
  * STATE: SENDPROTOCONNECT =&gt; DO handle 0x6000572d0; line 1258 (connection #0)
  &gt; GET /metrics HTTP/1.1
  &gt; Host: localhost:8081
  &gt; User-Agent: curl/7.45.0
  &gt; Accept: */*
  &gt;
  * STATE: DO =&gt; DO_DONE handle 0x6000572d0; line 1337 (connection #0)
  * STATE: DO_DONE =&gt; WAITPERFORM handle 0x6000572d0; line 1464 (connection #0)
  * STATE: WAITPERFORM =&gt; PERFORM handle 0x6000572d0; line 1474 (connection #0)
  * HTTP 1.1 or later with persistent connection, pipelining supported
  &lt; HTTP/1.1 404 Not Found
  * Server Apache-Coyote/1.1 is not blacklisted
  &lt; Server: Apache-Coyote/1.1
  &lt; X-Content-Type-Options: nosniff
  &lt; X-XSS-Protection: 1; mode=block
  &lt; Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  &lt; Pragma: no-cache
  &lt; Expires: 0
  &lt; X-Frame-Options: DENY
  &lt; Strict-Transport-Security: max-age=31536000 ; includeSubDomains
  &lt; WWW-Authenticate: Basic realm="Spring"
  &lt; Content-Length: 0
  &lt; Date: Thu, 21 Jan 2016 15:55:12 GMT
  &lt;
  * STATE: PERFORM =&gt; DONE handle 0x6000572d0; line 1632 (connection #0)
  * Curl_done
  * Connection #0 to host localhost left intact
  </code></pre>
  
  <p>And the relevant properties in <code>application.properties</code></p>
  
  <pre><code># Spring Boot Actuator
  management.address=127.0.0.1
  management.port=8081
  security.basic.enabled=false
  security.user.name=admin
  security.user.password=a1b2c3
  </code></pre>
  
  <p>Why is that so? Can I change it?</p>