EndpointRequest.toLinks() does not match when management.endpoints.web.base-path is '/'

[nightswimmings]

I am using a different management port with management.server.base-path: '/management' and management.endpoints.web.base-path: '/'.

When setting up security as .requestMatchers(EndpointRequest.toLinks()).permitAll(), then performing a request over '/management/', returns 403

Root cause: WebEndpointProperties.setBasePath cleans '/' as ''.

Later on, upon first '/' call, LinksRequestMatcher sees the empty basepath and returns EndpointRequest.EMPTY_MATCHER, which always evaluates to false

[somayaj]

Can this be worked? or is a triage still planned? WebEndpointProperties ln 70 needs fixing.

https://github.com/spring-projects/spring-boot/blob/main/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/endpoint/web/WebEndpointProperties.java#L

[philwebb]

@somayaj You're welcome to work on the issue, I'll assign it to you. Ideally we'll be looking to add a test as well.

[wilkinsona]

This is deceptively complicated as EndpointRequest.toLinks() needs to return different matchers depending on whether or not actuator is running on a separate port.

[somayaj]

@wilkinsona not sure if this would make sense or would be in the right direction? public static final class LinksRequestMatcher extends AbstractRequestMatcher {

    @Override
    protected RequestMatcher createDelegate(WebApplicationContext context,
            RequestMatcherFactory requestMatcherFactory) {
        WebEndpointProperties properties = context.getBean(WebEndpointProperties.class);
        String basePath = properties.getBasePath();
        ManagementPortType port = ManagementPortType.get(context.getEnvironment());
        if (StringUtils.hasText(basePath) && !(port == ManagementPortType.DIFFERENT )) {
            return new OrRequestMatcher(
                    getLinksMatchers(requestMatcherFactory, getRequestMatcherProvider(context), basePath));
        }
        else if(port == ManagementPortType.DIFFERENT) {
            return new OrRequestMatcher(
                    getLinksMatchers(requestMatcherFactory, getRequestMatcherProvider(context), properties.getBasePath())); // not sure what to put here yet? 
        }

        return EMPTY_MATCHER;
    }

}