[Solved] Why does this security config fail to secure actuator endpoints?http.authorizeHttpRequests() .requestMatchers("/actuator/**").hasRole("ADMIN") .anyRequest().authenticated(); | Spring Boot

Spring Boot - Actuator

Why does this security config fail to secure actuator endpoints?

http.authorizeHttpRequests()
  .requestMatchers("/actuator/**").hasRole("ADMIN")
  .anyRequest().authenticated();

ABecause the order of matchers is incorrect

BBecause CSRF is not disabled for actuator endpoints

CBecause actuator endpoints are not exposed

DBecause hasRole("ADMIN") requires prefix ROLE_ in database

Step-by-Step Solution

Solution:

Step 1: Verify exposure of actuator endpoints
If actuator endpoints are not exposed via properties, security rules have no effect.
Step 2: Confirm exposure property is missing or incorrect
Without management.endpoints.web.exposure.include, endpoints remain inaccessible and unsecured.
Final Answer:
Because actuator endpoints are not exposed -> Option C
Quick Check:
Exposure is prerequisite for securing endpoints [OK]

Quick Trick: Expose endpoints before applying security rules [OK]

Common Mistakes:

Master "Actuator" in Spring Boot

9 interactive learning modes - each teaches the same concept differently

More Spring Boot Quizzes

Why does this security config fail to secure actuator endpoints?