How to disable security on management port for Spring Boot app?

Question

I am setting up a Spring Boot 1.3 secured application, but with an management port that is inaccessible to the public, so I don't need any security on this port.

This is simply what I want to achieve:

server.port = 8080     # -> secure
management.port = 8081 # -> unsecure

But as soon as I add a WebSecurityConfigurerAdapter, it automatically is in effect for both ports. Setting management.security.enabled=false has no effect if management port is different, is this a bug? How can I otherwise disable security for the management port only?

My simple security configuration:

@Configuration
@EnableWebSecurity
static class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated();
    }
}

I know a possible workaround could be to set custom context-path eg. /manage and ignore this path from security, but it doesn't seem ideal to use a non-standard path plus the fiddling to resolve path into the security config without hard-coding it, so I would like to find out whether there is a standard approach to this.

Answer 1

You can always add a request matcher and skip the security checks for the management port. A workaround for Spring Boot 2 is as follows. This might work for older Spring Boot versions too. Please try and see.

public class AppSecurityConfig extends WebSecurityConfigurerAdapter {

   // this is the port for management endpoints
   @Value("${management.server.port}")
   private int managementPort;

   @Override
   protected void configure(HttpSecurity http) throws Exception {
       http
            .authorizeRequests()
            .requestMatchers(checkPort(managementPort)).permitAll()
            .anyRequest().authenticated();

   }

  /**
   * This method verifies whether a request port is equal to the provided method parameter
   *
   * @param port Port that needs to be checked with the incoming request port
   * @return Returns a request matcher object with port comparison
   */
   private RequestMatcher checkPort(final int port) {
       return (HttpServletRequest request) -> port == request.getLocalPort();
   }
}

Inspired by this answer.

Answer 2

Looks like it is in fact a bug: https://github.com/spring-projects/spring-boot/issues/4624