Security changes in Spring Boot 2.0 M4
Milestone 4 of Spring Boot 2.0 brings important changes to the security auto-configuration provided by Spring Boot.
Problem Statement
Until Spring Boot 1.x, the default auto-configuration secured all of the application endpoints using basic authentication. If actuator was on the classpath, there was a separate security configuration that applied to the actuator endpoints. The way these two auto-configurations would turn on and off was completely independent. Because of this, users wanting to provide custom security found themselves fighting ordering issues with WebSecurityConfigurerAdapter
s.
Additionally, for actuator endpoints, the effects of the management.security.enabled
…