Spring Boot Actuator info端点重定向至登录页问题求助

你的项目应该引入了Spring Security依赖，Spring Boot 3.x版本中，Spring Security默认会对Actuator的绝大多数端点（包括info）启用认证拦截，而health端点默认允许匿名访问，这就导致你访问info时会被重定向到登录页，health却能正常打开。

根据你的需求，有两种处理方式：

方式一：完全放开所有Actuator端点的访问限制 #

创建Spring Security配置类，允许所有请求访问Actuator相关路径：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class ActuatorSecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(auth -> auth
                .requestMatchers("/actuator/**").permitAll()
                .anyRequest().authenticated()
        );
        return http.build();
    }
}

方式二：仅放开info端点，其他端点保留认证保护 #

如果需要对其他Actuator端点（比如loggers）保留认证，只单独放开info：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class ActuatorSecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(auth -> auth
                .requestMatchers("/actuator/info").permitAll()
                .requestMatchers("/actuator/**").authenticated()
                .anyRequest().authenticated()
        );
        return http.build();
    }
}

补充：通过配置文件简化配置（Spring Boot 3.1+支持） #

如果你不想编写Java配置类，也可以直接在application.yaml中添加Spring Security配置，放开指定端点：

spring:
  security:
    authorization:
      requests:
        authorize:
          "/actuator/info": permitAll
          "/actuator/**": authenticated

内容的提问来源于stack exchange，提问作者The Dark Knight