WhyI am Getting 403 Forbidden error for actuator /refresh endpoint on Spring Boot 2 on Cloud Foundry{using Cloud Config Server service}

Question

Within my project, I have the following bootstrap.properties file:

spring.application.name=vault-demo
management.endpoints.web.exposure.include=*

Additionally to that, I defined the following dependency:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-actuator</artifactId>
</dependency>

The config server is able to access the property but when I update that property in GitHub and POST to /refresh I get a 403: Forbidden. Do I need to make any change in my application or bootstrap.properties?

Answer 1

I got the solution, I needed to add a security configuration, for example:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter{

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();
    }
}

Additionally, I had to add the following dependency:

<dependency> 
    <groupId>org.springframework.security</groupId> 
    <artifactId>spring-security-rsa</artifactId> 
    <version>1.0.5.RELEASE</version> 
</dependency>

I found this solution within the following GitHub issue: https://github.com/spring-cloud/spring-cloud-config/issues/950