title: Spring Boot actuator health endpoint not accessible after upgrading to Boot 1.2
body: <p>I'm having trouble upgrading Spring Boot from 1.1.12 to 1.2.5 but have the same issue in all versions of 1.2.x. The <code>/health</code> endpoint provided by Actuator is now returning 401 Unauthorized to an integration test that used to work. No code has changed while upgrading the dependency.</p>
  
  <p>Here's the test case:</p>
  
  <pre><code>@Test
  public void testNoUserForStatusEndpoint() throws Exception {
      HttpEntity&lt;String&gt; entity = new HttpEntity&lt;&gt;(null, headers);
      ResponseEntity&lt;String&gt; response = template
              .exchange(base + "/health", HttpMethod.GET, entity, String.class);
      assertEquals(HttpStatus.OK, response.getStatusCode());
      assertEquals("{\"status\":\"UP\"}", response.getBody());
  }
  </code></pre>
  
  <p>I expect to see the basic <code>"UP"</code> status but no further details as the user is anonymous and not authenticated.</p>
  
  <p>Setting <code>management.security.enabled=false</code> in application.properties causes the endpoint to return the complete health information. This is not desirable.</p>
  
  <p>Setting <code>endpoints.health.sensitive=false</code> does nothing.</p>
  
  <p>The security configuration has not changed. It is based on Apache termination and a certificate whitelist, which also hasn't changed.</p>
  
  <pre><code>@Override
  public void configure(HttpSecurity http) throws Exception {
      http.csrf().disable();
      http.addFilterBefore(new CustomAuthenticationFilter(authenticationManager(), Environment.getUserWhitelist()), BasicAuthenticationFilter.class);
  }
  </code></pre>
  
  <p>How can I make the test pass?</p>
  
  <p><strong>Updates:</strong></p>
  
  <p>Originally the only relevant setting in <code>application.properties</code> that was defined is <code>endpoints.health.enabled=true</code>.</p>
  
  <p>Adding <code>management.health.status.order=UP,DOWN,OUT_OF_SERVICE,UNKNOWN</code> to <code>application.properties</code> makes no difference.</p>
  
  <p>Using all three properties results in a 401 (doesn't work):</p>
  
  <pre><code>endpoints.health.enabled=true
  endpoints.health.sensitive=false
  management.health.status.order=UP,DOWN,OUT_OF_SERVICE,UNKNOWN
  </code></pre>
  
  <p>The main class is just a stripped down Spring Boot application launcher:</p>
  
  <pre><code>@Configuration
  @EnableAutoConfiguration
  @ComponentScan
  public class Application {
      public static void main(String[] args) {
          SpringApplication.run(Application.class, args);
      }
  }
  </code></pre>
  
  <p>I have tried adding <code>http.authorizeRequests().antMatchers("/health**").permitAll();</code> to the first line of the security configuration method detailed above. It did not make a difference.</p>
  
  <p>According to Spring Boot <a href="https://github.com/spring-projects/spring-boot/issues/2120" rel="nofollow">issue 2120</a>, The <code>endpoints.health.sensitive</code> property is ignored when using custom security. I found no mention of this in the documentation.</p>