title: How Prometheus scrape Spring Boot metrics with authentication?
body: <p>I'm using Spring Boot 1.5.1 with:</p>
  
  <pre><code>compile 'io.micrometer:micrometer-spring-legacy:1.0.6'
  compile 'io.micrometer:micrometer-registry-prometheus:1.0.6'
  </code></pre>
  
  <p>Spring properties file:</p>
  
  <pre><code>management.security.enabled=true
  endpoints.prometheus.enabled=true
  endpoints.prometheus.sensitive=false
  </code></pre>
  
  <p>In my Prometheus config file I added basic_auth:</p>
  
  <pre><code>basic_auth:
      username: username
      password: passw0rd
  </code></pre>
  
  <p>In my [prometheusURL]/targets I keep getting:</p>
  
  <blockquote>
    <p>server returned HTTP status 403</p>
  </blockquote>
  
  <p><strong>What is the proper way for Prometheus to authenticate each scrape of Spring metrics?</strong> </p>
  
  <p><strong><em>EDIT:</em></strong> I can pass through Spring Security with this command:</p>
  
  <pre><code>curl --cookie "SESSION=7f18cfe7-9a54-4fcf-9662-21d81247c705" http://localhost:8082/management/metrics
  </code></pre>
  
  <p>AFAIK in <a href="https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config" rel="noreferrer">prometheus config file</a> we can pass only <em>basic_auth</em> or <em>bearer_token</em>. There are no other options for headers.</p>