Expose full health details to unauthorized user without disabling management security

[berinle]

Currently, the health endpoint of an app reports only { "status": "UP" } when all is ok or { "status": "DOWN" } when one or more things aren't ok. Per the docs, there seems to be no way to expose the full health information to unauthenticated users without fully disabling security of management endpoints. It will be great if the full details of a the health endpoint can be exposed to an unauthenticated user without having to leave the whole management endpoints open.

endpoints.health.sensitive=false
management.security.enabled=false

[mbhave]

@berinle I think adding another flag for "secure" might be confusing. We can improve the behavior in 2.0, maybe by providing a nested path for accessing the full status such as health/full, instead of having two modes for /health which leads to a complicated security model. For 1.5, we can add a @ConditionalOnMissingBean to the existing HealthMvcEndpoint autoconfiguration. This will allow you to add a bean for the HealthMvcEndpoint in your configuration class. It would look something like this:

@Bean
public HealthMvcEndpoint exposeDetailsHealthMvcEndpoint(HealthEndpoint delegate) {
	return new HealthMvcEndpoint(delegate) {

		@Override
                protected boolean exposeHealthDetails(HttpServletRequest request,
		         Principal principal) {
	             return true;
                }

	};
}

Does that sound reasonable?

[berinle]

I agree @mbhave. It will be a bit convoluted to add an additional secure flag. Your recommendations sound reasonable to me.

Thanks!

[berinle]

@mbhave good morning. any update on this? Is it in anyway possible to override the current HealthMvcEndpoint without a substantial rewrite while I await a fix/workaround? Also, if that is possible, can you please share a snippet similar to the one you provided above to get me going? Thanks!

[mbhave]

@berinle The above snippet will override the current HealthMvcEndpoint. As of 1.5.3, the HealthMvcEndpoint bean created by default is @ConditionalOnMissingBean so adding your own bean that always exposes health details should do what you want.

[berinle]

@mbhave thanks! works great after i upgraded to 1.5.3.

[mbhave]

Closing as duplicate of #5750.