From e6db43850b088c81b41349ab5110fb6db799cfd4 Mon Sep 17 00:00:00 2001 From: Marcel Date: Wed, 18 Mar 2026 21:25:47 +0100 Subject: [PATCH] fix(security): permit /actuator/health without authentication The CI health check (curl -sf) and Docker Compose health check (wget) both hit /actuator/health unauthenticated. With anyRequest().authenticated() the endpoint returned 401, curl -f treated it as failure, and the health check loop never exited successfully. Co-Authored-By: Claude Sonnet 4.6 --- .../java/org/raddatz/familienarchiv/config/SecurityConfig.java | 2 ++ 1 file changed, 2 insertions(+) diff --git a/backend/src/main/java/org/raddatz/familienarchiv/config/SecurityConfig.java b/backend/src/main/java/org/raddatz/familienarchiv/config/SecurityConfig.java index c7fa7cca..cb4d1a87 100644 --- a/backend/src/main/java/org/raddatz/familienarchiv/config/SecurityConfig.java +++ b/backend/src/main/java/org/raddatz/familienarchiv/config/SecurityConfig.java @@ -46,6 +46,8 @@ public class SecurityConfig { .csrf(csrf -> csrf.disable()) .authorizeHttpRequests(auth -> { + // Health endpoint must be open so CI/Docker health checks work without credentials + auth.requestMatchers("/actuator/health").permitAll(); // In dev, allow unauthenticated access to the OpenAPI spec and Swagger UI if (environment.matchesProfiles("dev")) { auth.requestMatchers(