This PR fixes bug #25350 in which remote devtools endpoint cannot be accessed if actuator and spring security are on the classpath. The reason is the lack of explicit ordering for managementSecurityFilterChain
which leads to overwriting RemoteDevtoolsSecurity
filter chain.
Comment From: wilkinsona
Thanks for the PR, @hatefpalizgar. Before we can merge this change, we'll need to add a test that verifies that it has fixed the problem. Would you be interested in doing that?
Comment From: hatefpalizgar
Sure. I will do it.
Comment From: philwebb
Thanks for the PR @hatefpalizgar. I've merged this into 2.4.x
and main
. I managed to simplify the tests a little in https://github.com/spring-projects/spring-boot/commit/0699fdcc8acd39704f1bfd22e331b6ab8158bc0b