When management server is running on separate port, org.springframework.web.filter.RequestContextFilter is registered only for main server servlet, even though it seems that configuration was expecting that registration will be made for both servlets.
Here is how filter is registered for management server when it is listening on separate port https://github.com/spring-projects/spring-boot/blob/f947bad3f73ff0e330b6986b4b3ef0d8a726659f/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/web/servlet/WebMvcEndpointChildContextConfiguration.java#L107
And here is how it is configured for main servlet https://github.com/spring-projects/spring-boot/blob/f947bad3f73ff0e330b6986b4b3ef0d8a726659f/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/servlet/WebMvcAutoConfiguration.java#L369
It looks like ConditionalOnMissingBean is able to locate bean from main servlet context, but the same bean is not registered for child context.
The test case is purely synthetic, because when endpoint is called, FrameworkServlet will populate RequestContextHolder and LocaleContextHolder, but in my case I was trying to access those holders from ObservationPredicate, so is was relying on RequestContextFilter to be not empty: https://github.com/spring-projects/spring-security/issues/12854.
Test case https://github.com/betalb/spring-boot-request-context-filter
curl http://localhost:9001/actuator/feature
# Expected: {"source":"actuator","status":"filter was called"}
# Actual: {"source":"actuator","status":"null"}
Output of curl http://localhost:9000/ indicates that filter was called {"source":"actuator","status":"filter was called"}
I'm able to resolve this issue by commenting ConditionalOnMissingBean in ActuatorConfig https://github.com/betalb/spring-boot-request-context-filter/blob/main/src/main/java/com/example/springactuatorfilter/ActuatorConfig.java#L17
Comment From: bclozel
I was actually looking at spring-projects/spring-security#12854 and was about to mention there that it's a known behavior. I'm closing this issue as a duplicate of #31811.