Merge branch '3.5.x' into 4.0.x

module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java

@@ -453,7 +453,7 @@ public final class EndpointRequest {
 				.filter(Objects::nonNull)
 				.map(this::getEndpointId)
 				.flatMap((endpointId) -> streamAdditionalPaths(endpoints, endpointId))
-				.map(PathPatternParserServerWebExchangeMatcher::new)
+				.map((path) -> new PathPatternParserServerWebExchangeMatcher(path, this.httpMethod))
 				.collect(Collectors.toCollection(ArrayList::new));
 			return (!CollectionUtils.isEmpty(delegateMatchers)) ? new OrServerWebExchangeMatcher(delegateMatchers)
 					: EMPTY_MATCHER;

module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequestTests.java

@@ -311,6 +311,17 @@ class EndpointRequestTests {
 		assertMatcher.matches("/additional");
 	}
 
+	@Test
+	void toAdditionalPathsWithHttpMethodShouldRespectRequestMethod() {
+		ServerWebExchangeMatcher matcher = EndpointRequest
+			.toAdditionalPaths(WebServerNamespace.SERVER, FooEndpoint.class)
+			.withHttpMethod(HttpMethod.POST);
+		RequestMatcherAssert assertMatcher = assertMatcher(matcher, new PathMappedEndpoints("",
+				() -> List.of(mockEndpoint(EndpointId.of("foo"), "test", WebServerNamespace.SERVER, "/additional"))));
+		assertMatcher.matches(HttpMethod.POST, "/additional");
+		assertMatcher.doesNotMatch(HttpMethod.GET, "/additional");
+	}
+
 	@Test
 	void toAdditionalPathsWithEndpointClassShouldNotMatchOtherPaths() {
 		ServerWebExchangeMatcher matcher = EndpointRequest.toAdditionalPaths(WebServerNamespace.SERVER,