diff --git a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java index e9b594944a6..e2e7b1dfa9c 100644 --- a/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java +++ b/module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java @@ -453,7 +453,7 @@ public final class EndpointRequest { .filter(Objects::nonNull) .map(this::getEndpointId) .flatMap((endpointId) -> streamAdditionalPaths(endpoints, endpointId)) - .map(PathPatternParserServerWebExchangeMatcher::new) + .map((path) -> new PathPatternParserServerWebExchangeMatcher(path, this.httpMethod)) .collect(Collectors.toCollection(ArrayList::new)); return (!CollectionUtils.isEmpty(delegateMatchers)) ? new OrServerWebExchangeMatcher(delegateMatchers) : EMPTY_MATCHER; diff --git a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequestTests.java b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequestTests.java index 1c82bd80939..52621add7a7 100644 --- a/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequestTests.java +++ b/module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequestTests.java @@ -311,6 +311,17 @@ class EndpointRequestTests { assertMatcher.matches("/additional"); } + @Test + void toAdditionalPathsWithHttpMethodShouldRespectRequestMethod() { + ServerWebExchangeMatcher matcher = EndpointRequest + .toAdditionalPaths(WebServerNamespace.SERVER, FooEndpoint.class) + .withHttpMethod(HttpMethod.POST); + RequestMatcherAssert assertMatcher = assertMatcher(matcher, new PathMappedEndpoints("", + () -> List.of(mockEndpoint(EndpointId.of("foo"), "test", WebServerNamespace.SERVER, "/additional")))); + assertMatcher.matches(HttpMethod.POST, "/additional"); + assertMatcher.doesNotMatch(HttpMethod.GET, "/additional"); + } + @Test void toAdditionalPathsWithEndpointClassShouldNotMatchOtherPaths() { ServerWebExchangeMatcher matcher = EndpointRequest.toAdditionalPaths(WebServerNamespace.SERVER,