Why does Spring Boot Actuator return a 404 instead of 401?
<p>This is a very dumb question but, I don't understand why actuator gives me a 404 instead of a 401 when I try to access a secured endpoint.</p>

<p>I added the dependency</p>

<pre><code>&lt;dependency&gt;
    &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
    &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
&lt;/dependency&gt;
</code></pre>

<p>And disabled the security for non-sensitive endpoints</p>

<pre><code>security.basic.enabled=false
</code></pre>

<p>Now, I can access the application, and (a crippled version of) <code>/health</code> but when I go to <code>/metrics</code>, it gives me a <code>WWW-Authenticate</code> header, good, but with a 404, so my browser doesn't prompt me for user and password.</p>

<pre><code>$ curl -v http://localhost:8081/metrics
* STATE: INIT =&gt; CONNECT handle 0x6000572d0; line 1090 (connection #-5000)
* Added connection 0. The cache now contains 1 members
*   Trying ::1...
* STATE: CONNECT =&gt; WAITCONNECT handle 0x6000572d0; line 1143 (connection #0)
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 8081 (#0)
* STATE: WAITCONNECT =&gt; SENDPROTOCONNECT handle 0x6000572d0; line 1240 (connection #0)
* STATE: SENDPROTOCONNECT =&gt; DO handle 0x6000572d0; line 1258 (connection #0)
&gt; GET /metrics HTTP/1.1
&gt; Host: localhost:8081
&gt; User-Agent: curl/7.45.0
&gt; Accept: */*
&gt;
* STATE: DO =&gt; DO_DONE handle 0x6000572d0; line 1337 (connection #0)
* STATE: DO_DONE =&gt; WAITPERFORM handle 0x6000572d0; line 1464 (connection #0)
* STATE: WAITPERFORM =&gt; PERFORM handle 0x6000572d0; line 1474 (connection #0)
* HTTP 1.1 or later with persistent connection, pipelining supported
&lt; HTTP/1.1 404 Not Found
* Server Apache-Coyote/1.1 is not blacklisted
&lt; Server: Apache-Coyote/1.1
&lt; X-Content-Type-Options: nosniff
&lt; X-XSS-Protection: 1; mode=block
&lt; Cache-Control: no-cache, no-store, max-age=0, must-revalidate
&lt; Pragma: no-cache
&lt; Expires: 0
&lt; X-Frame-Options: DENY
&lt; Strict-Transport-Security: max-age=31536000 ; includeSubDomains
&lt; WWW-Authenticate: Basic realm="Spring"
&lt; Content-Length: 0
&lt; Date: Thu, 21 Jan 2016 15:55:12 GMT
&lt;
* STATE: PERFORM =&gt; DONE handle 0x6000572d0; line 1632 (connection #0)
* Curl_done
* Connection #0 to host localhost left intact
</code></pre>

<p>And the relevant properties in <code>application.properties</code></p>

<pre><code># Spring Boot Actuator
management.address=127.0.0.1
management.port=8081
security.basic.enabled=false
security.user.name=admin
security.user.password=a1b2c3
</code></pre>

<p>Why is that so? Can I change it?</p>