Design Review: Security

Two requests reached the actuator of the finished booking service in the same test run. The health probe, sent without a token as a platform sends it, received 401 Unauthorized. Ana, an ordinary customer, asked for /actuator/metrics/booking.confirmed with her token and received 200, together with the number of confirmed bookings.

The first answer is too strict and the second too loose, yet both came from one line: anyRequest().authenticated(), the last rule of the api chain