Missing the login/logout URIs in the actuator metrics

The spring security filter related endpoints (e.g. /login, /logout) are mapped to ROOT uri, instead of being mapped to their URIs and have visibility over their metrics.

Due to the fact that the spring security handles the logic of the login/logout into a Filter (for instance, login in UsernamePasswordAuthenticationFilter), the login request doesn't reach the request handler mapper to have the required attribute (e.g. DATA_REST_PATH_PATTERN_ATTRIBUTE or BEST_MATCHING_PATTERN_ATTRIBUTE) for the actuator to fetch the Uri in WebMvcTags

To validate the issue, I created this demo repository => https://github.com/mohammedalics/actuator-login-filter-metrics-issue

** Call Login**

$ curl -kv 'http://localhost:8080/login' -H 'Content-Type: application/x-www-form-urlencoded' --data-raw 'username=user&password=password'`

HTTP/1.1 302
Set-Cookie: JSESSIONID=E0F21CAD780C1C25AAA22DE6F3069764; Path=/; HttpOnly

** Call Dummy endpoint**

curl -kv 'http://localhost:8080/hello' -H 'Cookie: JSESSIONID=E0F21CAD780C1C25AAA22DE6F3069764'                                                                               

HTTP/1.1 200
hello

Then by calling the "http.server.requests" metrics => http://localhost:8080/actuator/metrics/http.server.requests

{
  "name": "http.server.requests",
  "description": null,
  "baseUnit": "seconds",
  "measurements": [
    {
      "statistic": "COUNT",
      "value": 4
    },
    {
      "statistic": "TOTAL_TIME",
      "value": 0.22907417300000002
    },
    {
      "statistic": "MAX",
      "value": 0.012099089
    }
  ],
  "availableTags": [
    {
      "tag": "exception",
      "values": [
        "None"
      ]
    },
    {
      "tag": "method",
      "values": [
        "POST",
        "GET"
      ]
    },
    {
      "tag": "uri",
      "values": [
        "REDIRECTION",
        "/hello",
        "root"
      ]
    },
    {
      "tag": "outcome",
      "values": [
        "REDIRECTION",
        "SUCCESS"
      ]
    },
    {
      "tag": "status",
      "values": [
        "302",
        "200"
      ]
    }
  ]
}

--

If you agree on the issue, I can create a pull request to fix it.

Start in spring-boot-actuator/src/main/java/org/springframework/boot/actuate/metrics/web/servlet/WebMvcTags.java around the referenced lines and trace how filter-handled requests receive their URI tag. Use the linked demo repository to reproduce login, logout, and a normal endpoint, then verify that the actuator http.server.requests metrics expose /login and /logout rather than root; add regression coverage where the existing actuator tests cover this behavior.