mirror of
https://github.com/spring-projects/spring-boot.git
synced 2024-09-03 04:26:12 +08:00
Add Spring MVC-generated path suffixes to endpoint paths
Spring Security doesn't know that Spring MVC maps /foo, /foo.json and /foo/ all to the same handler. This change explicitly adds suffixes to the actuator endpoint matchers so they are properly protected.
This commit is contained in:
parent
97adb5c1b3
commit
72d7c286c0
Notes:
Phillip Webb
2014-04-06 21:58:34 -07:00
Fixes gh-636
@ -221,7 +221,13 @@ public class ManagementSecurityAutoConfiguration {
|
|||||||
List<String> paths = new ArrayList<String>(endpoints.size());
|
List<String> paths = new ArrayList<String>(endpoints.size());
|
||||||
for (MvcEndpoint endpoint : endpoints) {
|
for (MvcEndpoint endpoint : endpoints) {
|
||||||
if (endpoint.isSensitive() == secure) {
|
if (endpoint.isSensitive() == secure) {
|
||||||
paths.add(endpointHandlerMapping.getPrefix() + endpoint.getPath());
|
String path = endpointHandlerMapping.getPrefix() + endpoint.getPath();
|
||||||
|
paths.add(path);
|
||||||
|
if (secure) {
|
||||||
|
// Add Spring MVC-generated additional paths
|
||||||
|
paths.add(path + "/");
|
||||||
|
paths.add(path + ".*");
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
return paths.toArray(new String[paths.size()]);
|
return paths.toArray(new String[paths.size()]);
|
||||||
|
@ -70,6 +70,23 @@ public class SampleActuatorApplicationTests {
|
|||||||
.containsKey("Set-Cookie"));
|
.containsKey("Set-Cookie"));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void testMetricsIsSecure() throws Exception {
|
||||||
|
@SuppressWarnings("rawtypes")
|
||||||
|
ResponseEntity<Map> entity = new TestRestTemplate().getForEntity(
|
||||||
|
"http://localhost:8080/metrics", Map.class);
|
||||||
|
assertEquals(HttpStatus.UNAUTHORIZED, entity.getStatusCode());
|
||||||
|
entity = new TestRestTemplate().getForEntity(
|
||||||
|
"http://localhost:8080/metrics/", Map.class);
|
||||||
|
assertEquals(HttpStatus.UNAUTHORIZED, entity.getStatusCode());
|
||||||
|
entity = new TestRestTemplate().getForEntity(
|
||||||
|
"http://localhost:8080/metrics/foo", Map.class);
|
||||||
|
assertEquals(HttpStatus.UNAUTHORIZED, entity.getStatusCode());
|
||||||
|
entity = new TestRestTemplate().getForEntity(
|
||||||
|
"http://localhost:8080/metrics.json", Map.class);
|
||||||
|
assertEquals(HttpStatus.UNAUTHORIZED, entity.getStatusCode());
|
||||||
|
}
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
public void testHome() throws Exception {
|
public void testHome() throws Exception {
|
||||||
@SuppressWarnings("rawtypes")
|
@SuppressWarnings("rawtypes")
|
||||||
|
Loading…
Reference in New Issue
Block a user