mirror of
https://github.com/spring-projects/spring-boot.git
synced 2024-09-03 04:26:12 +08:00
Add Spring MVC-generated path suffixes to endpoint paths
Spring Security doesn't know that Spring MVC maps /foo, /foo.json and /foo/ all to the same handler. This change explicitly adds suffixes to the actuator endpoint matchers so they are properly protected.
This commit is contained in:
parent
97adb5c1b3
commit
72d7c286c0
Notes:
Phillip Webb
2014-04-06 21:58:34 -07:00
Fixes gh-636
@ -221,7 +221,13 @@ public class ManagementSecurityAutoConfiguration {
|
||||
List<String> paths = new ArrayList<String>(endpoints.size());
|
||||
for (MvcEndpoint endpoint : endpoints) {
|
||||
if (endpoint.isSensitive() == secure) {
|
||||
paths.add(endpointHandlerMapping.getPrefix() + endpoint.getPath());
|
||||
String path = endpointHandlerMapping.getPrefix() + endpoint.getPath();
|
||||
paths.add(path);
|
||||
if (secure) {
|
||||
// Add Spring MVC-generated additional paths
|
||||
paths.add(path + "/");
|
||||
paths.add(path + ".*");
|
||||
}
|
||||
}
|
||||
}
|
||||
return paths.toArray(new String[paths.size()]);
|
||||
|
@ -70,6 +70,23 @@ public class SampleActuatorApplicationTests {
|
||||
.containsKey("Set-Cookie"));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testMetricsIsSecure() throws Exception {
|
||||
@SuppressWarnings("rawtypes")
|
||||
ResponseEntity<Map> entity = new TestRestTemplate().getForEntity(
|
||||
"http://localhost:8080/metrics", Map.class);
|
||||
assertEquals(HttpStatus.UNAUTHORIZED, entity.getStatusCode());
|
||||
entity = new TestRestTemplate().getForEntity(
|
||||
"http://localhost:8080/metrics/", Map.class);
|
||||
assertEquals(HttpStatus.UNAUTHORIZED, entity.getStatusCode());
|
||||
entity = new TestRestTemplate().getForEntity(
|
||||
"http://localhost:8080/metrics/foo", Map.class);
|
||||
assertEquals(HttpStatus.UNAUTHORIZED, entity.getStatusCode());
|
||||
entity = new TestRestTemplate().getForEntity(
|
||||
"http://localhost:8080/metrics.json", Map.class);
|
||||
assertEquals(HttpStatus.UNAUTHORIZED, entity.getStatusCode());
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testHome() throws Exception {
|
||||
@SuppressWarnings("rawtypes")
|
||||
|
Loading…
Reference in New Issue
Block a user