Question

我在端口6565上具有 / actuator / 端点（在我的情况下为 manage ）。是否可以仅在特定端口上禁用Spring Boot 2中的Security？目前，我只能从安全性中排除某些路径。如果我现在在/ manage /下的主应用程序端口1337下运行Enpoints，那将是不安全的。过去我们使用 management.security.enabled：false 还是该路径也相关？

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .antMatchers("/manage/**").permitAll()
                .anyRequest().authenticated().and().httpBasic().realmName("Hay, the Config Server is here");

    }
}

application.yml

spring:
  cloud:
    config:
      server:
        git:
          uri: https://bitbucket.xxx.net/scm/gpi/springconfiguration.git
          username: xxx
          password: xxx
          searchPaths: application-*
          force-pull: true
  security:
    user:
      name: xxxUser
      password: xxx
server:
  port: 1337
  address: 0.0.0.0
management:
    server:
      port: 6565
    metrics:
      export:
        prometheus:
          enabled: true
    endpoints:
      web:
        exposure:
          include: '*'
        base-path: /manage
    endpoint:
      prometheus:
        enabled: true

Answer 1

最后，我将其作为How can I tell spring security to apply authorizeRequests just for a specific port?

的有效解决方案

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Value("${management.server.port}")
    private int managementPort;

    @Value("${server.port}")
    private int apiPort;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .requestMatchers(forPortAndPath(managementPort, "/manage/**")).permitAll()
                .anyRequest().authenticated().and().httpBasic().realmName("Hay, the Config Server is here");

    }

    private RequestMatcher forPortAndPath(final int port, final String pathPattern) {
        return new AndRequestMatcher(forPort(port), new AntPathRequestMatcher(pathPattern));
    }

    private RequestMatcher forPortAndPath(final int port, final HttpMethod method,
                                          final String pathPattern) {
        return new AndRequestMatcher(forPort(port), new AntPathRequestMatcher(pathPattern, method.name()));
    }

    private RequestMatcher forPort(final int port) {
        return (HttpServletRequest request) -> port == request.getLocalPort();
    }

另一个解决方案是将路径添加到WebSecurity

@Value("${management.server.port:6565}")
private int managementPort;

@Value("${management.endpoints.web.base-path:/manage}")
private String managementPath;


@Override
public void configure(WebSecurity web) {
    if (securityConfiguration.getAuthenticationScenario()
            .equals(HwlPortalAuthenticationScenario.DISABLE_SECURITY)) {
        web.ignoring().antMatchers("/**");
    } else {
        web.ignoring().antMatchers(securityConfiguration.securityDisabledPaths().toArray(new String[]{}))
                .requestMatchers(forPortAndPath(managementPort,managementPath + "/**"));
    }
}

如何在Spring Boot 2中禁用管理端口上的安全性

1 个答案: