root
/
spring-boot
mirror of https://github.com/spring-projects/spring-boot.git
1
0
Fork 0
Code Issues Actions 12 Packages Projects Releases Wiki Activity

Add security.management.enabled flag

This commit is contained in:
Dave Syer 2013-09-06 19:54:15 +01:00
parent 5f8f062545
commit 8467a66e84
3 changed files with 26 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/SecurityAutoConfiguration.java
View File

@ -234,26 +234,28 @@ public class SecurityAutoConfiguration {
@Override
protected void configure(HttpSecurity http) throws Exception {
if (this.security.isRequireSsl()) {
http.requiresChannel().anyRequest().requiresSecure();
}
String[] paths = getEndpointPaths(true);
if (this.security.getBasic().isEnabled() && paths.length > 0) {
String[] paths = getEndpointPaths(true); // secure endpoints
if (paths.length > 0 && this.security.getManagement().isEnabled()) {
// Always protect them if present
if (this.security.isRequireSsl()) {
http.requiresChannel().anyRequest().requiresSecure();
}
http.exceptionHandling().authenticationEntryPoint(entryPoint());
http.requestMatchers().antMatchers(paths);
http.authorizeRequests().anyRequest()
.hasRole(this.security.getManagement().getRole()) //
.and().httpBasic() //
.and().anonymous().disable();
}
// No cookies for management endpoints by default
http.csrf().disable();
http.sessionManagement().sessionCreationPolicy(
this.security.getManagement().getSessions());
SecurityAutoConfiguration.configureHeaders(http.headers(),
this.security.getHeaders());
// No cookies for management endpoints by default
http.csrf().disable();
http.sessionManagement().sessionCreationPolicy(
this.security.getManagement().getSessions());
SecurityAutoConfiguration.configureHeaders(http.headers(),
this.security.getHeaders());
}
}

10
spring-boot-actuator/src/main/java/org/springframework/boot/actuate/properties/SecurityProperties.java
View File

@ -195,6 +195,8 @@ public class SecurityProperties {
public static class Management {
private boolean enabled = true;
private String role = "ADMIN";
private SessionCreationPolicy sessions = SessionCreationPolicy.STATELESS;
@ -215,6 +217,14 @@ public class SecurityProperties {
return this.role;
}
public boolean isEnabled() {
return this.enabled;
}
public void setEnabled(boolean enabled) {
this.enabled = enabled;
}
}
public static class User {

2
spring-boot-cli/src/main/java/org/springframework/boot/cli/compiler/autoconfigure/ReactorCompilerAutoConfiguration.java
View File

@ -23,7 +23,7 @@ import org.springframework.boot.cli.compiler.CompilerAutoConfiguration;
import org.springframework.boot.cli.compiler.DependencyCustomizer;
/**
* {@link CompilerAutoConfiguration} for the Recator.
* {@link CompilerAutoConfiguration} for the Reactor.
*
* @author Dave Syer
*/