java - 无法保护 Spring 引导管理执行器端点

Question

我正在尝试保护 Spring Boot 执行器端点。我在我的 /api REST 接口(interface)上有工作安全性，但尝试在内置端点上添加安全性似乎不起作用。

我已经在我的 application.properties 中设置了端点分组:

management.context-path=/management

我的 Java 配置中有这个

@Override
protected void configure( HttpSecurity http ) throws Exception
{
    http.csrf().disable();
    http.sessionManagement().sessionCreationPolicy( SessionCreationPolicy.STATELESS );

    http.authorizeRequests()
        .antMatchers( "/api/**" ).hasRole( "READONLY" )
        .antMatchers( "/management/**" ).hasRole( "ADMIN" );


    SecurityConfigurer<DefaultSecurityFilterChain, HttpSecurity> securityConfigurer = new XAuthTokenConfigurer( userDetailsServiceBean() );
    http.apply( securityConfigurer );
}

当我使用浏览器访问 /api 下的任何内容时，我会按预期返回 403。例如，当转到/management/info 时，我看到 JSON 被返回，而我也希望返回 403。

我还尝试将其添加到我的 application.properties 文件中:

management.security.role=ADMIN

但这也无济于事。

DEBUG 输出显示:

2014-05-02 10:15:30 DEBUG [localhost-startStop-1] ExpressionBasedFilterInvocationSecurityMetadataSource - 
Adding web access control expression 'hasRole('ROLE_READONLY')', for Ant [pattern='/api/**']

2014-05-02 10:15:30 DEBUG [localhost-startStop-1] ExpressionBasedFilterInvocationSecurityMetadataSource - 
Adding web access control expression 'hasRole('ROLE_ADMIN')', for Ant [pattern='/management/**']

然后我尝试 HTTP GET 的原因:

2014-05-02 10:16:39 DEBUG [http-nio-8443-exec-4] AntPathRequestMatcher - Checking match of request : '/management/info'; against '/css/**'
2014-05-02 10:16:39 DEBUG [http-nio-8443-exec-4] AntPathRequestMatcher - Checking match of request : '/management/info'; against '/js/**'
2014-05-02 10:16:39 DEBUG [http-nio-8443-exec-4] AntPathRequestMatcher - Checking match of request : '/management/info'; against '/images/**'
2014-05-02 10:16:39 DEBUG [http-nio-8443-exec-4] AntPathRequestMatcher - Checking match of request : '/management/info'; against '/**/favicon.ico'
2014-05-02 10:16:39 DEBUG [http-nio-8443-exec-4] AntPathRequestMatcher - Checking match of request : '/management/info'; against '/management/info'
2014-05-02 10:16:39 DEBUG [http-nio-8443-exec-4] FilterChainProxy - /management/info has an empty filter list

Answer 1

讲述这个故事的日志是:“/management/info 有一个空的过滤器列表”，因为它被明确标记为已忽略(/info 应该始终可用)。尝试其他执行器端点之一，看看它们的行为是否符合您的预期。如果您确实需要保护信息端点，您可以设置 endpoints.info.sensitive=true(我认为)。