From 3b28b1cadeaf0c2112de90a7662883afc0901c9e Mon Sep 17 00:00:00 2001 From: Phillip Webb Date: Mon, 29 Jul 2019 12:13:31 +0100 Subject: [PATCH] Don't use static final security matcher Using static final matchers breaks the build because they have state that's not reset across tests. See gh-17525 --- .../ReactiveManagementWebSecurityAutoConfiguration.java | 6 +----- .../servlet/ManagementWebSecurityConfigurerAdapter.java | 6 +----- 2 files changed, 2 insertions(+), 10 deletions(-) diff --git a/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/reactive/ReactiveManagementWebSecurityAutoConfiguration.java b/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/reactive/ReactiveManagementWebSecurityAutoConfiguration.java index 1907e983e7..bec5da10c6 100644 --- a/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/reactive/ReactiveManagementWebSecurityAutoConfiguration.java +++ b/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/reactive/ReactiveManagementWebSecurityAutoConfiguration.java @@ -19,7 +19,6 @@ package org.springframework.boot.actuate.autoconfigure.security.reactive; import org.springframework.boot.actuate.autoconfigure.endpoint.web.WebEndpointAutoConfiguration; import org.springframework.boot.actuate.autoconfigure.health.HealthEndpointAutoConfiguration; import org.springframework.boot.actuate.autoconfigure.info.InfoEndpointAutoConfiguration; -import org.springframework.boot.actuate.autoconfigure.security.reactive.EndpointRequest.EndpointServerWebExchangeMatcher; import org.springframework.boot.actuate.health.HealthEndpoint; import org.springframework.boot.actuate.info.InfoEndpoint; import org.springframework.boot.autoconfigure.AutoConfigureAfter; @@ -57,13 +56,10 @@ import org.springframework.security.web.server.WebFilterChainProxy; ReactiveOAuth2ResourceServerAutoConfiguration.class }) public class ReactiveManagementWebSecurityAutoConfiguration { - private static final EndpointServerWebExchangeMatcher HEALTH_OR_INFO_ENDPOINT = EndpointRequest - .to(HealthEndpoint.class, InfoEndpoint.class); - @Bean public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) throws Exception { http.authorizeExchange((exchanges) -> { - exchanges.matchers(HEALTH_OR_INFO_ENDPOINT).permitAll(); + exchanges.matchers(EndpointRequest.to(HealthEndpoint.class, InfoEndpoint.class)).permitAll(); exchanges.anyExchange().authenticated(); }); http.httpBasic(Customizer.withDefaults()); diff --git a/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityConfigurerAdapter.java b/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityConfigurerAdapter.java index 4ccf4390a2..707d866952 100644 --- a/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityConfigurerAdapter.java +++ b/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityConfigurerAdapter.java @@ -16,7 +16,6 @@ package org.springframework.boot.actuate.autoconfigure.security.servlet; -import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest.EndpointRequestMatcher; import org.springframework.boot.actuate.health.HealthEndpoint; import org.springframework.boot.actuate.info.InfoEndpoint; import org.springframework.context.annotation.Configuration; @@ -39,13 +38,10 @@ import org.springframework.security.config.annotation.web.configuration.WebSecur @Configuration(proxyBeanMethods = false) class ManagementWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter { - private static final EndpointRequestMatcher HEALTH_OR_INFO_ENDPOINT = EndpointRequest.to(HealthEndpoint.class, - InfoEndpoint.class); - @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests((requests) -> { - requests.requestMatchers(HEALTH_OR_INFO_ENDPOINT).permitAll(); + requests.requestMatchers(EndpointRequest.to(HealthEndpoint.class, InfoEndpoint.class)).permitAll(); requests.anyRequest().authenticated(); }); http.formLogin(Customizer.withDefaults());