Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Only hide /health details if the app is actually secure

Browse Source 
Also gives the user the option to override (by setting
endpoints.health.sensitive=false).

Fixes gh-1977 in a slightly different way
This commit is contained in:
Dave Syer
2014-11-25 16:30:10 +00:00
parent 337e9bd013
commit 3bb598a421
7 changed files with 108 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc
View File

@@ -402,9 +402,8 @@ content into your application; rather pick only the properties that you need.
endpoints.env.enabled=true
endpoints.env.keys-to-sanitize=password,secret,key # suffix or regex
endpoints.health.id=health
endpoints.health.sensitive=false
endpoints.health.sensitive=true
endpoints.health.enabled=true
endpoints.health.restrict-anonymous-access=true
endpoints.health.time-to-live=1000
endpoints.info.id=info
endpoints.info.sensitive=false

4
spring-boot-docs/src/main/asciidoc/production-ready-features.adoc
View File

@@ -413,7 +413,7 @@ If you don't want to expose endpoints over HTTP you can set the management port
[[production-ready-health-access-restrictions]]
=== Health endpoint anonymous access restrictions
The information exposed by the health endpoint varies depending on whether or not it's
accessed anonymously. When accessed anonymously, any details about the server's health
accessed anonymously. By default, when accessed anonymously, any details about the server's health
are hidden and the endpoint will simply indicate whether or not the server is up or
down. Furthermore, when accessed anonymously, the response is cached for a configurable
period to prevent the endpoint being used in a denial of service attack.
@@ -421,7 +421,7 @@ The `endpoints.health.time-to-live` property is used to configure the caching pe
milliseconds. It defaults to 1000, i.e. one second.
The above-described restrictions can be disabled, thereby allowing anonymous users full
access to the health endpoint. To do so, set `endpoints.health.restrict-anonymous-access`
access to the health endpoint. To do so, set `endpoints.health.sensitive`
to `false`.