diff --git a/spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/reactive/CloudFoundryReactiveHealthEndpointWebExtensionTests.java b/spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/reactive/CloudFoundryReactiveHealthEndpointWebExtensionTests.java index 03386b8565..1284ca3021 100644 --- a/spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/reactive/CloudFoundryReactiveHealthEndpointWebExtensionTests.java +++ b/spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/reactive/CloudFoundryReactiveHealthEndpointWebExtensionTests.java @@ -44,27 +44,27 @@ public class CloudFoundryReactiveHealthEndpointWebExtensionTests { private ReactiveWebApplicationContextRunner contextRunner = new ReactiveWebApplicationContextRunner() .withPropertyValues("VCAP_APPLICATION={}") - .withConfiguration( - AutoConfigurations.of(ReactiveSecurityAutoConfiguration.class, - ReactiveUserDetailsServiceAutoConfiguration.class, - WebFluxAutoConfiguration.class, JacksonAutoConfiguration.class, - HttpMessageConvertersAutoConfiguration.class, - PropertyPlaceholderAutoConfiguration.class, - ReactiveCloudFoundryActuatorAutoConfigurationTests.WebClientCustomizerConfig.class, - WebClientAutoConfiguration.class, ManagementContextAutoConfiguration.class, - EndpointAutoConfiguration.class, WebEndpointAutoConfiguration.class, - HealthIndicatorAutoConfiguration.class, HealthEndpointAutoConfiguration.class, - ReactiveCloudFoundryActuatorAutoConfiguration.class)); + .withConfiguration(AutoConfigurations.of( + ReactiveSecurityAutoConfiguration.class, + ReactiveUserDetailsServiceAutoConfiguration.class, + WebFluxAutoConfiguration.class, JacksonAutoConfiguration.class, + HttpMessageConvertersAutoConfiguration.class, + PropertyPlaceholderAutoConfiguration.class, + ReactiveCloudFoundryActuatorAutoConfigurationTests.WebClientCustomizerConfig.class, + WebClientAutoConfiguration.class, + ManagementContextAutoConfiguration.class, + EndpointAutoConfiguration.class, WebEndpointAutoConfiguration.class, + HealthIndicatorAutoConfiguration.class, + HealthEndpointAutoConfiguration.class, + ReactiveCloudFoundryActuatorAutoConfiguration.class)); @Test public void healthDetailsAlwaysPresent() { - this.contextRunner - .run((context) -> { - CloudFoundryReactiveHealthEndpointWebExtension extension = context - .getBean(CloudFoundryReactiveHealthEndpointWebExtension.class); - assertThat(extension.health().block().getBody().getDetails()) - .isNotEmpty(); - }); + this.contextRunner.run((context) -> { + CloudFoundryReactiveHealthEndpointWebExtension extension = context + .getBean(CloudFoundryReactiveHealthEndpointWebExtension.class); + assertThat(extension.health().block().getBody().getDetails()).isNotEmpty(); + }); } } diff --git a/spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/servlet/CloudFoundryHealthEndpointWebExtensionTests.java b/spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/servlet/CloudFoundryHealthEndpointWebExtensionTests.java index 5bffba51c6..a9e8817fd6 100644 --- a/spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/servlet/CloudFoundryHealthEndpointWebExtensionTests.java +++ b/spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/servlet/CloudFoundryHealthEndpointWebExtensionTests.java @@ -45,29 +45,26 @@ public class CloudFoundryHealthEndpointWebExtensionTests { private WebApplicationContextRunner contextRunner = new WebApplicationContextRunner() .withPropertyValues("VCAP_APPLICATION={}") - .withConfiguration( - AutoConfigurations.of(SecurityAutoConfiguration.class, - WebMvcAutoConfiguration.class, JacksonAutoConfiguration.class, - DispatcherServletAutoConfiguration.class, - HttpMessageConvertersAutoConfiguration.class, - PropertyPlaceholderAutoConfiguration.class, - RestTemplateAutoConfiguration.class, - ManagementContextAutoConfiguration.class, - ServletManagementContextAutoConfiguration.class, - EndpointAutoConfiguration.class, WebEndpointAutoConfiguration.class, - HealthIndicatorAutoConfiguration.class, - HealthEndpointAutoConfiguration.class, - CloudFoundryActuatorAutoConfiguration.class)); + .withConfiguration(AutoConfigurations.of(SecurityAutoConfiguration.class, + WebMvcAutoConfiguration.class, JacksonAutoConfiguration.class, + DispatcherServletAutoConfiguration.class, + HttpMessageConvertersAutoConfiguration.class, + PropertyPlaceholderAutoConfiguration.class, + RestTemplateAutoConfiguration.class, + ManagementContextAutoConfiguration.class, + ServletManagementContextAutoConfiguration.class, + EndpointAutoConfiguration.class, WebEndpointAutoConfiguration.class, + HealthIndicatorAutoConfiguration.class, + HealthEndpointAutoConfiguration.class, + CloudFoundryActuatorAutoConfiguration.class)); @Test public void healthDetailsAlwaysPresent() { - this.contextRunner - .run((context) -> { - CloudFoundryHealthEndpointWebExtension extension = context - .getBean(CloudFoundryHealthEndpointWebExtension.class); - assertThat(extension.getHealth().getBody() - .getDetails()).isNotEmpty(); - }); + this.contextRunner.run((context) -> { + CloudFoundryHealthEndpointWebExtension extension = context + .getBean(CloudFoundryHealthEndpointWebExtension.class); + assertThat(extension.getHealth().getBody().getDetails()).isNotEmpty(); + }); } } diff --git a/spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/health/HealthEndpointWebExtension.java b/spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/health/HealthEndpointWebExtension.java index 1d1ae54c48..c134bdcac2 100644 --- a/spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/health/HealthEndpointWebExtension.java +++ b/spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/health/HealthEndpointWebExtension.java @@ -60,8 +60,7 @@ public class HealthEndpointWebExtension { Health health = this.delegate.health(); Integer status = this.statusHttpMapper.mapStatus(health.getStatus()); if (showDetails == ShowDetails.NEVER - || (showDetails == ShowDetails.WHEN_AUTHENTICATED - && principal == null)) { + || (showDetails == ShowDetails.WHEN_AUTHENTICATED && principal == null)) { health = Health.status(health.getStatus()).build(); } return new WebEndpointResponse<>(health, status); diff --git a/spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc b/spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc index 945adfd638..6319d37f22 100644 --- a/spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc +++ b/spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc @@ -3023,21 +3023,23 @@ commonly used locations. [[boot-features-security-webflux]] === WebFlux Security -Similar to Spring MVC applications, you can secure your WebFlux applications by adding the `spring-boot-starter-security` dependency. -The default security configuration is implemented in `ReactiveSecurityAutoConfiguration` and in -the classes imported from there (`WebFluxSecurityConfiguration` for web security -and `ReactiveAuthenticationManagerConfiguration` for authentication configuration, which is also -relevant in non-web applications). To switch off the default web application security -configuration completely, you can add a bean of type `WebFilterChainProxy` (doing -so does not disable the authentication manager configuration or Actuator's security). +Similar to Spring MVC applications, you can secure your WebFlux applications by adding +the `spring-boot-starter-security` dependency. The default security configuration is +implemented in `ReactiveSecurityAutoConfiguration` and in the classes imported from there +(`WebFluxSecurityConfiguration` for web security and +`ReactiveAuthenticationManagerConfiguration` for authentication configuration, which is +also relevant in non-web applications). To switch off the default web application security +configuration completely, you can add a bean of type `WebFilterChainProxy` (doing so does +not disable the authentication manager configuration or Actuator's security). To also switch off the authentication manager configuration, you can add a bean of type `ReactiveUserDetailsService` or `ReactiveAuthenticationManager`. Access rules can be configured by adding a custom `SecurityWebFilterChain`. Spring Boot provides convenience methods that can be used to override access rules for actuator -endpoints and static resources. `EndpointRequest` can be used to create a `ServerWebExchangeMatcher` -that is based on the `management.endpoints.web.base-path` property. +endpoints and static resources. `EndpointRequest` can be used to create a +`ServerWebExchangeMatcher` that is based on the `management.endpoints.web.base-path` +property. `PathRequest` can be used to create a `ServerWebExchangeMatcher` for resources in commonly used locations. @@ -3046,10 +3048,11 @@ For example, you can customize your security configuration by adding something l [source,java,indent=0] ---- -include::{code-examples}/web/security/CustomWebFluxSecurityExample.java[tag=custom-webflux-security] +include::{code-examples}/web/security/CustomWebFluxSecurityExample.java[tag=configuration] ---- + [[boot-features-security-oauth2]] === OAuth2 https://oauth.net/2/[OAuth2] is a widely used authorization framework that is supported by diff --git a/spring-boot-project/spring-boot-docs/src/main/java/org/springframework/boot/docs/web/security/CustomWebFluxSecurityExample.java b/spring-boot-project/spring-boot-docs/src/main/java/org/springframework/boot/docs/web/security/CustomWebFluxSecurityExample.java index e4479587b0..852c54bbb7 100644 --- a/spring-boot-project/spring-boot-docs/src/main/java/org/springframework/boot/docs/web/security/CustomWebFluxSecurityExample.java +++ b/spring-boot-project/spring-boot-docs/src/main/java/org/springframework/boot/docs/web/security/CustomWebFluxSecurityExample.java @@ -30,6 +30,8 @@ import org.springframework.security.web.server.SecurityWebFilterChain; @EnableWebFluxSecurity public class CustomWebFluxSecurityExample { + // @formatter:off + // tag::configuration[] @Bean public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) { http @@ -40,6 +42,7 @@ public class CustomWebFluxSecurityExample { .formLogin(); return http.build(); } + // end::configuration[] + // @formatter:on } -