Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Move "Sanitize Sensitive Values" in docs

Browse Source 
Closes gh-35917
This commit is contained in:
Moritz Halbritter
2023-10-27 14:16:48 +02:00
parent 8a27326ba6
commit 43a3fbf449
4 changed files with 41 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
spring-boot-project/spring-boot-docs/src/docs/asciidoc/actuator/endpoints.adoc
View File

@@ -33,9 +33,11 @@ The following technology-agnostic endpoints are available:
| `configprops`
| Displays a collated list of all `@ConfigurationProperties`.
Subject to <<actuator#actuator.endpoints.sanitization, sanitization>>.
| `env`
| Exposes properties from Spring's `ConfigurableEnvironment`.
Subject to <<actuator#actuator.endpoints.sanitization, sanitization>>.
| `flyway`
| Shows any Flyway database migrations that have been applied.
@@ -70,6 +72,7 @@ The following technology-agnostic endpoints are available:
|`quartz`
|Shows information about Quartz Scheduler jobs.
Subject to <<actuator#actuator.endpoints.sanitization, sanitization>>.
| `scheduledtasks`
| Displays the scheduled tasks in your application.
@@ -277,6 +280,36 @@ NOTE: The `management.endpoint.<name>` prefix uniquely identifies the endpoint t
[[actuator.endpoints.sanitization]]
=== Sanitize Sensitive Values
Information returned by the `/env`, `/configprops` and `/quartz` endpoints can be somewhat sensitive.
All values are sanitized by default (that is replaced by `+******+`).
Viewing original values in the unsanitized form can be configured per endpoint using the `showValues` property for that endpoint.
This property can be configured to have the following values:
- `ALWAYS` - all values are shown in their unsanitized form to all users
- `NEVER` - all values are always sanitized (that is replaced by `+******+`)
- `WHEN_AUTHORIZED` - all values are shown in their unsanitized form to authorized users
For HTTP endpoints, a user is considered to be authorized if they have authenticated and have the roles configured by the endpoint's roles property.
By default, any authenticated user is authorized.
For JMX endpoints, all users are always authorized.
[source,yaml,indent=0,subs="verbatim",configprops,configblocks]
----
management:
endpoint:
env:
show-values: WHEN_AUTHORIZED
roles: "admin"
----
The configuration above enables the ability for all users with the `admin` role to view all values in their original form from the `/env` endpoint.
NOTE: When `show-values` is set to `ALWAYS` or `WHEN_AUTHORIZED` any sanitization applied by a `<<howto#howto.actuator.customizing-sanitization, SanitizingFunction>>` will still be applied.
[[actuator.endpoints.hypermedia]]
=== Hypermedia for Actuator Web Endpoints
A "`discovery page`" is added with links to all the endpoints.