Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix security config

Browse Source 
The management endpoints were still all mixed up
with the user endpoints. Fixed that and extracted
user endpoints in to conditional block so not
protected if path explicitly set to empty string.

[#53029715]
This commit is contained in:
Dave Syer
2013-08-22 11:43:17 +01:00
committed by Phillip Webb
parent 6498f0e8b8
commit 43fc107437
16 changed files with 23 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/SecurityAutoConfiguration.java
View File

@@ -17,7 +17,6 @@
package org.springframework.boot.actuate.autoconfigure;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import org.apache.commons.logging.Log;
@@ -141,12 +140,17 @@ public class SecurityAutoConfiguration {
http.httpBasic().and().anonymous().disable();
ExpressionUrlAuthorizationConfigurer<HttpSecurity> authorizeUrls = http
.authorizeUrls();
if (getEndpointPaths(true).length > 0) {
String[] paths = getEndpointPaths(true);
if (paths.length > 0) {
authorizeUrls.antMatchers(getEndpointPaths(true)).hasRole(
this.management.getUser().getRole());
}
authorizeUrls.antMatchers(getSecureApplicationPaths())
.hasRole(this.security.getBasic().getRole()).and().httpBasic();
paths = getSecureApplicationPaths();
if (paths.length > 0) {
authorizeUrls.antMatchers(getSecureApplicationPaths()).hasRole(
this.security.getBasic().getRole());
}
authorizeUrls.and().httpBasic();
}
// No cookies for service endpoints by default
@@ -164,7 +168,6 @@ public class SecurityAutoConfiguration {
list.add(path);
}
}
list.addAll(Arrays.asList(getEndpointPaths(true)));
return list.toArray(new String[list.size()]);
}