Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Change info endpoint to be secure and unexposed by default

Browse Source 
See gh-24715
This commit is contained in:
Hatef Palizgar
2021-01-21 13:31:53 -08:00
committed by Madhura Bhave
parent 0fc33b020d
commit 53c1e79810
14 changed files with 18 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
spring-boot-project/spring-boot-docs/src/docs/asciidoc/spring-boot-features.adoc
View File

@@ -3960,10 +3960,10 @@ You can register multiple relying parties under the `spring.security.saml2.relyi
[[boot-features-security-actuator]]
=== Actuator Security
For security purposes, all actuators other than `/health` and `/info` are disabled by default.
For security purposes, all actuators other than `/health` are disabled by default.
The configprop:management.endpoints.web.exposure.include[] property can be used to enable the actuators.
If Spring Security is on the classpath and no other `WebSecurityConfigurerAdapter` or `SecurityFilterChain` bean is present, all actuators other than `/health` and `/info` are secured by Spring Boot auto-configuration.
If Spring Security is on the classpath and no other `WebSecurityConfigurerAdapter` or `SecurityFilterChain` bean is present, all actuators other than `/health` are secured by Spring Boot auto-configuration.
If you define a custom `WebSecurityConfigurerAdapter` or `SecurityFilterChain` bean, Spring Boot auto-configuration will back off and you will be in full control of actuator access rules.
NOTE: Before setting the `management.endpoints.web.exposure.include`, ensure that the exposed actuators do not contain sensitive information and/or are secured by placing them behind a firewall or by something like Spring Security.