Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Really disable security for app endpoints

Browse Source 
If the user sets security.basic.enabled=false we should just
back away from the non-management endpoints completely.
Previously the Spring Security filter was still added but with
no authentication, creating complications when unexpected
headers etc. are added by Spring Security.
This commit is contained in:
Dave Syer
2013-09-04 10:17:00 +01:00
committed by Phillip Webb
parent 8a1e39c4dc
commit 5d7101fb5a
2 changed files with 37 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/SecurityAutoConfiguration.java
View File

@@ -33,6 +33,7 @@ import org.springframework.boot.actuate.properties.SecurityProperties.User;
import org.springframework.boot.actuate.web.ErrorController;
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.context.annotation.Bean;
@@ -107,6 +108,7 @@ public class SecurityAutoConfiguration {
@Bean
@ConditionalOnMissingBean({ ApplicationWebSecurityConfigurerAdapter.class })
@ConditionalOnExpression("${security.basic.enabled:true}")
public WebSecurityConfigurerAdapter applicationWebSecurityConfigurerAdapter() {
return new ApplicationWebSecurityConfigurerAdapter();
}