From 68fcea7b9ad3830f539cc00101e1a9d0bb17e085 Mon Sep 17 00:00:00 2001 From: Stephane Nicoll Date: Tue, 22 Aug 2017 11:40:39 +0200 Subject: [PATCH] Migrate endpoints.cors to management.endpoints.cors This commit moves CORS properties out of the endpoints namespace as they do not refer to a "cors" endpoint but rather to the CORS configuration of all endpoints. Closes gh-10053 --- .../CorsEndpointProperties.java} | 6 ++-- ...ructureManagementContextConfiguration.java | 7 ++--- ...itional-spring-configuration-metadata.json | 6 ++-- .../mvc/MvcEndpointCorsIntegrationTests.java | 28 +++++++++---------- .../appendix-application-properties.adoc | 16 +++++------ .../asciidoc/production-ready-features.adoc | 8 +++--- .../resources/application-cors.properties | 4 +-- 7 files changed, 37 insertions(+), 38 deletions(-) rename spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/endpoint/{EndpointCorsProperties.java => infrastructure/CorsEndpointProperties.java} (93%) diff --git a/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/endpoint/EndpointCorsProperties.java b/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/endpoint/infrastructure/CorsEndpointProperties.java similarity index 93% rename from spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/endpoint/EndpointCorsProperties.java rename to spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/endpoint/infrastructure/CorsEndpointProperties.java index 20469d088c..dd06d63d5d 100644 --- a/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/endpoint/EndpointCorsProperties.java +++ b/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/endpoint/infrastructure/CorsEndpointProperties.java @@ -14,7 +14,7 @@ * limitations under the License. */ -package org.springframework.boot.actuate.autoconfigure.endpoint; +package org.springframework.boot.actuate.autoconfigure.endpoint.infrastructure; import java.util.ArrayList; import java.util.List; @@ -27,8 +27,8 @@ import org.springframework.boot.context.properties.ConfigurationProperties; * @author Andy Wilkinson * @since 2.0.0 */ -@ConfigurationProperties(prefix = "endpoints.cors") -public class EndpointCorsProperties { +@ConfigurationProperties(prefix = "management.endpoints.cors") +public class CorsEndpointProperties { /** * Comma-separated list of origins to allow. '*' allows all origins. When not set, diff --git a/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/endpoint/infrastructure/WebEndpointInfrastructureManagementContextConfiguration.java b/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/endpoint/infrastructure/WebEndpointInfrastructureManagementContextConfiguration.java index 8e687c7b65..37fff4eb87 100644 --- a/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/endpoint/infrastructure/WebEndpointInfrastructureManagementContextConfiguration.java +++ b/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/endpoint/infrastructure/WebEndpointInfrastructureManagementContextConfiguration.java @@ -24,7 +24,6 @@ import org.glassfish.jersey.server.ResourceConfig; import org.springframework.beans.factory.ObjectProvider; import org.springframework.boot.actuate.autoconfigure.ManagementContextConfiguration; -import org.springframework.boot.actuate.autoconfigure.endpoint.EndpointCorsProperties; import org.springframework.boot.actuate.autoconfigure.web.ManagementServerProperties; import org.springframework.boot.autoconfigure.condition.ConditionalOnBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; @@ -50,7 +49,7 @@ import org.springframework.web.servlet.DispatcherServlet; */ @ConditionalOnWebApplication @ManagementContextConfiguration -@EnableConfigurationProperties({ EndpointCorsProperties.class, +@EnableConfigurationProperties({ CorsEndpointProperties.class, ManagementServerProperties.class }) class WebEndpointInfrastructureManagementContextConfiguration { @@ -91,7 +90,7 @@ class WebEndpointInfrastructureManagementContextConfiguration { @ConditionalOnMissingBean public WebEndpointServletHandlerMapping webEndpointServletHandlerMapping( EndpointProvider provider, - EndpointCorsProperties corsProperties, + CorsEndpointProperties corsProperties, ManagementServerProperties managementServerProperties) { WebEndpointServletHandlerMapping handlerMapping = new WebEndpointServletHandlerMapping( managementServerProperties.getContextPath(), provider.getEndpoints(), @@ -103,7 +102,7 @@ class WebEndpointInfrastructureManagementContextConfiguration { } private CorsConfiguration getCorsConfiguration( - EndpointCorsProperties properties) { + CorsEndpointProperties properties) { if (CollectionUtils.isEmpty(properties.getAllowedOrigins())) { return null; } diff --git a/spring-boot-actuator/src/main/resources/META-INF/additional-spring-configuration-metadata.json b/spring-boot-actuator/src/main/resources/META-INF/additional-spring-configuration-metadata.json index 8f5387becc..ef05003228 100644 --- a/spring-boot-actuator/src/main/resources/META-INF/additional-spring-configuration-metadata.json +++ b/spring-boot-actuator/src/main/resources/META-INF/additional-spring-configuration-metadata.json @@ -200,7 +200,7 @@ } ],"hints": [ { - "name": "endpoints.cors.allowed-headers", + "name": "management.endpoints.cors.allowed-headers", "values": [ { "value": "*" @@ -213,7 +213,7 @@ ] }, { - "name": "endpoints.cors.allowed-methods", + "name": "management.endpoints.cors.allowed-methods", "values": [ { "value": "*" @@ -226,7 +226,7 @@ ] }, { - "name": "endpoints.cors.allowed-origins", + "name": "management.endpoints.cors.allowed-origins", "values": [ { "value": "*" diff --git a/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/mvc/MvcEndpointCorsIntegrationTests.java b/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/mvc/MvcEndpointCorsIntegrationTests.java index f0c197d87f..a4ad66e6e5 100644 --- a/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/mvc/MvcEndpointCorsIntegrationTests.java +++ b/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/mvc/MvcEndpointCorsIntegrationTests.java @@ -77,7 +77,7 @@ public class MvcEndpointCorsIntegrationTests { @Test public void settingAllowedOriginsEnablesCors() throws Exception { - TestPropertyValues.of("endpoints.cors.allowed-origins:foo.example.com") + TestPropertyValues.of("management.endpoints.cors.allowed-origins:foo.example.com") .applyTo(this.context); createMockMvc() .perform(options("/application/beans").header("Origin", "bar.example.com") @@ -88,7 +88,7 @@ public class MvcEndpointCorsIntegrationTests { @Test public void maxAgeDefaultsTo30Minutes() throws Exception { - TestPropertyValues.of("endpoints.cors.allowed-origins:foo.example.com") + TestPropertyValues.of("management.endpoints.cors.allowed-origins:foo.example.com") .applyTo(this.context); performAcceptedCorsRequest() .andExpect(header().string(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "1800")); @@ -96,15 +96,15 @@ public class MvcEndpointCorsIntegrationTests { @Test public void maxAgeCanBeConfigured() throws Exception { - TestPropertyValues.of("endpoints.cors.allowed-origins:foo.example.com", - "endpoints.cors.max-age: 2400").applyTo(this.context); + TestPropertyValues.of("management.endpoints.cors.allowed-origins:foo.example.com", + "management.endpoints.cors.max-age: 2400").applyTo(this.context); performAcceptedCorsRequest() .andExpect(header().string(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "2400")); } @Test public void requestsWithDisallowedHeadersAreRejected() throws Exception { - TestPropertyValues.of("endpoints.cors.allowed-origins:foo.example.com") + TestPropertyValues.of("management.endpoints.cors.allowed-origins:foo.example.com") .applyTo(this.context); createMockMvc() .perform(options("/application/beans").header("Origin", "foo.example.com") @@ -116,8 +116,8 @@ public class MvcEndpointCorsIntegrationTests { @Test public void allowedHeadersCanBeConfigured() throws Exception { TestPropertyValues - .of("endpoints.cors.allowed-origins:foo.example.com", - "endpoints.cors.allowed-headers:Alpha,Bravo") + .of("management.endpoints.cors.allowed-origins:foo.example.com", + "management.endpoints.cors.allowed-headers:Alpha,Bravo") .applyTo(this.context); createMockMvc() .perform(options("/application/beans").header("Origin", "foo.example.com") @@ -129,7 +129,7 @@ public class MvcEndpointCorsIntegrationTests { @Test public void requestsWithDisallowedMethodsAreRejected() throws Exception { - TestPropertyValues.of("endpoints.cors.allowed-origins:foo.example.com") + TestPropertyValues.of("management.endpoints.cors.allowed-origins:foo.example.com") .applyTo(this.context); createMockMvc() .perform(options("/application/health") @@ -140,8 +140,8 @@ public class MvcEndpointCorsIntegrationTests { @Test public void allowedMethodsCanBeConfigured() throws Exception { - TestPropertyValues.of("endpoints.cors.allowed-origins:foo.example.com", - "endpoints.cors.allowed-methods:GET,HEAD").applyTo(this.context); + TestPropertyValues.of("management.endpoints.cors.allowed-origins:foo.example.com", + "management.endpoints.cors.allowed-methods:GET,HEAD").applyTo(this.context); createMockMvc() .perform(options("/application/beans") .header(HttpHeaders.ORIGIN, "foo.example.com") @@ -152,16 +152,16 @@ public class MvcEndpointCorsIntegrationTests { @Test public void credentialsCanBeAllowed() throws Exception { - TestPropertyValues.of("endpoints.cors.allowed-origins:foo.example.com", - "endpoints.cors.allow-credentials:true").applyTo(this.context); + TestPropertyValues.of("management.endpoints.cors.allowed-origins:foo.example.com", + "management.endpoints.cors.allow-credentials:true").applyTo(this.context); performAcceptedCorsRequest().andExpect( header().string(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true")); } @Test public void credentialsCanBeDisabled() throws Exception { - TestPropertyValues.of("endpoints.cors.allowed-origins:foo.example.com", - "endpoints.cors.allow-credentials:false").applyTo(this.context); + TestPropertyValues.of("management.endpoints.cors.allowed-origins:foo.example.com", + "management.endpoints.cors.allow-credentials:false").applyTo(this.context); performAcceptedCorsRequest().andExpect( header().doesNotExist(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS)); } diff --git a/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc b/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc index 42a62872a9..74f6f81b50 100644 --- a/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc +++ b/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc @@ -1114,14 +1114,6 @@ content into your application; rather pick only the properties that you need. endpoints.configprops.keys-to-sanitize=password,secret,key,token,.*credentials.*,vcap_services # Keys that should be sanitized. Keys can be simple strings that the property ends with or regex expressions. endpoints.configprops.web.enabled=true # Expose the configprops endpoint as a Web endpoint. - # ENDPOINTS CORS CONFIGURATION ({sc-spring-boot-actuator}/autoconfigure/EndpointCorsProperties.{sc-ext}[EndpointCorsProperties]) - endpoints.cors.allow-credentials= # Set whether credentials are supported. When not set, credentials are not supported. - endpoints.cors.allowed-headers= # Comma-separated list of headers to allow in a request. '*' allows all headers. - endpoints.cors.allowed-methods= # Comma-separated list of methods to allow. '*' allows all methods. When not set, defaults to GET. - endpoints.cors.allowed-origins= # Comma-separated list of origins to allow. '*' allows all origins. When not set, CORS support is disabled. - endpoints.cors.exposed-headers= # Comma-separated list of headers to include in a response. - endpoints.cors.max-age=1800 # How long, in seconds, the response from a pre-flight request can be cached by clients. - # ENVIRONMENT ENDPOINT ({sc-spring-boot-actuator}/endpoint/EnvironmentEndpoint.{sc-ext}[EnvironmentEndpoint]) endpoints.env.cache.time-to-live=0 # Maximum time in milliseconds that a response can be cached. endpoints.env.enabled=true # Enable the env endpoint. @@ -1238,6 +1230,14 @@ content into your application; rather pick only the properties that you need. management.cloudfoundry.enabled=true # Enable extended Cloud Foundry actuator endpoints. management.cloudfoundry.skip-ssl-validation=false # Skip SSL verification for Cloud Foundry actuator endpoint security calls. + # ENDPOINTS CORS CONFIGURATION ({sc-spring-boot-actuator}/autoconfigure/EndpointCorsProperties.{sc-ext}[EndpointCorsProperties]) + management.endpoints.cors.allow-credentials= # Set whether credentials are supported. When not set, credentials are not supported. + management.cors.allowed-headers= # Comma-separated list of headers to allow in a request. '*' allows all headers. + management.endpoints.cors.allowed-methods= # Comma-separated list of methods to allow. '*' allows all methods. When not set, defaults to GET. + management.endpoints.cors.allowed-origins= # Comma-separated list of origins to allow. '*' allows all origins. When not set, CORS support is disabled. + management.endpoints.cors.exposed-headers= # Comma-separated list of headers to include in a response. + management.endpoints.cors.max-age=1800 # How long, in seconds, the response from a pre-flight request can be cached by clients. + # HEALTH INDICATORS management.health.db.enabled=true # Enable database health check. management.health.cassandra.enabled=true # Enable cassandra health check. diff --git a/spring-boot-docs/src/main/asciidoc/production-ready-features.adoc b/spring-boot-docs/src/main/asciidoc/production-ready-features.adoc index 741531c092..ffc7237afa 100644 --- a/spring-boot-docs/src/main/asciidoc/production-ready-features.adoc +++ b/spring-boot-docs/src/main/asciidoc/production-ready-features.adoc @@ -243,13 +243,13 @@ MVC or Spring WebFlux, Actuator's web endpoints can be configured to support suc scenarios. CORS support is disabled by default and is only enabled once the -`endpoints.cors.allowed-origins` property has been set. The configuration below permits -`GET` and `POST` calls from the `example.com` domain: +`management.endpoints.cors.allowed-origins` property has been set. The configuration below +permits `GET` and `POST` calls from the `example.com` domain: [source,properties,indent=0] ---- - endpoints.cors.allowed-origins=http://example.com - endpoints.cors.allowed-methods=GET,POST + management.endpoints.cors.allowed-origins=http://example.com + management.endpoints.cors.allowed-methods=GET,POST ---- TIP: Check {sc-spring-boot-actuator}/autoconfigure/EndpointCorsProperties.{sc-ext}[EndpointCorsProperties] diff --git a/spring-boot-samples/spring-boot-sample-actuator/src/test/resources/application-cors.properties b/spring-boot-samples/spring-boot-sample-actuator/src/test/resources/application-cors.properties index 2bfb6b6cdb..9c03501893 100644 --- a/spring-boot-samples/spring-boot-sample-actuator/src/test/resources/application-cors.properties +++ b/spring-boot-samples/spring-boot-sample-actuator/src/test/resources/application-cors.properties @@ -1,2 +1,2 @@ -endpoints.cors.allowed-origins=http://localhost:8080 -endpoints.cors.allowed-methods=GET \ No newline at end of file +management.endpoints.cors.allowed-origins=http://localhost:8080 +management.endpoints.cors.allowed-methods=GET \ No newline at end of file