Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Harmonize endpoints exclude property

Browse Source 
Closes gh-11914
This commit is contained in:
Stephane Nicoll
2018-02-12 14:00:40 +01:00
parent 037b6d8ba2
commit 7473642f58
33 changed files with 161 additions and 135 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
spring-boot-project/spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc
View File

@@ -1151,15 +1151,15 @@ content into your application. Rather, pick only the properties that you need.
management.endpoints.enabled-by-default= # Enable or disable all endpoints by default.
# ENDPOINTS JMX CONFIGURATION ({sc-spring-boot-actuator-autoconfigure}/endpoint/jmx/JmxEndpointProperties.{sc-ext}[JmxEndpointProperties])
management.endpoints.jmx.expose=* # Endpoint IDs that should be exposed or '*' for all.
management.endpoints.jmx.exclude= # Endpoint IDs that should be excluded.
management.endpoints.jmx.domain=org.springframework.boot # Endpoints JMX domain name. Fallback to 'spring.jmx.default-domain' if set.
management.endpoints.jmx.exposure.include=* # Endpoint IDs that should be included or '*' for all.
management.endpoints.jmx.exposure.exclude= # Endpoint IDs that should be excluded.
management.endpoints.jmx.static-names=false # Additional static properties to append to all ObjectNames of MBeans representing Endpoints.
management.endpoints.jmx.unique-names=false # Whether to ensure that ObjectNames are modified in case of conflict.
# ENDPOINTS WEB CONFIGURATION ({sc-spring-boot-actuator-autoconfigure}/endpoint/web/WebEndpointProperties.{sc-ext}[WebEndpointProperties])
management.endpoints.web.expose=info,health # Endpoint IDs that should be exposed or '*' for all.
management.endpoints.web.exclude= # Endpoint IDs that should be excluded.
management.endpoints.web.exposure.include=info,health # Endpoint IDs that should be included or '*' for all.
management.endpoints.web.exposure.exclude= # Endpoint IDs that should be excluded.
management.endpoints.web.base-path=/actuator # Base path for Web endpoints. Relative to server.servlet.context-path or management.server.servlet.context-path if management.server.port is configured.
management.endpoints.web.path-mapping= # Mapping between endpoint IDs and the path that should expose them.

39
spring-boot-project/spring-boot-docs/src/main/asciidoc/production-ready-features.adoc
View File

@@ -197,7 +197,7 @@ disables all other endpoints:
NOTE: Disabled endpoints are removed entirely from the application context. If you want
to change only the technologies over which an endpoint is exposed, use the
<<production-ready-endpoints-exposing-endpoints, `expose` and `exclude` properties>>
<<production-ready-endpoints-exposing-endpoints, `include` and `exclude` properties>>
instead.
@@ -298,38 +298,38 @@ endpoints:
|===
To change which endpoints are exposed, use the following technology-specific `expose` and
To change which endpoints are exposed, use the following technology-specific `include` and
`exclude` properties:
[cols="3,1"]
|===
|Property | Default
|`management.endpoints.jmx.exclude`
|`management.endpoints.jmx.exposure.exclude`
|
|`management.endpoints.jmx.expose`
|`management.endpoints.jmx.exposure.include`
| `*`
|`management.endpoints.web.exclude`
|`management.endpoints.web.exposure.exclude`
|
|`management.endpoints.web.expose`
|`management.endpoints.web.exposure.include`
| `info, health`
|===
The `expose` property lists the IDs of the endpoints that are exposed. The `exclude`
The `include` property lists the IDs of the endpoints that are exposed. The `exclude`
property lists the IDs of the endpoints that should not be exposed. The `exclude`
property takes precedence over the `expose` property. Both `expose` and `exclude` properties
can be configured with a list of endpoint IDs.
property takes precedence over the `include` property. Both `include` and `exclude`
properties can be configured with a list of endpoint IDs.
For example, to stop exposing all endpoints over JMX and only expose the `health` and `info`
endpoints, use the following property:
For example, to stop exposing all endpoints over JMX and only expose the `health` and
`info` endpoints, use the following property:
[source,properties,indent=0]
----
management.endpoints.jmx.expose=health,info
management.endpoints.jmx.exposure.include=health,info
----
`*` can be used to select all endpoints. For example, to expose everything over HTTP
@@ -337,8 +337,8 @@ except the `env` and `beans` endpoints, use the following properties:
[source,properties,indent=0]
----
management.endpoints.web.expose=*
management.endpoints.web.exclude=env,beans
management.endpoints.web.exposure.include=*
management.endpoints.web.exposure.exclude=env,beans
----
NOTE: If your application is exposed publicly, we strongly recommend that you also
@@ -384,12 +384,12 @@ methods are also available on `EndpointRequest`. See the API documentation
If you deploy applications behind a firewall, you may prefer that all your actuator
endpoints can be accessed without requiring authentication. You can do so by changing the
`management.endpoints.web.expose` property, as follows:
`management.endpoints.web.exposure.include` property, as follows:
.application.properties
[source,properties,indent=0]
----
management.endpoints.web.expose=*
management.endpoints.web.exposure.include=*
----
Additionally, if Spring Security is present, you would need to add custom security
@@ -1014,11 +1014,12 @@ settings show an example of doing so in `application.properties`:
[[production-ready-disable-jmx-endpoints]]
=== Disabling JMX Endpoints
If you do not want to expose endpoints over JMX, you can set the
`management.endpoints.jmx.exclude` property to `*`, as shown in the following example:
`management.endpoints.jmx.exposure.exclude` property to `*`, as shown in the following
example:
[source,properties,indent=0]
----
management.endpoints.jmx.exclude=*
management.endpoints.jmx.exposure.exclude=*
----
@@ -1038,7 +1039,7 @@ Maven, you would add the following dependency:
----
The Jolokia endpoint can then be exposed by adding `jolokia` or `*` to the
`management.endpoints.web.expose` property. You can then access it by using
`management.endpoints.web.exposure.include` property. You can then access it by using
`/actuator/jolokia` on your management HTTP server.

19
spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc
View File

@@ -3131,15 +3131,18 @@ In other words, the two configurations in the following example use the Google p
[[boot-features-security-actuator]]
=== Actuator Security
For security purposes, all actuators other than `/health` and `/info` are disabled by default.
The `management.endpoints.web.expose` flag can be used to enable the actuators.
If Spring Security is on the classpath and no other WebSecurityConfigurerAdapter is present,
the actuators are secured by Spring Boot auto-config. If you define a custom `WebSecurityConfigurerAdapter`,
Spring Boot auto-config will back off and you will be in full control of actuator access rules.
For security purposes, all actuators other than `/health` and `/info` are disabled by
default. The `management.endpoints.web.exposure.include` property can be used to enable
the actuators.
NOTE: Before setting the `management.endpoints.web.expose`, ensure that the exposed actuators
do not contain sensitive information and/or are secured by placing them behind a firewall or by
something like Spring Security.
If Spring Security is on the classpath and no other WebSecurityConfigurerAdapter is
present, the actuators are secured by Spring Boot auto-config. If you define a custom
`WebSecurityConfigurerAdapter`, Spring Boot auto-config will back off and you will be in
full control of actuator access rules.
NOTE: Before setting the `management.endpoints.web.exposure.include`, ensure that the
exposed actuators do not contain sensitive information and/or are secured by placing them
behind a firewall or by something like Spring Security.