Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Provide security matchers for actuator links

Browse Source 
Fixes gh-12353
This commit is contained in:
Madhura Bhave
2018-03-07 18:52:48 -08:00
parent 7d1faa1c88
commit 89e42d40c5
7 changed files with 330 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
spring-boot-samples/spring-boot-sample-actuator-custom-security/src/test/java/sample/actuator/customsecurity/SampleActuatorCustomSecurityApplicationTests.java
View File

@@ -81,6 +81,16 @@ public class SampleActuatorCustomSecurityApplicationTests {
assertThat(entity.getBody()).contains("\"status\":\"UP\"");
}
@Test
public void actuatorLinksIsSecure() {
ResponseEntity<Object> entity = restTemplate().getForEntity("/actuator",
Object.class);
assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
entity = adminRestTemplate().getForEntity("/actuator",
Object.class);
assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
}
@Test
public void actuatorSecureEndpointWithAnonymous() {
ResponseEntity<Object> entity = restTemplate().getForEntity("/actuator/env",

10
spring-boot-samples/spring-boot-sample-secure-webflux/src/test/java/sample/secure/webflux/SampleSecureWebFluxCustomSecurityTests.java
View File

@@ -92,6 +92,16 @@ public class SampleSecureWebFluxCustomSecurityTests {
.accept(MediaType.APPLICATION_JSON).exchange().expectStatus().isOk();
}
@Test
public void actuatorLinksIsSecure() {
this.webClient.get().uri("/actuator").accept(MediaType.APPLICATION_JSON)
.exchange()
.expectStatus().isUnauthorized();
this.webClient.get().uri("/actuator").accept(MediaType.APPLICATION_JSON)
.header("Authorization", "basic " + getBasicAuthForAdmin()).exchange()
.expectStatus().isOk();
}
@Configuration
static class SecurityConfiguration {