Remove concept of sensitivity from Actuator's endpoints
Closes gh-9924
This commit is contained in:
Andy Wilkinson
@@ -1084,86 +1084,66 @@ content into your application; rather pick only the properties that you need.
|
||||
|
||||
# ENDPOINTS ({sc-spring-boot-actuator}/endpoint/AbstractEndpoint.{sc-ext}[AbstractEndpoint] subclasses)
|
||||
endpoints.enabled=true # Enable endpoints.
|
||||
endpoints.sensitive= # Default endpoint sensitive setting.
|
||||
endpoints.auditevents.enabled= # Enable the endpoint.
|
||||
endpoints.auditevents.path= # Endpoint path.
|
||||
endpoints.auditevents.sensitive=false # Enable security on the endpoint.
|
||||
endpoints.autoconfig.enabled= # Enable the endpoint.
|
||||
endpoints.autoconfig.id= # Endpoint identifier.
|
||||
endpoints.autoconfig.path= # Endpoint path.
|
||||
endpoints.autoconfig.sensitive= # Mark if the endpoint exposes sensitive information.
|
||||
endpoints.beans.enabled= # Enable the endpoint.
|
||||
endpoints.beans.id= # Endpoint identifier.
|
||||
endpoints.beans.path= # Endpoint path.
|
||||
endpoints.beans.sensitive= # Mark if the endpoint exposes sensitive information.
|
||||
endpoints.configprops.enabled= # Enable the endpoint.
|
||||
endpoints.configprops.id= # Endpoint identifier.
|
||||
endpoints.configprops.keys-to-sanitize=password,secret,key,token,.*credentials.*,vcap_services # Keys that should be sanitized. Keys can be simple strings that the property ends with or regex expressions.
|
||||
endpoints.configprops.path= # Endpoint path.
|
||||
endpoints.configprops.sensitive= # Mark if the endpoint exposes sensitive information.
|
||||
endpoints.docs.curies.enabled=false # Enable the curie generation.
|
||||
endpoints.docs.enabled=true # Enable actuator docs endpoint.
|
||||
endpoints.docs.path=/docs #
|
||||
endpoints.docs.sensitive=false #
|
||||
endpoints.dump.enabled= # Enable the endpoint.
|
||||
endpoints.dump.id= # Endpoint identifier.
|
||||
endpoints.dump.path= # Endpoint path.
|
||||
endpoints.dump.sensitive= # Mark if the endpoint exposes sensitive information.
|
||||
endpoints.env.enabled= # Enable the endpoint.
|
||||
endpoints.env.id= # Endpoint identifier.
|
||||
endpoints.env.keys-to-sanitize=password,secret,key,token,.*credentials.*,vcap_services # Keys that should be sanitized. Keys can be simple strings that the property ends with or regex expressions.
|
||||
endpoints.env.path= # Endpoint path.
|
||||
endpoints.env.sensitive= # Mark if the endpoint exposes sensitive information.
|
||||
endpoints.flyway.enabled= # Enable the endpoint.
|
||||
endpoints.flyway.id= # Endpoint identifier.
|
||||
endpoints.flyway.sensitive= # Mark if the endpoint exposes sensitive information.
|
||||
endpoints.health.enabled= # Enable the endpoint.
|
||||
endpoints.health.id= # Endpoint identifier.
|
||||
endpoints.health.mapping.*= # Mapping of health statuses to HttpStatus codes. By default, registered health statuses map to sensible defaults (i.e. UP maps to 200).
|
||||
endpoints.health.path= # Endpoint path.
|
||||
endpoints.health.sensitive= # Mark if the endpoint exposes sensitive information.
|
||||
endpoints.health.time-to-live=1000 # Time to live for cached result, in milliseconds.
|
||||
endpoints.heapdump.enabled= # Enable the endpoint.
|
||||
endpoints.heapdump.path= # Endpoint path.
|
||||
endpoints.heapdump.sensitive= # Mark if the endpoint exposes sensitive information.
|
||||
endpoints.info.enabled= # Enable the endpoint.
|
||||
endpoints.info.id= # Endpoint identifier.
|
||||
endpoints.info.path= # Endpoint path.
|
||||
endpoints.info.sensitive= # Mark if the endpoint exposes sensitive information.
|
||||
endpoints.jolokia.enabled=true # Enable Jolokia endpoint.
|
||||
endpoints.jolokia.path=/jolokia # Endpoint URL path.
|
||||
endpoints.jolokia.sensitive=true # Enable security on the endpoint.
|
||||
endpoints.liquibase.enabled= # Enable the endpoint.
|
||||
endpoints.liquibase.id= # Endpoint identifier.
|
||||
endpoints.liquibase.sensitive= # Mark if the endpoint exposes sensitive information.
|
||||
endpoints.logfile.enabled=true # Enable the endpoint.
|
||||
endpoints.logfile.external-file= # External Logfile to be accessed.
|
||||
endpoints.logfile.path=/logfile # Endpoint URL path.
|
||||
endpoints.logfile.sensitive=true # Enable security on the endpoint.
|
||||
endpoints.loggers.enabled=true # Enable the endpoint.
|
||||
endpoints.loggers.id= # Endpoint identifier.
|
||||
endpoints.loggers.path=/logfile # Endpoint path.
|
||||
endpoints.loggers.sensitive=true # Mark if the endpoint exposes sensitive information.
|
||||
endpoints.mappings.enabled= # Enable the endpoint.
|
||||
endpoints.mappings.id= # Endpoint identifier.
|
||||
endpoints.mappings.path= # Endpoint path.
|
||||
endpoints.mappings.sensitive= # Mark if the endpoint exposes sensitive information.
|
||||
endpoints.metrics.enabled= # Enable the endpoint.
|
||||
endpoints.metrics.filter.enabled=true # Enable the metrics servlet filter.
|
||||
endpoints.metrics.filter.gauge-submissions=merged # Http filter gauge submissions (merged, per-http-method)
|
||||
endpoints.metrics.filter.counter-submissions=merged # Http filter counter submissions (merged, per-http-method)
|
||||
endpoints.metrics.id= # Endpoint identifier.
|
||||
endpoints.metrics.path= # Endpoint path.
|
||||
endpoints.metrics.sensitive= # Mark if the endpoint exposes sensitive information.
|
||||
endpoints.shutdown.enabled= # Enable the endpoint.
|
||||
endpoints.shutdown.id= # Endpoint identifier.
|
||||
endpoints.shutdown.path= # Endpoint path.
|
||||
endpoints.shutdown.sensitive= # Mark if the endpoint exposes sensitive information.
|
||||
endpoints.trace.enabled= # Enable the endpoint.
|
||||
endpoints.trace.filter.enabled=true # Enable the trace servlet filter.
|
||||
endpoints.trace.id= # Endpoint identifier.
|
||||
endpoints.trace.path= # Endpoint path.
|
||||
endpoints.trace.sensitive= # Mark if the endpoint exposes sensitive information.
|
||||
|
||||
# ENDPOINTS CORS CONFIGURATION ({sc-spring-boot-actuator}/autoconfigure/EndpointCorsProperties.{sc-ext}[EndpointCorsProperties])
|
||||
endpoints.cors.allow-credentials= # Set whether credentials are supported. When not set, credentials are not supported.
|
||||
|
||||
@@ -67,111 +67,142 @@ The following technology agnostic endpoints are available:
|
||||
|
||||
[cols="2,5,1"]
|
||||
|===
|
||||
| ID | Description | Sensitive Default
|
||||
| ID | Description
|
||||
|
||||
|`auditevents`
|
||||
|Exposes audit events information for the current application.
|
||||
|true
|
||||
|
||||
|`autoconfig`
|
||||
|Displays an auto-configuration report showing all auto-configuration candidates and the
|
||||
reason why they '`were`' or '`were not`' applied.
|
||||
|true
|
||||
|
||||
|`beans`
|
||||
|Displays a complete list of all the Spring beans in your application.
|
||||
|true
|
||||
|
||||
|`configprops`
|
||||
|Displays a collated list of all `@ConfigurationProperties`.
|
||||
|true
|
||||
|
||||
|`dump`
|
||||
|Performs a thread dump.
|
||||
|true
|
||||
|
||||
|`env`
|
||||
|Exposes properties from Spring's `ConfigurableEnvironment`.
|
||||
|true
|
||||
|
||||
|`flyway`
|
||||
|Shows any Flyway database migrations that have been applied.
|
||||
|true
|
||||
|
||||
|`health`
|
||||
|Shows application health information (when the application is secure, a simple '`status`'
|
||||
when accessed over an unauthenticated connection or full message details when
|
||||
authenticated).
|
||||
|false
|
||||
|Shows application health information.
|
||||
|
||||
|`info`
|
||||
|Displays arbitrary application info.
|
||||
|false
|
||||
|
||||
|`loggers`
|
||||
|Shows and modifies the configuration of loggers in the application.
|
||||
|true
|
||||
|
||||
|`liquibase`
|
||||
|Shows any Liquibase database migrations that have been applied.
|
||||
|true
|
||||
|
||||
|`metrics`
|
||||
|Shows '`metrics`' information for the current application.
|
||||
|true
|
||||
|
||||
|`mappings`
|
||||
|Displays a collated list of all `@RequestMapping` paths.
|
||||
|true
|
||||
|
||||
|`shutdown`
|
||||
|Allows the application to be gracefully shutdown (not enabled by default).
|
||||
|true
|
||||
|
||||
|`trace`
|
||||
|Displays trace information (by default the last 100 HTTP requests).
|
||||
|true
|
||||
|===
|
||||
|
||||
If you are using Spring MVC, the following additional endpoints can also be used:
|
||||
|
||||
[cols="2,5,1"]
|
||||
|===
|
||||
| ID | Description | Sensitive Default
|
||||
| ID | Description
|
||||
|
||||
|`heapdump`
|
||||
|Returns a GZip compressed `hprof` heap dump file.
|
||||
|true
|
||||
|
||||
|`jolokia`
|
||||
|Exposes JMX beans over HTTP (when Jolokia is on the classpath).
|
||||
|true
|
||||
|
||||
|`logfile`
|
||||
|Returns the contents of the logfile (if `logging.file` or `logging.path` properties have
|
||||
been set). Supports the use of the HTTP `Range` header to retrieve part of the log file's
|
||||
content.
|
||||
|true
|
||||
|===
|
||||
|
||||
NOTE: Depending on how an endpoint is exposed, the `sensitive` property may be used as
|
||||
a security hint. For example, sensitive endpoints will require a username/password when
|
||||
they are accessed over HTTP (or simply disabled if web security is not enabled).
|
||||
[[production-ready-endpoints-security]]
|
||||
=== Securing endpoints
|
||||
By default all HTTP endpoints are secured such that only users that have an `ACTUATOR`
|
||||
role may access them. Security is enforced using the standard
|
||||
`HttpServletRequest.isUserInRole` method.
|
||||
|
||||
TIP: Use the `management.security.roles` property if you want something different to
|
||||
`ACTUATOR`.
|
||||
|
||||
If you are deploying applications behind a firewall, you may prefer that all your actuator
|
||||
endpoints can be accessed without requiring authentication. You can do this by changing
|
||||
the `management.security.enabled` property:
|
||||
|
||||
.application.properties
|
||||
[source,properties,indent=0]
|
||||
----
|
||||
management.security.enabled=false
|
||||
----
|
||||
|
||||
NOTE: By default, actuator endpoints are exposed on the same port that serves regular
|
||||
HTTP traffic. Take care not to accidentally expose sensitive information if you change
|
||||
the `management.security.enabled` property.
|
||||
|
||||
If you're deploying applications publicly, you may want to add '`Spring Security`' to
|
||||
handle user authentication. When '`Spring Security`' is added, by default '`basic`'
|
||||
authentication will be used with the username `user` and a generated password (which is
|
||||
printed on the console when the application starts).
|
||||
|
||||
TIP: Generated passwords are logged as the application starts. Search for '`Using default
|
||||
security password`'.
|
||||
|
||||
You can use Spring properties to change the username and password and to change the
|
||||
security role(s) required to access the endpoints. For example, you might set the following
|
||||
in your `application.properties`:
|
||||
|
||||
[source,properties,indent=0]
|
||||
----
|
||||
security.user.name=admin
|
||||
security.user.password=secret
|
||||
management.security.roles=SUPERUSER
|
||||
----
|
||||
|
||||
If your application has custom security configuration and you want all your actuator
|
||||
endpoints to be accessible without authentication, you need to explicitly configure that
|
||||
in your security configuration. Along with that, you need to change the
|
||||
`management.security.enabled` property to `false`.
|
||||
|
||||
If your custom security configuration secures your actuator endpoints, you also need to
|
||||
ensure that the authenticated user has the roles specified under
|
||||
`management.security.roles`.
|
||||
|
||||
TIP: If you don't have a use case for exposing basic health information to unauthenticated
|
||||
users, and you have secured the actuator endpoints with custom security, you can set
|
||||
`management.security.enabled` to `false`. This will inform Spring Boot to skip the
|
||||
additional role check.
|
||||
|
||||
|
||||
|
||||
[[production-ready-customizing-endpoints]]
|
||||
=== Customizing endpoints
|
||||
Endpoints can be customized using Spring properties. You can change if an endpoint is
|
||||
`enabled`, if it is considered `sensitive` and even its `id`.
|
||||
`enabled` and its `id`.
|
||||
|
||||
For example, here is an `application.properties` that changes the sensitivity and id
|
||||
of the `beans` endpoint and also enables `shutdown`.
|
||||
For example, here is an `application.properties` that changes the id of the `beans`
|
||||
endpoint and also enables `shutdown`.
|
||||
|
||||
[source,properties,indent=0]
|
||||
----
|
||||
endpoints.beans.id=springbeans
|
||||
endpoints.beans.sensitive=false
|
||||
endpoints.shutdown.enabled=true
|
||||
----
|
||||
|
||||
@@ -188,16 +219,6 @@ For example, the following will disable _all_ endpoints except for `info`:
|
||||
endpoints.info.enabled=true
|
||||
----
|
||||
|
||||
Likewise, you can also choose to globally set the "`sensitive`" flag of all endpoints. By
|
||||
default, the sensitive flag depends on the type of endpoint (see the table above).
|
||||
For example, to mark _all_ endpoints as sensitive except `info`:
|
||||
|
||||
[source,properties,indent=0]
|
||||
----
|
||||
endpoints.sensitive=true
|
||||
endpoints.info.sensitive=false
|
||||
----
|
||||
|
||||
|
||||
|
||||
[[production-ready-endpoint-hypermedia]]
|
||||
@@ -272,12 +293,6 @@ overall health status. If no `HealthIndicator` returns a status that is known to
|
||||
|
||||
|
||||
=== Security with HealthIndicators
|
||||
Information returned by `HealthIndicators` is often somewhat sensitive in nature. For
|
||||
example, you probably don't want to publish details of your database server to the
|
||||
world. For this reason, by default, only the health status is exposed over an
|
||||
unauthenticated HTTP connection. If you are happy for complete health information to always
|
||||
be exposed you can set `endpoints.health.sensitive` to `false`.
|
||||
|
||||
Health responses are also cached to prevent "`denial of service`" attacks. Use the
|
||||
`endpoints.health.time-to-live` property if you want to change the default cache period
|
||||
of 1000 milliseconds.
|
||||
@@ -545,64 +560,6 @@ is exposed as `/application/health`.
|
||||
|
||||
|
||||
|
||||
[[production-ready-sensitive-endpoints]]
|
||||
=== Accessing sensitive endpoints
|
||||
By default all sensitive HTTP endpoints are secured such that only users that have an
|
||||
`ACTUATOR` role may access them. Security is enforced using the standard
|
||||
`HttpServletRequest.isUserInRole` method.
|
||||
|
||||
TIP: Use the `management.security.roles` property if you want something different to
|
||||
`ACTUATOR`.
|
||||
|
||||
If you are deploying applications behind a firewall, you may prefer that all your actuator
|
||||
endpoints can be accessed without requiring authentication. You can do this by changing
|
||||
the `management.security.enabled` property:
|
||||
|
||||
.application.properties
|
||||
[source,properties,indent=0]
|
||||
----
|
||||
management.security.enabled=false
|
||||
----
|
||||
|
||||
NOTE: By default, actuator endpoints are exposed on the same port that serves regular
|
||||
HTTP traffic. Take care not to accidentally expose sensitive information if you change
|
||||
the `management.security.enabled` property.
|
||||
|
||||
If you're deploying applications publicly, you may want to add '`Spring Security`' to
|
||||
handle user authentication. When '`Spring Security`' is added, by default '`basic`'
|
||||
authentication will be used with the username `user` and a generated password (which is
|
||||
printed on the console when the application starts).
|
||||
|
||||
TIP: Generated passwords are logged as the application starts. Search for '`Using default
|
||||
security password`'.
|
||||
|
||||
You can use Spring properties to change the username and password and to change the
|
||||
security role(s) required to access the endpoints. For example, you might set the following
|
||||
in your `application.properties`:
|
||||
|
||||
[source,properties,indent=0]
|
||||
----
|
||||
security.user.name=admin
|
||||
security.user.password=secret
|
||||
management.security.roles=SUPERUSER
|
||||
----
|
||||
|
||||
If your application has custom security configuration and you want all your actuator endpoints
|
||||
to be accessible without authentication, you need to explicitly configure that in your
|
||||
security configuration. Along with that, you need to change the `management.security.enabled`
|
||||
property to `false`.
|
||||
|
||||
If your custom security configuration secures your actuator endpoints, you also need to ensure that
|
||||
the authenticated user has the roles specified under `management.security.roles`.
|
||||
|
||||
TIP: If you don't have a use case for exposing basic health information to unauthenticated users,
|
||||
and you have secured the actuator endpoints with custom security, you can set `management.security.enabled`
|
||||
to `false`. This will inform Spring Boot to skip the additional role check.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
[[production-ready-customizing-management-server-context-path]]
|
||||
=== Customizing the management endpoint paths
|
||||
Sometimes it is useful to customize the prefix for the management endpoints.
|
||||
@@ -763,7 +720,7 @@ Sample summarized HTTP response for status "DOWN" (notice the 503 status code):
|
||||
{"status":"DOWN"}
|
||||
----
|
||||
|
||||
Sample detailed HTTP response:
|
||||
Sample detailed HTTP response:
|
||||
|
||||
[source,indent=0]
|
||||
----
|
||||
@@ -789,30 +746,6 @@ Sample detailed HTTP response:
|
||||
}
|
||||
----
|
||||
|
||||
The above-described restrictions can be enhanced, thereby allowing only authenticated
|
||||
users full access to the health endpoint in a secure application. To do so, set
|
||||
`endpoints.health.sensitive` to `true`. Here's a summary of behavior (with default
|
||||
`sensitive` flag value "`false`" indicated in bold):
|
||||
|
||||
|====
|
||||
| `management.security.enabled` | `endpoints.health.sensitive` | Unauthenticated | Authenticated (with right role)
|
||||
|
||||
|false
|
||||
|*
|
||||
|Full content
|
||||
|Full content
|
||||
|
||||
|true
|
||||
|**false**
|
||||
|Status only
|
||||
|Full content
|
||||
|
||||
|true
|
||||
|true
|
||||
|No content
|
||||
|Full content
|
||||
|====
|
||||
|
||||
|
||||
|
||||
[[production-ready-jmx]]
|
||||
|
||||
Reference in New Issue
Block a user