Update "Securing Euereka server" section in docs.

This commit is contained in:
Olga MaciaszekSharma
2023-06-16 16:28:24 +02:00
parent 5fe67e7543
commit cd9cd7be5a

View File

@@ -575,27 +575,26 @@ You can set your hostname at the run-time by using an environment variable -- fo
=== Securing The Eureka Server
You can secure your Eureka server simply by adding Spring Security to your
server's classpath via `spring-boot-starter-security`. By default when Spring Security is on the classpath it will require that
server's classpath via `spring-boot-starter-security`. By default, when Spring Security is on the classpath it will require that
a valid CSRF token be sent with every request to the app. Eureka clients will not generally possess a valid
cross site request forgery (CSRF) token you will need to disable this requirement for the `/eureka/**` endpoints.
For example:
[source,java,indent=0]
----
@EnableWebSecurity
class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().ignoringAntMatchers("/eureka/**");
super.configure(http);
}
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests((authz) -> authz
.anyRequest().authenticated())
.httpBasic(withDefaults());
http.csrf().ignoringRequestMatchers("/eureka/**");
return http.build();
}
----
For more information on CSRF see the https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#csrf[Spring Security documentation].
A demo Eureka Server can be found in the Spring Cloud Samples https://github.com/spring-cloud-samples/eureka/tree/Eureka-With-Security[repo].
A demo Eureka Server can be found in the Spring Cloud Samples https://github.com/spring-cloud-samples/eureka/tree/Eureka-With-Security-4.x[repo].
=== JDK 11 Support