Update "Securing Euereka server" section in docs.
This commit is contained in:
@@ -575,27 +575,26 @@ You can set your hostname at the run-time by using an environment variable -- fo
|
||||
=== Securing The Eureka Server
|
||||
|
||||
You can secure your Eureka server simply by adding Spring Security to your
|
||||
server's classpath via `spring-boot-starter-security`. By default when Spring Security is on the classpath it will require that
|
||||
server's classpath via `spring-boot-starter-security`. By default, when Spring Security is on the classpath it will require that
|
||||
a valid CSRF token be sent with every request to the app. Eureka clients will not generally possess a valid
|
||||
cross site request forgery (CSRF) token you will need to disable this requirement for the `/eureka/**` endpoints.
|
||||
For example:
|
||||
|
||||
[source,java,indent=0]
|
||||
----
|
||||
@EnableWebSecurity
|
||||
class WebSecurityConfig extends WebSecurityConfigurerAdapter {
|
||||
|
||||
@Override
|
||||
protected void configure(HttpSecurity http) throws Exception {
|
||||
http.csrf().ignoringAntMatchers("/eureka/**");
|
||||
super.configure(http);
|
||||
}
|
||||
@Bean
|
||||
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
|
||||
http.authorizeHttpRequests((authz) -> authz
|
||||
.anyRequest().authenticated())
|
||||
.httpBasic(withDefaults());
|
||||
http.csrf().ignoringRequestMatchers("/eureka/**");
|
||||
return http.build();
|
||||
}
|
||||
----
|
||||
|
||||
For more information on CSRF see the https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#csrf[Spring Security documentation].
|
||||
|
||||
A demo Eureka Server can be found in the Spring Cloud Samples https://github.com/spring-cloud-samples/eureka/tree/Eureka-With-Security[repo].
|
||||
A demo Eureka Server can be found in the Spring Cloud Samples https://github.com/spring-cloud-samples/eureka/tree/Eureka-With-Security-4.x[repo].
|
||||
|
||||
=== JDK 11 Support
|
||||
|
||||
|
||||
Reference in New Issue
Block a user