- Mastering Spring Boot 2.0
- Dinesh Rajput
- 328字
- 2021-06-25 21:29:21
Securing the Actuator endpoints
The Actuator's endpoints provide many insights into your Spring application to callers, but some of that information might be unsafe if you expose it to the caller. For example, the /shutdown endpoint can kill your application in production. So the /shutdown endpoint can be very dangerous for your application if you expose it publicly. Similarly, many endpoints in Spring Boot's Actuator expose information that might be very sensitive. So, you have to secure those Actuator endpoints and make them only available to authorized callers. You can use Spring Security to make secure the Actuator endpoints.
Although Spring Boot will not apply any security on your behalf, it does provide some convenient RequestMatchers that can be used in combination with Spring Security. In a Spring Boot application, this means adding the Security Starter as a build dependency and letting security auto-configuration take care of locking down the application, including the Actuator endpoints.
Let's add the following Starter dependency for Spring Security:
<dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency>
It will secure all Actuator endpoints, but you can disable basic security as follows:
In the application.properties file:
security.basic.enabled=false
In the application.yml file, it looks like this:
basic: enabled: false
The preceding configuration change leaves only the sensitive Actuator endpoints secured and leaves the rest open for access.
Now you can secure sensitive endpoints by defining the default security properties, such username, password, and role, in the application.properties file:
security.user.name=admin security.user.password=secret management.security.role=SUPERUSER
The preceding configuration will secure the Actuator endpoints. If any call reaches these endpoints, then it asks for username and password. That means no one can access these Actuator endpoints without authentication.
This Spring Security configuration is provided by the auto-configuration of the Spring Boot. You can also customize the Spring Security configuration to lock some of the more dangerous Actuator endpoints such as /shutdown or provide this Actuator endpoint for a very specific role.
Let's see what changes are introduced with Spring Boot 2.0.
- Office 2016辦公應用從入門到精通
- Word/Excel/PPT 2016 商務應用傻瓜書
- Word 2003辦公應用實戰從入門到精通
- 普通WPS Word規范排版公文格式
- Office 2003辦公應用實戰從入門到精通
- 中文版AutoCAD 2012基礎與應用培訓教程
- PPT2013制作超級應用大全(實戰案例版)
- Excel數據處理與統計初步(第4版)
- PowerPoint 2010辦公專家從入門到精通(精編版)
- Word/Excel/PPT辦公應用從入門到精通
- AI智能辦公實戰108招:ChatGPT+Word+PowerPoint+WPS
- Excel公式與函數大辭典
- Excel也可以很好玩(職場故事版)
- Excel 2016會計與財務管理從入門到精通
- PowerPoint 2016入門與提高