如何在 Spring Boot 2 中禁用管理端口的安全性

Question

我在端口 6565 上有/actuator/端点(在我的例子中是管理(。是否可以仅在特定端口的 Spring 引导 2 中禁用安全性？目前，我只能从安全性中排除某些路径。如果我现在在/manage/下的主应用程序端口 1337 下运行 Enpoints，那将是不安全的。过去我们使用management.security.enabled： false还是该路径也相关？

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/manage/**").permitAll()
.anyRequest().authenticated().and().httpBasic().realmName("Hay, the Config Server is here");
}
}

应用程序.yml

spring:
cloud:
config:
server:
git:
uri: https://bitbucket.xxx.net/scm/gpi/springconfiguration.git
username: xxx
password: xxx
searchPaths: application-*
force-pull: true
security:
user:
name: xxxUser
password: xxx
server:
port: 1337
address: 0.0.0.0
management:
server:
port: 6565
metrics:
export:
prometheus:
enabled: true
endpoints:
web:
exposure:
include: '*'
base-path: /manage
endpoint:
prometheus:
enabled: true

Answer 1

我最终将其作为此处找到的工作解决方案 如何告诉 spring security 仅针对特定端口应用授权请求？

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Value("${management.server.port}")
private int managementPort;
@Value("${server.port}")
private int apiPort;
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.requestMatchers(forPortAndPath(managementPort, "/manage/**")).permitAll()
.anyRequest().authenticated().and().httpBasic().realmName("Hay, the Config Server is here");
}
private RequestMatcher forPortAndPath(final int port, final String pathPattern) {
return new AndRequestMatcher(forPort(port), new AntPathRequestMatcher(pathPattern));
}
private RequestMatcher forPortAndPath(final int port, final HttpMethod method,
final String pathPattern) {
return new AndRequestMatcher(forPort(port), new AntPathRequestMatcher(pathPattern, method.name()));
}
private RequestMatcher forPort(final int port) {
return (HttpServletRequest request) -> port == request.getLocalPort();
}

另一种解决方案是将路径添加到网络安全

@Value("${management.server.port:6565}")
private int managementPort;
@Value("${management.endpoints.web.base-path:/manage}")
private String managementPath;

@Override
public void configure(WebSecurity web) {
if (securityConfiguration.getAuthenticationScenario()
.equals(HwlPortalAuthenticationScenario.DISABLE_SECURITY)) {
web.ignoring().antMatchers("/**");
} else {
web.ignoring().antMatchers(securityConfiguration.securityDisabledPaths().toArray(new String[]{}))
.requestMatchers(forPortAndPath(managementPort,managementPath + "/**"));
}
}