Skip to content

Commit 27fee5f

Browse files
committed
Configure filter to process preflight requests for webflux actuator endpoints
Fixes gh-24541
1 parent 29d1e22 commit 27fee5f

File tree

4 files changed

+71
-4
lines changed

4 files changed

+71
-4
lines changed

spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/reactive/ReactiveManagementWebSecurityAutoConfiguration.java

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,12 @@
3434
import org.springframework.context.annotation.Configuration;
3535
import org.springframework.security.config.Customizer;
3636
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
37+
import org.springframework.security.config.web.server.SecurityWebFiltersOrder;
3738
import org.springframework.security.config.web.server.ServerHttpSecurity;
3839
import org.springframework.security.web.server.SecurityWebFilterChain;
3940
import org.springframework.security.web.server.WebFilterChainProxy;
41+
import org.springframework.web.cors.reactive.PreFlightRequestHandler;
42+
import org.springframework.web.cors.reactive.PreFlightRequestWebFilter;
4043

4144
/**
4245
* {@link EnableAutoConfiguration Auto-configuration} for Reactive Spring Security when
@@ -57,11 +60,13 @@
5760
public class ReactiveManagementWebSecurityAutoConfiguration {
5861

5962
@Bean
60-
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) throws Exception {
63+
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http, PreFlightRequestHandler handler) {
6164
http.authorizeExchange((exchanges) -> {
6265
exchanges.matchers(EndpointRequest.to(HealthEndpoint.class, InfoEndpoint.class)).permitAll();
6366
exchanges.anyExchange().authenticated();
6467
});
68+
PreFlightRequestWebFilter filter = new PreFlightRequestWebFilter(handler);
69+
http.addFilterAt(filter, SecurityWebFiltersOrder.CORS);
6570
http.httpBasic(Customizer.withDefaults());
6671
http.formLogin(Customizer.withDefaults());
6772
return http.build();

spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/security/reactive/ReactiveManagementWebSecurityAutoConfigurationTests.java

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
import org.springframework.boot.autoconfigure.security.oauth2.resource.reactive.ReactiveOAuth2ResourceServerAutoConfiguration;
3636
import org.springframework.boot.autoconfigure.security.reactive.ReactiveSecurityAutoConfiguration;
3737
import org.springframework.boot.autoconfigure.security.reactive.ReactiveUserDetailsServiceAutoConfiguration;
38+
import org.springframework.boot.autoconfigure.web.reactive.WebFluxAutoConfiguration;
3839
import org.springframework.boot.test.context.assertj.AssertableReactiveWebApplicationContext;
3940
import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner;
4041
import org.springframework.context.ApplicationContext;
@@ -68,9 +69,9 @@ class ReactiveManagementWebSecurityAutoConfigurationTests {
6869
private final ReactiveWebApplicationContextRunner contextRunner = new ReactiveWebApplicationContextRunner()
6970
.withConfiguration(AutoConfigurations.of(HealthContributorAutoConfiguration.class,
7071
HealthEndpointAutoConfiguration.class, InfoEndpointAutoConfiguration.class,
71-
EnvironmentEndpointAutoConfiguration.class, EndpointAutoConfiguration.class,
72-
WebEndpointAutoConfiguration.class, ReactiveSecurityAutoConfiguration.class,
73-
ReactiveUserDetailsServiceAutoConfiguration.class,
72+
WebFluxAutoConfiguration.class, EnvironmentEndpointAutoConfiguration.class,
73+
EndpointAutoConfiguration.class, WebEndpointAutoConfiguration.class,
74+
ReactiveSecurityAutoConfiguration.class, ReactiveUserDetailsServiceAutoConfiguration.class,
7475
ReactiveManagementWebSecurityAutoConfiguration.class));
7576

7677
@Test
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/*
2+
* Copyright 2012-2021 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package smoketest.secure.webflux;
18+
19+
import org.junit.jupiter.api.Test;
20+
21+
import org.springframework.beans.factory.annotation.Autowired;
22+
import org.springframework.boot.test.context.SpringBootTest;
23+
import org.springframework.context.ApplicationContext;
24+
import org.springframework.test.context.ActiveProfiles;
25+
import org.springframework.test.web.reactive.server.WebTestClient;
26+
27+
/**
28+
* Integration test for cors preflight requests to management endpoints.
29+
*
30+
* @author Madhura Bhave
31+
*/
32+
@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
33+
@ActiveProfiles("cors")
34+
class CorsSampleActuatorApplicationTests {
35+
36+
@Autowired
37+
private WebTestClient webClient;
38+
39+
@Autowired
40+
private ApplicationContext applicationContext;
41+
42+
@Test
43+
void endpointShouldReturnUnauthorized() {
44+
this.webClient.get().uri("/actuator/env").exchange().expectStatus().isUnauthorized();
45+
}
46+
47+
@Test
48+
void preflightRequestToEndpointShouldReturnOk() throws Exception {
49+
this.webClient.options().uri("/actuator/env").header("Origin", "http://localhost:8080")
50+
.header("Access-Control-Request-Method", "GET").exchange().expectStatus().isOk();
51+
}
52+
53+
@Test
54+
void preflightRequestWhenCorsConfigInvalidShouldReturnForbidden() throws Exception {
55+
this.webClient.options().uri("/actuator/env").header("Origin", "http://localhost:9095")
56+
.header("Access-Control-Request-Method", "GET").exchange().expectStatus().isForbidden();
57+
}
58+
59+
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
management.endpoints.web.cors.allowed-origins=http://localhost:8080
2+
management.endpoints.web.cors.allowed-methods=GET

0 commit comments

Comments
 (0)