Skip to content

Commit 3ef9b7e

Browse files
mbhavembhave
committed
Merge branch '2.4.x' into main
Closes gh-26612
2 parents 110c36e + 743ac4c commit 3ef9b7e

File tree

5 files changed

+123
-6
lines changed

5 files changed

+123
-6
lines changed

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.java

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
import org.springframework.security.config.Customizer;
3737
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
3838
import org.springframework.security.web.SecurityFilterChain;
39+
import org.springframework.util.ClassUtils;
3940

4041
/**
4142
* {@link EnableAutoConfiguration Auto-configuration} for Spring Security when actuator is
@@ -64,6 +65,9 @@ SecurityFilterChain managementSecurityFilterChain(HttpSecurity http) throws Exce
6465
requests.requestMatchers(EndpointRequest.to(HealthEndpoint.class)).permitAll();
6566
requests.anyRequest().authenticated();
6667
});
68+
if (ClassUtils.isPresent("org.springframework.web.servlet.DispatcherServlet", null)) {
69+
http.cors();
70+
}
6771
http.formLogin(Customizer.withDefaults());
6872
http.httpBasic(Customizer.withDefaults());
6973
return http.build();

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/integrationtest/JerseyEndpointIntegrationTests.java

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,18 +16,24 @@
1616

1717
package org.springframework.boot.actuate.autoconfigure.integrationtest;
1818

19+
import java.util.ArrayList;
20+
import java.util.Arrays;
21+
import java.util.List;
22+
1923
import org.glassfish.jersey.server.ResourceConfig;
2024
import org.junit.jupiter.api.Test;
2125

2226
import org.springframework.boot.actuate.autoconfigure.beans.BeansEndpointAutoConfiguration;
2327
import org.springframework.boot.actuate.autoconfigure.endpoint.EndpointAutoConfiguration;
2428
import org.springframework.boot.actuate.autoconfigure.endpoint.web.WebEndpointAutoConfiguration;
29+
import org.springframework.boot.actuate.autoconfigure.security.servlet.ManagementWebSecurityAutoConfiguration;
2530
import org.springframework.boot.actuate.autoconfigure.web.server.ManagementContextAutoConfiguration;
2631
import org.springframework.boot.actuate.endpoint.web.annotation.ControllerEndpoint;
2732
import org.springframework.boot.actuate.endpoint.web.annotation.RestControllerEndpoint;
2833
import org.springframework.boot.autoconfigure.AutoConfigurations;
2934
import org.springframework.boot.autoconfigure.jackson.JacksonAutoConfiguration;
3035
import org.springframework.boot.autoconfigure.jersey.JerseyAutoConfiguration;
36+
import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
3137
import org.springframework.boot.autoconfigure.web.servlet.ServletWebServerFactoryAutoConfiguration;
3238
import org.springframework.boot.test.context.FilteredClassLoader;
3339
import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
@@ -67,6 +73,20 @@ void actuatorEndpointsWhenUserProvidedResourceConfigBeanNotAvailable() {
6773
testJerseyEndpoints(new Class<?>[] { EndpointsConfiguration.class });
6874
}
6975

76+
@Test
77+
void actuatorEndpointsWhenSecurityAvailable() {
78+
WebApplicationContextRunner contextRunner = getContextRunner(
79+
new Class[] { EndpointsConfiguration.class, ResourceConfigConfiguration.class },
80+
getAutoconfigurations(SecurityAutoConfiguration.class, ManagementWebSecurityAutoConfiguration.class));
81+
contextRunner.run((context) -> {
82+
int port = context.getSourceApplicationContext(AnnotationConfigServletWebServerApplicationContext.class)
83+
.getWebServer().getPort();
84+
WebTestClient client = WebTestClient.bindToServer().baseUrl("http://localhost:" + port).build();
85+
client.get().uri("/actuator").exchange().expectStatus().isUnauthorized();
86+
});
87+
88+
}
89+
7090
protected void testJerseyEndpoints(Class<?>[] userConfigurations) {
7191
getContextRunner(userConfigurations).run((context) -> {
7292
int port = context.getSourceApplicationContext(AnnotationConfigServletWebServerApplicationContext.class)
@@ -78,18 +98,25 @@ protected void testJerseyEndpoints(Class<?>[] userConfigurations) {
7898
});
7999
}
80100

81-
WebApplicationContextRunner getContextRunner(Class<?>[] userConfigurations) {
101+
WebApplicationContextRunner getContextRunner(Class<?>[] userConfigurations,
102+
Class<?>... additionalAutoConfigurations) {
82103
FilteredClassLoader classLoader = new FilteredClassLoader(DispatcherServlet.class);
83104
return new WebApplicationContextRunner(AnnotationConfigServletWebServerApplicationContext::new)
84105
.withClassLoader(classLoader)
85-
.withConfiguration(AutoConfigurations.of(JacksonAutoConfiguration.class, JerseyAutoConfiguration.class,
86-
EndpointAutoConfiguration.class, ServletWebServerFactoryAutoConfiguration.class,
87-
WebEndpointAutoConfiguration.class, ManagementContextAutoConfiguration.class,
88-
BeansEndpointAutoConfiguration.class))
106+
.withConfiguration(AutoConfigurations.of(getAutoconfigurations(additionalAutoConfigurations)))
89107
.withUserConfiguration(userConfigurations)
90108
.withPropertyValues("management.endpoints.web.exposure.include:*", "server.port:0");
91109
}
92110

111+
private Class<?>[] getAutoconfigurations(Class<?>... additional) {
112+
List<Class<?>> autoconfigurations = new ArrayList<>(Arrays.asList(JacksonAutoConfiguration.class,
113+
JerseyAutoConfiguration.class, EndpointAutoConfiguration.class,
114+
ServletWebServerFactoryAutoConfiguration.class, WebEndpointAutoConfiguration.class,
115+
ManagementContextAutoConfiguration.class, BeansEndpointAutoConfiguration.class));
116+
autoconfigurations.addAll(Arrays.asList(additional));
117+
return autoconfigurations.toArray(new Class<?>[0]);
118+
}
119+
93120
@ControllerEndpoint(id = "controller")
94121
static class TestControllerEndpoint {
95122

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfigurationTests.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
import org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.OAuth2ResourceServerAutoConfiguration;
3434
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyAutoConfiguration;
3535
import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
36+
import org.springframework.boot.autoconfigure.web.servlet.WebMvcAutoConfiguration;
3637
import org.springframework.boot.test.context.FilteredClassLoader;
3738
import org.springframework.boot.test.context.assertj.AssertableWebApplicationContext;
3839
import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
@@ -67,7 +68,7 @@ class ManagementWebSecurityAutoConfigurationTests {
6768
private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner().withConfiguration(
6869
AutoConfigurations.of(HealthContributorAutoConfiguration.class, HealthEndpointAutoConfiguration.class,
6970
InfoEndpointAutoConfiguration.class, EnvironmentEndpointAutoConfiguration.class,
70-
EndpointAutoConfiguration.class, WebEndpointAutoConfiguration.class,
71+
EndpointAutoConfiguration.class, WebMvcAutoConfiguration.class, WebEndpointAutoConfiguration.class,
7172
SecurityAutoConfiguration.class, ManagementWebSecurityAutoConfiguration.class));
7273

7374
@Test

‎spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator/src/test/java/smoketest/actuator/CorsSampleActuatorApplicationTests.java

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
/*
2+
* Copyright 2012-2020 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package smoketest.actuator;
18+
19+
import java.net.URI;
20+
import java.util.Map;
21+
22+
import org.junit.jupiter.api.BeforeEach;
23+
import org.junit.jupiter.api.Test;
24+
25+
import org.springframework.beans.factory.annotation.Autowired;
26+
import org.springframework.boot.test.context.SpringBootTest;
27+
import org.springframework.boot.test.web.client.LocalHostUriTemplateHandler;
28+
import org.springframework.boot.test.web.client.TestRestTemplate;
29+
import org.springframework.boot.web.client.RestTemplateBuilder;
30+
import org.springframework.context.ApplicationContext;
31+
import org.springframework.http.HttpStatus;
32+
import org.springframework.http.RequestEntity;
33+
import org.springframework.http.ResponseEntity;
34+
import org.springframework.test.context.ActiveProfiles;
35+
36+
import static org.assertj.core.api.Assertions.assertThat;
37+
38+
/**
39+
* Integration test for cors preflight requests to management endpoints.
40+
*
41+
* @author Madhura Bhave
42+
*/
43+
@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
44+
@ActiveProfiles("cors")
45+
class CorsSampleActuatorApplicationTests {
46+
47+
private TestRestTemplate testRestTemplate;
48+
49+
@Autowired
50+
private ApplicationContext applicationContext;
51+
52+
@BeforeEach
53+
void setUp() {
54+
RestTemplateBuilder builder = new RestTemplateBuilder();
55+
LocalHostUriTemplateHandler handler = new LocalHostUriTemplateHandler(this.applicationContext.getEnvironment(),
56+
"http");
57+
builder = builder.uriTemplateHandler(handler);
58+
this.testRestTemplate = new TestRestTemplate(builder);
59+
}
60+
61+
@Test
62+
void endpointShouldReturnUnauthorized() {
63+
ResponseEntity<?> entity = this.testRestTemplate.getForEntity("/actuator/env", Map.class);
64+
assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
65+
}
66+
67+
@Test
68+
void preflightRequestToEndpointShouldReturnOk() throws Exception {
69+
RequestEntity<?> healthRequest = RequestEntity.options(new URI("/actuator/env"))
70+
.header("Origin", "http://localhost:8080").header("Access-Control-Request-Method", "GET").build();
71+
ResponseEntity<?> exchange = this.testRestTemplate.exchange(healthRequest, Map.class);
72+
assertThat(exchange.getStatusCode()).isEqualTo(HttpStatus.OK);
73+
}
74+
75+
@Test
76+
void preflightRequestWhenCorsConfigInvalidShouldReturnForbidden() throws Exception {
77+
RequestEntity<?> entity = RequestEntity.options(new URI("/actuator/env"))
78+
.header("Origin", "http://localhost:9095").header("Access-Control-Request-Method", "GET").build();
79+
ResponseEntity<byte[]> exchange = this.testRestTemplate.exchange(entity, byte[].class);
80+
assertThat(exchange.getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
81+
}
82+
83+
}

‎spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator/src/test/resources/application-cors.properties

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
management.endpoints.web.cors.allowed-origins=http://localhost:8080
2+
management.endpoints.web.cors.allowed-methods=GET

0 commit comments

Comments
 (0)