Skip to content

Commit 743ac4c

Browse files
mbhavembhave
committed
Merge branch '2.3.x' into 2.4.x
Closes gh-26611
2 parents 80610fa + b26e842 commit 743ac4c

File tree

5 files changed

+134
-16
lines changed

5 files changed

+134
-16
lines changed

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.java

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
import org.springframework.security.config.Customizer;
3838
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
3939
import org.springframework.security.web.SecurityFilterChain;
40+
import org.springframework.util.ClassUtils;
4041

4142
/**
4243
* {@link EnableAutoConfiguration Auto-configuration} for Spring Security when actuator is
@@ -67,6 +68,9 @@ SecurityFilterChain managementSecurityFilterChain(HttpSecurity http) throws Exce
6768
requests.requestMatchers(EndpointRequest.to(HealthEndpoint.class, InfoEndpoint.class)).permitAll();
6869
requests.anyRequest().authenticated();
6970
});
71+
if (ClassUtils.isPresent("org.springframework.web.servlet.DispatcherServlet", null)) {
72+
http.cors();
73+
}
7074
http.formLogin(Customizer.withDefaults());
7175
http.httpBasic(Customizer.withDefaults());
7276
return http.build();

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/integrationtest/JerseyEndpointIntegrationTests.java

Lines changed: 43 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -16,18 +16,24 @@
1616

1717
package org.springframework.boot.actuate.autoconfigure.integrationtest;
1818

19+
import java.util.ArrayList;
20+
import java.util.Arrays;
21+
import java.util.List;
22+
1923
import org.glassfish.jersey.server.ResourceConfig;
2024
import org.junit.jupiter.api.Test;
2125

2226
import org.springframework.boot.actuate.autoconfigure.beans.BeansEndpointAutoConfiguration;
2327
import org.springframework.boot.actuate.autoconfigure.endpoint.EndpointAutoConfiguration;
2428
import org.springframework.boot.actuate.autoconfigure.endpoint.web.WebEndpointAutoConfiguration;
29+
import org.springframework.boot.actuate.autoconfigure.security.servlet.ManagementWebSecurityAutoConfiguration;
2530
import org.springframework.boot.actuate.autoconfigure.web.server.ManagementContextAutoConfiguration;
2631
import org.springframework.boot.actuate.endpoint.web.annotation.ControllerEndpoint;
2732
import org.springframework.boot.actuate.endpoint.web.annotation.RestControllerEndpoint;
2833
import org.springframework.boot.autoconfigure.AutoConfigurations;
2934
import org.springframework.boot.autoconfigure.jackson.JacksonAutoConfiguration;
3035
import org.springframework.boot.autoconfigure.jersey.JerseyAutoConfiguration;
36+
import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
3137
import org.springframework.boot.autoconfigure.web.servlet.ServletWebServerFactoryAutoConfiguration;
3238
import org.springframework.boot.test.context.FilteredClassLoader;
3339
import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
@@ -55,24 +61,46 @@ void actuatorEndpointsWhenUserProvidedResourceConfigBeanNotAvailable() {
5561
testJerseyEndpoints(new Class<?>[] { EndpointsConfiguration.class });
5662
}
5763

64+
@Test
65+
void actuatorEndpointsWhenSecurityAvailable() {
66+
WebApplicationContextRunner contextRunner = getContextRunner(
67+
new Class[] { EndpointsConfiguration.class, ResourceConfigConfiguration.class },
68+
getAutoconfigurations(SecurityAutoConfiguration.class, ManagementWebSecurityAutoConfiguration.class));
69+
contextRunner.run((context) -> {
70+
int port = context.getSourceApplicationContext(AnnotationConfigServletWebServerApplicationContext.class)
71+
.getWebServer().getPort();
72+
WebTestClient client = WebTestClient.bindToServer().baseUrl("http://localhost:" + port).build();
73+
client.get().uri("/actuator").exchange().expectStatus().isUnauthorized();
74+
});
75+
76+
}
77+
5878
protected void testJerseyEndpoints(Class<?>[] userConfigurations) {
79+
getContextRunner(userConfigurations, getAutoconfigurations()).run((context) -> {
80+
int port = context.getSourceApplicationContext(AnnotationConfigServletWebServerApplicationContext.class)
81+
.getWebServer().getPort();
82+
WebTestClient client = WebTestClient.bindToServer().baseUrl("http://localhost:" + port).build();
83+
client.get().uri("/actuator").exchange().expectStatus().isOk().expectBody().jsonPath("_links.beans")
84+
.isNotEmpty().jsonPath("_links.restcontroller").doesNotExist().jsonPath("_links.controller")
85+
.doesNotExist();
86+
});
87+
}
88+
89+
private WebApplicationContextRunner getContextRunner(Class<?>[] userConfigurations, Class<?>[] autoConfigurations) {
5990
FilteredClassLoader classLoader = new FilteredClassLoader(DispatcherServlet.class);
60-
new WebApplicationContextRunner(AnnotationConfigServletWebServerApplicationContext::new)
61-
.withClassLoader(classLoader)
62-
.withConfiguration(AutoConfigurations.of(JacksonAutoConfiguration.class, JerseyAutoConfiguration.class,
63-
EndpointAutoConfiguration.class, ServletWebServerFactoryAutoConfiguration.class,
64-
WebEndpointAutoConfiguration.class, ManagementContextAutoConfiguration.class,
65-
BeansEndpointAutoConfiguration.class))
91+
return new WebApplicationContextRunner(AnnotationConfigServletWebServerApplicationContext::new)
92+
.withClassLoader(classLoader).withConfiguration(AutoConfigurations.of(autoConfigurations))
6693
.withUserConfiguration(userConfigurations)
67-
.withPropertyValues("management.endpoints.web.exposure.include:*", "server.port:0").run((context) -> {
68-
int port = context
69-
.getSourceApplicationContext(AnnotationConfigServletWebServerApplicationContext.class)
70-
.getWebServer().getPort();
71-
WebTestClient client = WebTestClient.bindToServer().baseUrl("http://localhost:" + port).build();
72-
client.get().uri("/actuator").exchange().expectStatus().isOk().expectBody().jsonPath("_links.beans")
73-
.isNotEmpty().jsonPath("_links.restcontroller").doesNotExist().jsonPath("_links.controller")
74-
.doesNotExist();
75-
});
94+
.withPropertyValues("management.endpoints.web.exposure.include:*", "server.port:0");
95+
}
96+
97+
private Class<?>[] getAutoconfigurations(Class<?>... additional) {
98+
List<Class<?>> autoconfigurations = new ArrayList<>(Arrays.asList(JacksonAutoConfiguration.class,
99+
JerseyAutoConfiguration.class, EndpointAutoConfiguration.class,
100+
ServletWebServerFactoryAutoConfiguration.class, WebEndpointAutoConfiguration.class,
101+
ManagementContextAutoConfiguration.class, BeansEndpointAutoConfiguration.class));
102+
autoconfigurations.addAll(Arrays.asList(additional));
103+
return autoconfigurations.toArray(new Class<?>[0]);
76104
}
77105

78106
@ControllerEndpoint(id = "controller")

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfigurationTests.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
import org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.OAuth2ResourceServerAutoConfiguration;
3434
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyAutoConfiguration;
3535
import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
36+
import org.springframework.boot.autoconfigure.web.servlet.WebMvcAutoConfiguration;
3637
import org.springframework.boot.test.context.FilteredClassLoader;
3738
import org.springframework.boot.test.context.assertj.AssertableWebApplicationContext;
3839
import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
@@ -67,7 +68,7 @@ class ManagementWebSecurityAutoConfigurationTests {
6768
private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner().withConfiguration(
6869
AutoConfigurations.of(HealthContributorAutoConfiguration.class, HealthEndpointAutoConfiguration.class,
6970
InfoEndpointAutoConfiguration.class, EnvironmentEndpointAutoConfiguration.class,
70-
EndpointAutoConfiguration.class, WebEndpointAutoConfiguration.class,
71+
EndpointAutoConfiguration.class, WebMvcAutoConfiguration.class, WebEndpointAutoConfiguration.class,
7172
SecurityAutoConfiguration.class, ManagementWebSecurityAutoConfiguration.class));
7273

7374
@Test

‎spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator/src/test/java/smoketest/actuator/CorsSampleActuatorApplicationTests.java

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
/*
2+
* Copyright 2012-2020 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package smoketest.actuator;
18+
19+
import java.net.URI;
20+
import java.util.Map;
21+
22+
import org.junit.jupiter.api.BeforeEach;
23+
import org.junit.jupiter.api.Test;
24+
25+
import org.springframework.beans.factory.annotation.Autowired;
26+
import org.springframework.boot.test.context.SpringBootTest;
27+
import org.springframework.boot.test.web.client.LocalHostUriTemplateHandler;
28+
import org.springframework.boot.test.web.client.TestRestTemplate;
29+
import org.springframework.boot.web.client.RestTemplateBuilder;
30+
import org.springframework.context.ApplicationContext;
31+
import org.springframework.http.HttpStatus;
32+
import org.springframework.http.RequestEntity;
33+
import org.springframework.http.ResponseEntity;
34+
import org.springframework.test.context.ActiveProfiles;
35+
36+
import static org.assertj.core.api.Assertions.assertThat;
37+
38+
/**
39+
* Integration test for cors preflight requests to management endpoints.
40+
*
41+
* @author Madhura Bhave
42+
*/
43+
@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
44+
@ActiveProfiles("cors")
45+
class CorsSampleActuatorApplicationTests {
46+
47+
private TestRestTemplate testRestTemplate;
48+
49+
@Autowired
50+
private ApplicationContext applicationContext;
51+
52+
@BeforeEach
53+
void setUp() {
54+
RestTemplateBuilder builder = new RestTemplateBuilder();
55+
LocalHostUriTemplateHandler handler = new LocalHostUriTemplateHandler(this.applicationContext.getEnvironment(),
56+
"http");
57+
builder = builder.uriTemplateHandler(handler);
58+
this.testRestTemplate = new TestRestTemplate(builder);
59+
}
60+
61+
@Test
62+
void endpointShouldReturnUnauthorized() {
63+
ResponseEntity<?> entity = this.testRestTemplate.getForEntity("/actuator/env", Map.class);
64+
assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
65+
}
66+
67+
@Test
68+
void preflightRequestToEndpointShouldReturnOk() throws Exception {
69+
RequestEntity<?> healthRequest = RequestEntity.options(new URI("/actuator/env"))
70+
.header("Origin", "http://localhost:8080").header("Access-Control-Request-Method", "GET").build();
71+
ResponseEntity<?> exchange = this.testRestTemplate.exchange(healthRequest, Map.class);
72+
assertThat(exchange.getStatusCode()).isEqualTo(HttpStatus.OK);
73+
}
74+
75+
@Test
76+
void preflightRequestWhenCorsConfigInvalidShouldReturnForbidden() throws Exception {
77+
RequestEntity<?> entity = RequestEntity.options(new URI("/actuator/env"))
78+
.header("Origin", "http://localhost:9095").header("Access-Control-Request-Method", "GET").build();
79+
ResponseEntity<byte[]> exchange = this.testRestTemplate.exchange(entity, byte[].class);
80+
assertThat(exchange.getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
81+
}
82+
83+
}

‎spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator/src/test/resources/application-cors.properties

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
management.endpoints.web.cors.allowed-origins=http://localhost:8080
2+
management.endpoints.web.cors.allowed-methods=GET

0 commit comments

Comments
 (0)