Skip to content

Commit b26e842

Browse files
mbhavembhave
committed
Configure CORS in default security configuration for MVC
Fixes gh-11987
1 parent b6e860b commit b26e842

File tree

5 files changed

+133
-16
lines changed

5 files changed

+133
-16
lines changed

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityConfigurerAdapter.java

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
import org.springframework.security.config.Customizer;
2323
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
2424
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
25+
import org.springframework.util.ClassUtils;
2526

2627
/**
2728
* The default configuration for web security when the actuator dependency is on the
@@ -44,6 +45,9 @@ protected void configure(HttpSecurity http) throws Exception {
4445
requests.requestMatchers(EndpointRequest.to(HealthEndpoint.class, InfoEndpoint.class)).permitAll();
4546
requests.anyRequest().authenticated();
4647
});
48+
if (ClassUtils.isPresent("org.springframework.web.servlet.DispatcherServlet", null)) {
49+
http.cors();
50+
}
4751
http.formLogin(Customizer.withDefaults());
4852
http.httpBasic(Customizer.withDefaults());
4953
}

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/integrationtest/JerseyEndpointIntegrationTests.java

Lines changed: 42 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,17 @@
1616

1717
package org.springframework.boot.actuate.autoconfigure.integrationtest;
1818

19+
import java.util.ArrayList;
20+
import java.util.Arrays;
21+
import java.util.List;
22+
1923
import org.glassfish.jersey.server.ResourceConfig;
2024
import org.junit.jupiter.api.Test;
2125

2226
import org.springframework.boot.actuate.autoconfigure.beans.BeansEndpointAutoConfiguration;
2327
import org.springframework.boot.actuate.autoconfigure.endpoint.EndpointAutoConfiguration;
2428
import org.springframework.boot.actuate.autoconfigure.endpoint.web.WebEndpointAutoConfiguration;
29+
import org.springframework.boot.actuate.autoconfigure.security.servlet.ManagementWebSecurityAutoConfiguration;
2530
import org.springframework.boot.actuate.autoconfigure.web.server.ManagementContextAutoConfiguration;
2631
import org.springframework.boot.actuate.endpoint.web.annotation.ControllerEndpoint;
2732
import org.springframework.boot.actuate.endpoint.web.annotation.RestControllerEndpoint;
@@ -55,24 +60,46 @@ void actuatorEndpointsWhenUserProvidedResourceConfigBeanNotAvailable() {
5560
testJerseyEndpoints(new Class[] { EndpointsConfiguration.class });
5661
}
5762

63+
@Test
64+
void actuatorEndpointsWhenSecurityAvailable() {
65+
WebApplicationContextRunner contextRunner = getContextRunner(
66+
new Class[] { EndpointsConfiguration.class, ResourceConfigConfiguration.class },
67+
getAutoconfigurations(ManagementWebSecurityAutoConfiguration.class));
68+
contextRunner.run((context) -> {
69+
int port = context.getSourceApplicationContext(AnnotationConfigServletWebServerApplicationContext.class)
70+
.getWebServer().getPort();
71+
WebTestClient client = WebTestClient.bindToServer().baseUrl("http://localhost:" + port).build();
72+
client.get().uri("/actuator").exchange().expectStatus().isUnauthorized();
73+
});
74+
75+
}
76+
5877
protected void testJerseyEndpoints(Class<?>[] userConfigurations) {
78+
getContextRunner(userConfigurations, getAutoconfigurations()).run((context) -> {
79+
int port = context.getSourceApplicationContext(AnnotationConfigServletWebServerApplicationContext.class)
80+
.getWebServer().getPort();
81+
WebTestClient client = WebTestClient.bindToServer().baseUrl("http://localhost:" + port).build();
82+
client.get().uri("/actuator").exchange().expectStatus().isOk().expectBody().jsonPath("_links.beans")
83+
.isNotEmpty().jsonPath("_links.restcontroller").doesNotExist().jsonPath("_links.controller")
84+
.doesNotExist();
85+
});
86+
}
87+
88+
private WebApplicationContextRunner getContextRunner(Class<?>[] userConfigurations, Class<?>[] autoConfigurations) {
5989
FilteredClassLoader classLoader = new FilteredClassLoader(DispatcherServlet.class);
60-
new WebApplicationContextRunner(AnnotationConfigServletWebServerApplicationContext::new)
61-
.withClassLoader(classLoader)
62-
.withConfiguration(AutoConfigurations.of(JacksonAutoConfiguration.class, JerseyAutoConfiguration.class,
63-
EndpointAutoConfiguration.class, ServletWebServerFactoryAutoConfiguration.class,
64-
WebEndpointAutoConfiguration.class, ManagementContextAutoConfiguration.class,
65-
BeansEndpointAutoConfiguration.class))
90+
return new WebApplicationContextRunner(AnnotationConfigServletWebServerApplicationContext::new)
91+
.withClassLoader(classLoader).withConfiguration(AutoConfigurations.of(autoConfigurations))
6692
.withUserConfiguration(userConfigurations)
67-
.withPropertyValues("management.endpoints.web.exposure.include:*", "server.port:0").run((context) -> {
68-
int port = context
69-
.getSourceApplicationContext(AnnotationConfigServletWebServerApplicationContext.class)
70-
.getWebServer().getPort();
71-
WebTestClient client = WebTestClient.bindToServer().baseUrl("http://localhost:" + port).build();
72-
client.get().uri("/actuator").exchange().expectStatus().isOk().expectBody().jsonPath("_links.beans")
73-
.isNotEmpty().jsonPath("_links.restcontroller").doesNotExist().jsonPath("_links.controller")
74-
.doesNotExist();
75-
});
93+
.withPropertyValues("management.endpoints.web.exposure.include:*", "server.port:0");
94+
}
95+
96+
private Class<?>[] getAutoconfigurations(Class<?>... additional) {
97+
List<Class<?>> autoconfigurations = new ArrayList<>(Arrays.asList(JacksonAutoConfiguration.class,
98+
JerseyAutoConfiguration.class, EndpointAutoConfiguration.class,
99+
ServletWebServerFactoryAutoConfiguration.class, WebEndpointAutoConfiguration.class,
100+
ManagementContextAutoConfiguration.class, BeansEndpointAutoConfiguration.class));
101+
autoconfigurations.addAll(Arrays.asList(additional));
102+
return autoconfigurations.toArray(new Class<?>[0]);
76103
}
77104

78105
@ControllerEndpoint(id = "controller")

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfigurationTests.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
import org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.OAuth2ResourceServerAutoConfiguration;
3131
import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyAutoConfiguration;
3232
import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
33+
import org.springframework.boot.autoconfigure.web.servlet.WebMvcAutoConfiguration;
3334
import org.springframework.boot.test.context.assertj.AssertableWebApplicationContext;
3435
import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
3536
import org.springframework.context.annotation.Configuration;
@@ -56,7 +57,7 @@ class ManagementWebSecurityAutoConfigurationTests {
5657
private WebApplicationContextRunner contextRunner = new WebApplicationContextRunner().withConfiguration(
5758
AutoConfigurations.of(HealthContributorAutoConfiguration.class, HealthEndpointAutoConfiguration.class,
5859
InfoEndpointAutoConfiguration.class, EnvironmentEndpointAutoConfiguration.class,
59-
EndpointAutoConfiguration.class, WebEndpointAutoConfiguration.class,
60+
EndpointAutoConfiguration.class, WebMvcAutoConfiguration.class, WebEndpointAutoConfiguration.class,
6061
SecurityAutoConfiguration.class, ManagementWebSecurityAutoConfiguration.class));
6162

6263
@Test

‎spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator/src/test/java/smoketest/actuator/CorsSampleActuatorApplicationTests.java

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
/*
2+
* Copyright 2012-2020 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package smoketest.actuator;
18+
19+
import java.net.URI;
20+
import java.util.Map;
21+
22+
import org.junit.jupiter.api.BeforeEach;
23+
import org.junit.jupiter.api.Test;
24+
25+
import org.springframework.beans.factory.annotation.Autowired;
26+
import org.springframework.boot.test.context.SpringBootTest;
27+
import org.springframework.boot.test.web.client.LocalHostUriTemplateHandler;
28+
import org.springframework.boot.test.web.client.TestRestTemplate;
29+
import org.springframework.boot.web.client.RestTemplateBuilder;
30+
import org.springframework.context.ApplicationContext;
31+
import org.springframework.http.HttpStatus;
32+
import org.springframework.http.RequestEntity;
33+
import org.springframework.http.ResponseEntity;
34+
import org.springframework.test.context.ActiveProfiles;
35+
36+
import static org.assertj.core.api.Assertions.assertThat;
37+
38+
/**
39+
* Integration test for cors preflight requests to management endpoints.
40+
*
41+
* @author Madhura Bhave
42+
*/
43+
@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
44+
@ActiveProfiles("cors")
45+
class CorsSampleActuatorApplicationTests {
46+
47+
private TestRestTemplate testRestTemplate;
48+
49+
@Autowired
50+
private ApplicationContext applicationContext;
51+
52+
@BeforeEach
53+
void setUp() {
54+
RestTemplateBuilder builder = new RestTemplateBuilder();
55+
LocalHostUriTemplateHandler handler = new LocalHostUriTemplateHandler(this.applicationContext.getEnvironment(),
56+
"http");
57+
builder = builder.uriTemplateHandler(handler);
58+
this.testRestTemplate = new TestRestTemplate(builder);
59+
}
60+
61+
@Test
62+
void endpointShouldReturnUnauthorized() {
63+
ResponseEntity<?> entity = this.testRestTemplate.getForEntity("/actuator/env", Map.class);
64+
assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
65+
}
66+
67+
@Test
68+
void preflightRequestToEndpointShouldReturnOk() throws Exception {
69+
RequestEntity<?> healthRequest = RequestEntity.options(new URI("/actuator/env"))
70+
.header("Origin", "http://localhost:8080").header("Access-Control-Request-Method", "GET").build();
71+
ResponseEntity<?> exchange = this.testRestTemplate.exchange(healthRequest, Map.class);
72+
assertThat(exchange.getStatusCode()).isEqualTo(HttpStatus.OK);
73+
}
74+
75+
@Test
76+
void preflightRequestWhenCorsConfigInvalidShouldReturnForbidden() throws Exception {
77+
RequestEntity<?> entity = RequestEntity.options(new URI("/actuator/env"))
78+
.header("Origin", "http://localhost:9095").header("Access-Control-Request-Method", "GET").build();
79+
ResponseEntity<byte[]> exchange = this.testRestTemplate.exchange(entity, byte[].class);
80+
assertThat(exchange.getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
81+
}
82+
83+
}

‎spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator/src/test/resources/application-cors.properties

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
management.endpoints.web.cors.allowed-origins=http://localhost:8080
2+
management.endpoints.web.cors.allowed-methods=GET

0 commit comments

Comments
 (0)