actuator防止外部访问漏洞修复

解决办法适用于2.x springboot版本

注意：actuator默认是开启的，默认开启是有漏洞的。

法零：和网站设置不同端口，不映射到外面，并修改路径 法一：禁用所有http接口，将配置改成：management.endpoints.web.exposure.exclude=* 法二：引入spring-boot-starter-security依赖，增加安全认证 <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency> 配置增加

# actuator是否需要安全保证配置 management: security: enabled: true endpoints: web: exposure: include: "*" # actuator登录认证配置 spring: security: user: name: admin${random.int} password: ${random.value} 代码增加 打印认证的用户和密码

@Component public class MyApplicationRunner implements ApplicationRunner {

private static final Logger LOGGER = LoggerFactory.getLogger(MyApplicationRunner.class);

@Autowired private SecurityProperties securityProperties;

@Override public void run(ApplicationArguments args) throws Exception { LOGGER.info("actuator user name:{}, password:{}", securityProperties.getUser().getName(), securityProperties.getUser().getPassword()); // todo 存到redis或者其他 } } ActuatorSecurity认证类

import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration public class ActuatorSecurity extends WebSecurityConfigurerAdapter {

@Override protected void configure(HttpSecurity http) throws Exception { http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests() .anyRequest().authenticated().and().httpBasic(); }

} 启动&测试 http://localhost:8088/actuator/beans