Skip to content

Commit 0cdde3b

Browse files
philwebbphilwebb
committed
Merge branch '1.5.x'
2 parents 4486d2d + 81c5753 commit 0cdde3b

File tree

12 files changed

+281
-19
lines changed

12 files changed

+281
-19
lines changed

‎spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/ManagementServerProperties.java

Lines changed: 29 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
import java.util.Arrays;
2121
import java.util.List;
2222

23+
import javax.servlet.http.HttpSession;
2324
import javax.validation.constraints.NotNull;
2425

2526
import org.springframework.boot.autoconfigure.security.SecurityPrerequisite;
@@ -28,8 +29,6 @@
2829
import org.springframework.boot.context.embedded.Ssl;
2930
import org.springframework.boot.context.properties.ConfigurationProperties;
3031
import org.springframework.boot.context.properties.NestedConfigurationProperty;
31-
import org.springframework.security.config.http.SessionCreationPolicy;
32-
import org.springframework.util.ClassUtils;
3332
import org.springframework.util.StringUtils;
3433

3534
/**
@@ -43,8 +42,6 @@
4342
@ConfigurationProperties(prefix = "management", ignoreUnknownFields = true)
4443
public class ManagementServerProperties implements SecurityPrerequisite {
4544

46-
private static final String SECURITY_CHECK_CLASS = "org.springframework.security.config.http.SessionCreationPolicy";
47-
4845
/**
4946
* Order applied to the WebSecurityConfigurerAdapter that is used to configure basic
5047
* authentication for management endpoints. If you want to add your own authentication
@@ -89,14 +86,7 @@ public class ManagementServerProperties implements SecurityPrerequisite {
8986
*/
9087
private boolean addApplicationContextHeader = true;
9188

92-
private final Security security = maybeCreateSecurity();
93-
94-
private Security maybeCreateSecurity() {
95-
if (ClassUtils.isPresent(SECURITY_CHECK_CLASS, null)) {
96-
return new Security();
97-
}
98-
return null;
99-
}
89+
private final Security security = new Security();
10090

10191
/**
10292
* Returns the management port or {@code null} if the
@@ -181,7 +171,8 @@ public static class Security {
181171
private List<String> roles = Arrays.asList("ADMIN");
182172

183173
/**
184-
* Session creating policy to use (always, never, if_required, stateless).
174+
* Session creating policy for security use (always, never, if_required,
175+
* stateless).
185176
*/
186177
private SessionCreationPolicy sessions = SessionCreationPolicy.STATELESS;
187178

@@ -211,4 +202,29 @@ public void setEnabled(boolean enabled) {
211202

212203
}
213204

205+
public enum SessionCreationPolicy {
206+
207+
/**
208+
* Always create an {@link HttpSession}.
209+
*/
210+
ALWAYS,
211+
212+
/**
213+
* Never create an {@link HttpSession}, but use any {@link HttpSession} that
214+
* already exists.
215+
*/
216+
NEVER,
217+
218+
/**
219+
* Only create an {@link HttpSession} if required.
220+
*/
221+
IF_REQUIRED,
222+
223+
/**
224+
* Never create an {@link HttpSession}.
225+
*/
226+
STATELESS
227+
228+
}
229+
214230
}

‎spring-boot-actuator/src/main/java/org/springframework/boot/actuate/autoconfigure/ManagementWebSecurityAutoConfiguration.java

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@
6464
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration;
6565
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
6666
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
67+
import org.springframework.security.config.http.SessionCreationPolicy;
6768
import org.springframework.security.web.AuthenticationEntryPoint;
6869
import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint;
6970
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
@@ -274,13 +275,22 @@ protected void configure(HttpSecurity http) throws Exception {
274275
http.httpBasic().authenticationEntryPoint(entryPoint);
275276
// No cookies for management endpoints by default
276277
http.csrf().disable();
277-
http.sessionManagement().sessionCreationPolicy(
278-
this.management.getSecurity().getSessions());
278+
http.sessionManagement()
279+
.sessionCreationPolicy(asSpringSecuritySessionCreationPolicy(
280+
this.management.getSecurity().getSessions()));
279281
SpringBootWebSecurityConfiguration.configureHeaders(http.headers(),
280282
this.security.getHeaders());
281283
}
282284
}
283285

286+
private SessionCreationPolicy asSpringSecuritySessionCreationPolicy(
287+
Enum<?> value) {
288+
if (value == null) {
289+
return SessionCreationPolicy.STATELESS;
290+
}
291+
return SessionCreationPolicy.valueOf(value.name());
292+
}
293+
284294
private RequestMatcher getRequestMatcher() {
285295
if (this.management.getSecurity().isEnabled()) {
286296
return LazyEndpointPathRequestMatcher

‎spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/diagnostics/analyzer/NoSuchBeanDefinitionFailureAnalyzer.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -218,8 +218,8 @@ private boolean isMatch(MethodMetadata candidate, Source source,
218218
}
219219
String name = cause.getBeanName();
220220
ResolvableType resolvableType = cause.getResolvableType();
221-
return ((name != null && hasName(candidate, name))
222-
|| (resolvableType != null && hasType(candidate, extractBeanType(resolvableType))));
221+
return ((name != null && hasName(candidate, name)) || (resolvableType != null
222+
&& hasType(candidate, extractBeanType(resolvableType))));
223223
}
224224

225225
private boolean hasName(MethodMetadata methodMetadata, String name) {

‎spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/diagnostics/analyzer/NoSuchBeanDefinitionFailureAnalyzerTests.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,8 @@ public void failureAnalysisForMissingPropertyExactType() {
8787
public void failureAnalysisForMissingCollectionType() throws Exception {
8888
FailureAnalysis analysis = analyzeFailure(
8989
createFailure(StringCollectionConfiguration.class));
90-
assertDescriptionConstructorMissingType(analysis, StringCollectionHandler.class, 0,
91-
String.class);
90+
assertDescriptionConstructorMissingType(analysis, StringCollectionHandler.class,
91+
0, String.class);
9292
assertBeanMethodDisabled(analysis,
9393
"did not find property 'spring.string.enabled'",
9494
TestPropertyAutoConfiguration.class, "string");

‎spring-boot-samples/pom.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
<module>spring-boot-sample-activemq</module>
2626
<module>spring-boot-sample-actuator</module>
2727
<module>spring-boot-sample-actuator-log4j2</module>
28+
<module>spring-boot-sample-actuator-no-security</module>
2829
<module>spring-boot-sample-actuator-noweb</module>
2930
<module>spring-boot-sample-actuator-ui</module>
3031
<module>spring-boot-sample-amqp</module>

‎spring-boot-samples/spring-boot-sample-actuator-no-security/pom.xml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
<parent>
5+
<!-- Your own application should inherit from spring-boot-starter-parent -->
6+
<groupId>org.springframework.boot</groupId>
7+
<artifactId>spring-boot-samples</artifactId>
8+
<version>1.4.2.BUILD-SNAPSHOT</version>
9+
</parent>
10+
<artifactId>spring-boot-sample-actuator-no-security</artifactId>
11+
<name>Spring Boot Actuator UI Sample</name>
12+
<description>Spring Boot Actuator UI Sample</description>
13+
<url>http://projects.spring.io/spring-boot/</url>
14+
<organization>
15+
<name>Pivotal Software, Inc.</name>
16+
<url>http://www.spring.io</url>
17+
</organization>
18+
<properties>
19+
<main.basedir>${basedir}/../..</main.basedir>
20+
</properties>
21+
<dependencies>
22+
<dependency>
23+
<groupId>org.springframework.boot</groupId>
24+
<artifactId>spring-boot-starter-actuator</artifactId>
25+
</dependency>
26+
<dependency>
27+
<groupId>org.springframework.boot</groupId>
28+
<artifactId>spring-boot-starter-freemarker</artifactId>
29+
</dependency>
30+
<dependency>
31+
<groupId>org.springframework.boot</groupId>
32+
<artifactId>spring-boot-starter-test</artifactId>
33+
<scope>test</scope>
34+
</dependency>
35+
</dependencies>
36+
<build>
37+
<plugins>
38+
<plugin>
39+
<groupId>org.springframework.boot</groupId>
40+
<artifactId>spring-boot-maven-plugin</artifactId>
41+
</plugin>
42+
</plugins>
43+
</build>
44+
</project>

‎spring-boot-samples/spring-boot-sample-actuator-no-security/src/main/java/sample/actuator/nosecurity/SampleActuatorNoSecurityApplication.java

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
/*
2+
* Copyright 2012-2016 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package sample.actuator.nosecurity;
18+
19+
import java.util.Date;
20+
import java.util.Map;
21+
22+
import org.springframework.boot.SpringApplication;
23+
import org.springframework.boot.autoconfigure.SpringBootApplication;
24+
import org.springframework.stereotype.Controller;
25+
import org.springframework.web.bind.annotation.GetMapping;
26+
import org.springframework.web.bind.annotation.RequestMapping;
27+
28+
@SpringBootApplication
29+
@Controller
30+
public class SampleActuatorNoSecurityApplication {
31+
32+
@GetMapping("/")
33+
public String home(Map<String, Object> model) {
34+
model.put("message", "Hello World");
35+
model.put("title", "Hello Home");
36+
model.put("date", new Date());
37+
return "home";
38+
}
39+
40+
@RequestMapping("/foo")
41+
public String foo() {
42+
throw new RuntimeException("Expected exception in controller");
43+
}
44+
45+
public static void main(String[] args) throws Exception {
46+
SpringApplication.run(SampleActuatorNoSecurityApplication.class, args);
47+
}
48+
49+
}

‎spring-boot-samples/spring-boot-sample-actuator-no-security/src/main/resources/application.properties

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
health.diskspace.enabled=false
2+
management.security.role=superuser

‎spring-boot-samples/spring-boot-sample-actuator-no-security/src/main/resources/static/css/bootstrap.min.css

Lines changed: 11 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎spring-boot-samples/spring-boot-sample-actuator-no-security/src/main/resources/templates/error.ftl

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
<#import "/spring.ftl" as spring />
2+
<!DOCTYPE html>
3+
<html>
4+
<head>
5+
<title>Error</title>
6+
<#assign home><@spring.url relativeUrl="/"/></#assign>
7+
<#assign bootstrap><@spring.url relativeUrl="/css/bootstrap.min.css"/></#assign>
8+
<link rel="stylesheet" href="${bootstrap}" />
9+
</head>
10+
<body>
11+
<div class="container">
12+
<div class="navbar">
13+
<div class="navbar-inner">
14+
<a class="brand" href="http://freemarker.org/"> FreeMarker -
15+
Plain </a>
16+
<ul class="nav">
17+
<li><a href="${home}"> Home </a></li>
18+
</ul>
19+
</div>
20+
</div>
21+
<h1>Error Page</h1>
22+
<div id="created">${timestamp?datetime}</div>
23+
<div>
24+
There was an unexpected error (type=${error}, status=${status}).
25+
</div>
26+
<div>${message}</div>
27+
<div>
28+
Please contact the operator with the above information.
29+
</div>
30+
</div>
31+
</body>
32+
</html>

‎spring-boot-samples/spring-boot-sample-actuator-no-security/src/main/resources/templates/home.ftl

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<#import "/spring.ftl" as spring />
2+
<!DOCTYPE html>
3+
<html>
4+
<head>
5+
<title>${title}</title>
6+
<#assign home><@spring.url relativeUrl="/"/></#assign>
7+
<#assign bootstrap><@spring.url relativeUrl="/css/bootstrap.min.css"/></#assign>
8+
<link rel="stylesheet" href="${bootstrap}" />
9+
</head>
10+
<body>
11+
<div class="container">
12+
<div class="navbar">
13+
<div class="navbar-inner">
14+
<a class="brand" href="http://freemarker.org/"> FreeMarker -
15+
Plain </a>
16+
<ul class="nav">
17+
<li><a href="${home}"> Home </a></li>
18+
</ul>
19+
</div>
20+
</div>
21+
<h1>${title}</h1>
22+
<div>${message}</div>
23+
<div id="created">${date?datetime}</div>
24+
</div>
25+
</body>
26+
</html>

‎spring-boot-samples/spring-boot-sample-actuator-no-security/src/test/java/sample/actuator/nosecurity/SampleActuatorNoSecurityApplicationTests.java

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
/*
2+
* Copyright 2012-2016 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package sample.actuator.nosecurity;
18+
19+
import java.util.Arrays;
20+
import java.util.Map;
21+
22+
import org.junit.Test;
23+
import org.junit.runner.RunWith;
24+
25+
import org.springframework.beans.factory.annotation.Autowired;
26+
import org.springframework.boot.test.context.SpringBootTest;
27+
import org.springframework.boot.test.context.SpringBootTest.WebEnvironment;
28+
import org.springframework.boot.test.web.client.TestRestTemplate;
29+
import org.springframework.http.HttpEntity;
30+
import org.springframework.http.HttpHeaders;
31+
import org.springframework.http.HttpMethod;
32+
import org.springframework.http.HttpStatus;
33+
import org.springframework.http.MediaType;
34+
import org.springframework.http.ResponseEntity;
35+
import org.springframework.test.annotation.DirtiesContext;
36+
import org.springframework.test.context.junit4.SpringRunner;
37+
38+
import static org.assertj.core.api.Assertions.assertThat;
39+
40+
/**
41+
* Basic integration tests for demo application.
42+
*
43+
* @author Phillip Webb
44+
*/
45+
@RunWith(SpringRunner.class)
46+
@SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT)
47+
@DirtiesContext
48+
public class SampleActuatorNoSecurityApplicationTests {
49+
50+
@Autowired
51+
private TestRestTemplate restTemplate;
52+
53+
@Test
54+
public void testHome() throws Exception {
55+
HttpHeaders headers = new HttpHeaders();
56+
headers.setAccept(Arrays.asList(MediaType.TEXT_HTML));
57+
ResponseEntity<String> entity = this.restTemplate.exchange("/", HttpMethod.GET,
58+
new HttpEntity<Void>(headers), String.class);
59+
assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
60+
assertThat(entity.getBody()).contains("<title>Hello");
61+
}
62+
63+
@Test
64+
public void testMetrics() throws Exception {
65+
@SuppressWarnings("rawtypes")
66+
ResponseEntity<Map> entity = this.restTemplate.getForEntity("/metrics",
67+
Map.class);
68+
assertThat(entity.getStatusCode()).isEqualTo(HttpStatus.OK);
69+
}
70+
71+
}

0 commit comments

Comments
 (0)