springboot actuator未授权访问漏洞

jeecgboot · Sep 19, 2022 · a781606 · a781606
1 parent e142f4d
commit a781606
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/jeecg-boot-base-core/src/main/java/org/jeecg/config/shiro/ShiroConfig.java b/jeecg-boot-base-core/src/main/java/org/jeecg/config/shiro/ShiroConfig.java
@@ -144,8 +144,8 @@ public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
         filterChainDefinitionMap.put("/vxeSocket/**", "anon");//JVxeTable无痕刷新示例
 
 
-        //性能监控  TODO 存在安全漏洞泄露TOEKN（durid连接池也有）
-        filterChainDefinitionMap.put("/actuator/**", "anon");
+        //性能监控，放开排除会存在安全漏洞泄露TOEKN（durid连接池也有）
+        //filterChainDefinitionMap.put("/actuator/**", "anon");
 
         //测试模块排除
         filterChainDefinitionMap.put("/test/seata/**", "anon");