Skip to content

Commit

Permalink
Secure the actuator endpoints behind /management
Browse files Browse the repository at this point in the history 
Fix #3550
  • Loading branch information
@jdubois
jdubois committed May 6, 2016
1 parent 30a4014 commit bd09d3b
Show file tree
Hide file tree
Showing 16 changed files with 27 additions and 95 deletions.
2 changes: 1 addition & 1 deletion generators/client/templates/src/main/webapp/app/admin/audits/_audits.service.js
View file
Expand Up @@ -8,7 +8,7 @@
AuditsService.$inject = ['$resource'];

function AuditsService ($resource) {
var service = $resource(<% if(authenticationType === 'uaa') { %>'<%= uaaBaseName %>/api/audits/:id'<%} else { %>'api/audits/:id'<% } %>, {}, {
var service = $resource(<% if(authenticationType === 'uaa') { %>'<%= uaaBaseName %>/api/audits/:id'<%} else { %>'management/jhipster/audits/:id'<% } %>, {}, {
'get': {
method: 'GET',
isArray: true
Expand Down
4 changes: 2 additions & 2 deletions ...rators/client/templates/src/main/webapp/app/admin/configuration/_configuration.service.js
View file
Expand Up @@ -16,7 +16,7 @@
return service;

function get () {
return $http.get('configprops').then(getConfigPropsComplete);
return $http.get('management/configprops').then(getConfigPropsComplete);

function getConfigPropsComplete (response) {
var properties = [];
Expand All @@ -29,7 +29,7 @@
}

function getEnv () {
return $http.get('env').then(getEnvComplete);
return $http.get('management/env').then(getEnvComplete);

function getEnvComplete (response) {
var properties = {};
Expand Down
2 changes: 1 addition & 1 deletion generators/client/templates/src/main/webapp/app/admin/health/_health.service.js
View file
Expand Up @@ -15,7 +15,7 @@
return service;

function checkHealth () {
return $http.get('health').then(function (response) {
return $http.get('management/health').then(function (response) {
return response.data;
});
}
Expand Down
2 changes: 1 addition & 1 deletion generators/client/templates/src/main/webapp/app/admin/logs/_logs.service.js
View file
Expand Up @@ -8,7 +8,7 @@
LogsService.$inject = ['$resource'];

function LogsService ($resource) {
var service = $resource('api/logs', {}, {
var service = $resource('management/jhipster/logs', {}, {
'findAll': { method: 'GET', isArray: true},
'changeLevel': { method: 'PUT'}
});
Expand Down
4 changes: 2 additions & 2 deletions generators/client/templates/src/main/webapp/app/admin/metrics/_metrics.service.js
View file
Expand Up @@ -16,13 +16,13 @@
return service;

function getMetrics () {
return $http.get('metrics/metrics').then(function (response) {
return $http.get('management/jhipster/metrics').then(function (response) {
return response.data;
});
}

function threadDump () {
return $http.get('dump').then(function (response) {
return $http.get('management/dump').then(function (response) {
return response.data;
});
}
Expand Down
4 changes: 2 additions & 2 deletions generators/client/templates/src/main/webapp/app/services/auth/_auth.oauth2.service.js
View file
Expand Up @@ -30,13 +30,13 @@
function login (credentials) {
var data = 'username=' + encodeURIComponent(credentials.username) + '&password=' +
encodeURIComponent(credentials.password) + '&grant_type=password&scope=read%20write&' +
'client_secret=mySecretOAuthSecret&client_id=<%= baseName%>app';
'client_secret=my-secret-token-to-change-in-production&client_id=<%= baseName%>app';

return $http.post('oauth/token', data, {
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
'Accept': 'application/json',
'Authorization': 'Basic ' + Base64.encode('<%= baseName%>app' + ':' + 'mySecretOAuthSecret')
'Authorization': 'Basic ' + Base64.encode('<%= baseName%>app' + ':' + 'my-secret-token-to-change-in-production')
}
}).success(authSucess);

Expand Down
14 changes: 1 addition & 13 deletions generators/client/templates/src/main/webapp/robots.txt
View file
Expand Up @@ -7,17 +7,5 @@ Disallow: /api/account/sessions
Disallow: /api/audits/
Disallow: /api/logs/
Disallow: /api/users/
Disallow: /metrics/
Disallow: /health/
Disallow: /trace/
Disallow: /dump/
Disallow: /shutdown/
Disallow: /beans/
Disallow: /configprops/
Disallow: /info/
Disallow: /autoconfig/
Disallow: /env/
Disallow: /trace/
Disallow: /management/
Disallow: /v2/api-docs/
Disallow: /configuration/
Disallow: /protected/
4 changes: 2 additions & 2 deletions generators/entity/templates/src/test/gatling/simulations/_EntityGatlingTest.scala
View file
Expand Up @@ -43,7 +43,7 @@ class <%= entityClass %>GatlingTest extends Simulation {
<%_ } _%>
<%_ if (authenticationType == 'oauth2') { _%>

val authorization_header = "Basic " + Base64.getEncoder.encodeToString("<%= baseName%>app:mySecretOAuthSecret".getBytes(StandardCharsets.UTF_8))
val authorization_header = "Basic " + Base64.getEncoder.encodeToString("<%= baseName%>app:my-secret-token-to-change-in-production".getBytes(StandardCharsets.UTF_8))

val headers_http_authentication = Map(
"Content-Type" -> """application/x-www-form-urlencoded""",
Expand Down Expand Up @@ -91,7 +91,7 @@ class <%= entityClass %>GatlingTest extends Simulation {
.formParam("password", "admin")
.formParam("grant_type", "password")
.formParam("scope", "read write")
.formParam("client_secret", "mySecretOAuthSecret")
.formParam("client_secret", "my-secret-token-to-change-in-production")
.formParam("client_id", "<%= baseName%>app")
.formParam("submit", "Login")
.check(jsonPath("$.access_token").saveAs("access_token"))).exitHereIfFailed
Expand Down
38 changes: 3 additions & 35 deletions ...ors/server/templates/src/main/java/package/config/_MicroserviceSecurityConfiguration.java
View file
Expand Up @@ -52,25 +52,9 @@ protected void configure(HttpSecurity http) throws Exception {
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()

.antMatchers("/api/logs/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/api/**").authenticated()
.antMatchers("/metrics/**").permitAll()
.antMatchers("/health/**").permitAll()
.antMatchers("/trace/**").permitAll()
.antMatchers("/dump/**").permitAll()
.antMatchers("/shutdown/**").permitAll()
.antMatchers("/beans/**").permitAll()
.antMatchers("/configprops/**").permitAll()
.antMatchers("/info/**").permitAll()
.antMatchers("/autoconfig/**").permitAll()
.antMatchers("/env/**").permitAll()
.antMatchers("/mappings/**").permitAll()
.antMatchers("/liquibase/**").permitAll()
.antMatchers("/v2/api-docs/**").permitAll()

This comment has been minimized.

Sign in to view

Copy link
@deepu105

deepu105 May 6, 2016

Member

@jdubois you removed swagger endpoint as well is that required?

This comment has been minimized.

Sign in to view

Copy link
@jdubois

jdubois May 6, 2016

Author Member

as it's outside /management it's not secured at all -> which is OK, as it's only available in dev profile (and even better than before, as this line wasn't needed in prod)
.antMatchers("/configuration/security").permitAll()
.antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/configuration/ui").permitAll()
.antMatchers("/protected/**").authenticated()

This comment has been minimized.

Sign in to view

Copy link
@deepu105

deepu105 May 6, 2016

Member

What about this?

This comment has been minimized.

Sign in to view

Copy link
@jdubois

jdubois May 6, 2016

Author Member

it's not used at all. I did that line at the very beginning of JHipster, thinking that maybe some people would be happy to have a "protected" url, but in the end nobody uses it.

This comment has been minimized.

Sign in to view

Copy link
@deepu105

deepu105 via email May 7, 2016

Member
.and()
.apply(securityConfigurerAdapter());

Expand Down Expand Up @@ -123,25 +107,9 @@ public void configure(HttpSecurity http) throws Exception {
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()

.antMatchers("/api/logs/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/api/**").authenticated()
.antMatchers("/metrics/**").permitAll()
.antMatchers("/health/**").permitAll()
.antMatchers("/trace/**").permitAll()
.antMatchers("/dump/**").permitAll()
.antMatchers("/shutdown/**").permitAll()
.antMatchers("/beans/**").permitAll()
.antMatchers("/configprops/**").permitAll()
.antMatchers("/info/**").permitAll()
.antMatchers("/autoconfig/**").permitAll()
.antMatchers("/env/**").permitAll()
.antMatchers("/mappings/**").permitAll()
.antMatchers("/liquibase/**").permitAll()
.antMatchers("/v2/api-docs/**").permitAll()

This comment has been minimized.

Sign in to view

Copy link
@deepu105

deepu105 May 6, 2016

Member

Same for swagger
.antMatchers("/configuration/security").permitAll()
.antMatchers("/configuration/ui").permitAll()
.antMatchers("/protected/**").authenticated();
.antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/configuration/ui").permitAll();

}

Expand Down
20 changes: 4 additions & 16 deletions generators/server/templates/src/main/java/package/config/_OAuth2ServerConfiguration.java
View file
Expand Up @@ -62,25 +62,13 @@ public void configure(HttpSecurity http) throws Exception {
.antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
.antMatchers("/api/authenticate").permitAll()
.antMatchers("/api/register").permitAll()
.antMatchers("/api/logs/**").hasAnyAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/api/**").authenticated()<% if (websocket == 'spring-websocket') { %>
.antMatchers("/websocket/tracker").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/websocket/**").permitAll()<% } %>
.antMatchers("/metrics/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/health/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/trace/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/dump/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/shutdown/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/beans/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/configprops/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/info/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/autoconfig/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/env/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/trace/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/liquibase/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/api-docs/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/protected/**").authenticated();

.antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/v2/api-docs/**").permitAll()
.antMatchers("/configuration/ui").permitAll()
.antMatchers("/swagger-ui/index.html").hasAuthority(AuthoritiesConstants.ADMIN);
}
}

Expand Down
16 changes: 1 addition & 15 deletions generators/server/templates/src/main/java/package/config/_SecurityConfiguration.java
View file
Expand Up @@ -138,25 +138,11 @@ protected void configure(HttpSecurity http) throws Exception {
.antMatchers("/api/account/reset_password/init").permitAll()
.antMatchers("/api/account/reset_password/finish").permitAll()
.antMatchers("/api/profile-info").permitAll()
.antMatchers("/api/logs/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/api/audits/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/api/**").authenticated()<% if (websocket == 'spring-websocket') { %>
.antMatchers("/websocket/tracker").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/websocket/**").permitAll()<% } %>
.antMatchers("/metrics/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/health/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/trace/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/dump/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/shutdown/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/beans/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/configprops/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/info/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/autoconfig/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/env/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/mappings/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/liquibase/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/v2/api-docs/**").permitAll()
.antMatchers("/configuration/security").permitAll()
.antMatchers("/configuration/ui").permitAll()
.antMatchers("/swagger-ui/index.html").hasAuthority(AuthoritiesConstants.ADMIN)
.antMatchers("/protected/**").authenticated() <%if (authenticationType != 'jwt') { %>;<% } %><% if (authenticationType == 'jwt') { %>
Expand Down
2 changes: 1 addition & 1 deletion generators/server/templates/src/main/java/package/config/_WebConfigurer.java
View file
Expand Up @@ -186,7 +186,7 @@ private void initMetrics(ServletContext servletContext, EnumSet<DispatcherType>
ServletRegistration.Dynamic metricsAdminServlet =
servletContext.addServlet("metricsServlet", new MetricsServlet());

metricsAdminServlet.addMapping("/metrics/metrics/*");
metricsAdminServlet.addMapping("/management/jhipster/metrics/*");
metricsAdminServlet.setAsyncSupported(true);
metricsAdminServlet.setLoadOnStartup(2);
}
Expand Down
2 changes: 1 addition & 1 deletion generators/server/templates/src/main/java/package/web/rest/_AuditResource.java
View file
Expand Up @@ -22,7 +22,7 @@
* REST controller for getting the audit events.
*/
@RestController
@RequestMapping(value = "/api/audits", produces = MediaType.APPLICATION_JSON_VALUE)
@RequestMapping(value = "/management/jhipster/audits", produces = MediaType.APPLICATION_JSON_VALUE)
public class AuditResource {

private AuditEventService auditEventService;
Expand Down
2 changes: 1 addition & 1 deletion generators/server/templates/src/main/java/package/web/rest/_LogsResource.java
View file
Expand Up @@ -17,7 +17,7 @@
* Controller for view and managing Log Level at runtime.
*/
@RestController
@RequestMapping("/api")
@RequestMapping("/management/jhipster")
public class LogsResource {

@RequestMapping(value = "/logs",
Expand Down
4 changes: 3 additions & 1 deletion generators/server/templates/src/main/resources/config/_application.yml
View file
Expand Up @@ -20,12 +20,14 @@ eureka:
ribbon:
eureka:
enabled: true

<%_ } _%>
<%_ if (applicationType == 'gateway') { _%>

zuul:

<%_ } _%>
management:
context-path: /management

spring:
application:
Expand Down
2 changes: 1 addition & 1 deletion generators/server/templates/src/test/resources/config/_application.yml
View file
Expand Up @@ -115,7 +115,7 @@ jhipster:
<%_ if (authenticationType == 'oauth2') { _%>
oauth:
clientid: <%= baseName %>app
secret: mySecretOAuthSecret
secret: my-secret-token-to-change-in-production
# Token is valid 30 minutes
tokenValidityInSeconds: 1800
<%_ } _%>
Expand Down

0 comments on commit bd09d3b

Please sign in to comment.