add security to spring admin

Colorful Crossbill answered on March 9, 2024 Popularity 3/10 Helpfulness 2/10

answer add security to spring admin

add security to spring admin

Comment

@Configuration(proxyBeanMethods = false)
public class SecuritySecureConfig {

        private final AdminServerProperties adminServer;

        private final SecurityProperties security;

        public SecuritySecureConfig(AdminServerProperties adminServer, SecurityProperties security) {
                this.adminServer = adminServer;
                this.security = security;
        }

        @Bean
        protected SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                SavedRequestAwareAuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
                successHandler.setTargetUrlParameter("redirectTo");
                successHandler.setDefaultTargetUrl(this.adminServer.path("/"));

                http.authorizeHttpRequests((authorizeRequests) -> authorizeRequests //
                        .requestMatchers(new AntPathRequestMatcher(this.adminServer.path("/assets/**")))
                        .permitAll() (1)
                        .requestMatchers(new AntPathRequestMatcher(this.adminServer.path("/actuator/info")))
                        .permitAll()
                        .requestMatchers(new AntPathRequestMatcher(adminServer.path("/actuator/health")))
                        .permitAll()
                        .requestMatchers(new AntPathRequestMatcher(this.adminServer.path("/login")))
                        .permitAll()
                        .dispatcherTypeMatchers(DispatcherType.ASYNC)
                        .permitAll() // https://github.com/spring-projects/spring-security/issues/11027
                        .anyRequest()
                        .authenticated()) (2)
                        .formLogin(
                                        (formLogin) -> formLogin.loginPage(this.adminServer.path("/login")).successHandler(successHandler)) (3)
                        .logout((logout) -> logout.logoutUrl(this.adminServer.path("/logout")))
                        .httpBasic(Customizer.withDefaults()); (4)

                http.addFilterAfter(new CustomCsrfFilter(), BasicAuthenticationFilter.class) (5)
                        .csrf((csrf) -> csrf.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                                .csrfTokenRequestHandler(new CsrfTokenRequestAttributeHandler())
                                .ignoringRequestMatchers(
                                                new AntPathRequestMatcher(this.adminServer.path("/instances"), POST.toString()), (6)
                                                new AntPathRequestMatcher(this.adminServer.path("/instances/*"), DELETE.toString()), (6)
                                                new AntPathRequestMatcher(this.adminServer.path("/actuator/**")) (7)
                                ));

                http.rememberMe((rememberMe) -> rememberMe.key(UUID.randomUUID().toString()).tokenValiditySeconds(1209600));

                return http.build();

        }

        // Required to provide UserDetailsService for "remember functionality"
        @Bean
        public InMemoryUserDetailsManager userDetailsService(PasswordEncoder passwordEncoder) {
                UserDetails user = User.withUsername("user").password(passwordEncoder.encode("password")).roles("USER").build();
                return new InMemoryUserDetailsManager(user);
        }

        @Bean
        public PasswordEncoder passwordEncoder() {
                return new BCryptPasswordEncoder();
        }

}

Popularity 3/10 Helpfulness 2/10 Language java

Source: docs.spring-boot-admin.com

Tags: add java security

Link to this answer
Share Copy Link

Contributed on Mar 09 2024

Colorful Crossbill

0 Answers Avg Quality 2/10

add security to spring admin

Contents

More Related Answers

add security to spring admin

Grepper

Documentation

Social

Legal

Contact

Oops, You will need to install Grepper and log-in to perform this action.