java Spring启动版本从2.0.1升级到2.1.6，使URL“受保护”

Question

我有一个springbootweb项目，它提供各种http服务（cxfws、httpinvoker、healthcheck等）

当我用SpringBoot2.0.1构建它时，一切都正常。httpInvoker服务是可用的，在healtcheck url上我收到一个纯文本“绿色”等等

当我使用SpringBoot2.1.6构建它时，每个服务都会重定向到一个登录页面（/login）

如何使用Spring Boot 2.1.6获得“旧行为”

以下是配置：

@SpringBootApplication(exclude = { //
        DataSourceAutoConfiguration.class, //
        JacksonAutoConfiguration.class, //
        JtaAutoConfiguration.class, //
        RedisAutoConfiguration.class, //
        RestTemplateAutoConfiguration.class, //
        SecurityAutoConfiguration.class, //
        WebSocketServletAutoConfiguration.class, //
        MetricsAutoConfiguration.class // GC overhead limit exceeded SimplePauseDetector kiikatsása miatt
})
@ComponentScan( //
        basePackages = { //
.... various packages
}) //
@EnableConfigurationProperties
@EnableScheduling
public class XXXService extends SpringBootServletInitializer {

    private static final Logger LOGGER = LoggerFactory.getLogger(XXXService.class);

    private static SpringApplicationBuilder configureApplication(SpringApplicationBuilder applicationBuilder) {
        Map<String, Object> props = new HashMap<>();
        props.put("spring.config.name", "XXX-service-config");
        props.put("spring.batch.job.enabled", "false");
        props.put("server.connection-timeout", "5000");
        applicationBuilder.properties(props);
        applicationBuilder.listeners(new XXXServicePropertiesLogger());
        return applicationBuilder.sources(XXXService.class);
    }

    public static void main(String[] args) {
        configureApplication(new SpringApplicationBuilder()).run(args);
    }

    @Override
    protected SpringApplicationBuilder configure(SpringApplicationBuilder applicationBuilder) {
        return configureApplication(applicationBuilder);
    }

}

Answer 1

Securing HTTP Endpoints You should take care to secure HTTP endpoints in the same way that you would any other sensitive URL. If Spring Security is present, endpoints are secured by default using Spring Security’s content-negotiation strategy doc

添加属性

management.endpoints.web.exposure.include=*

将执行器的健康端点排除在安全范围之外