基于SpringBoot应用监控Actuator安全隐患及解决方式

<dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

# 访问示例：http://localhost:9595/monitor
management:
  endpoints:
    web:
      # actuator的访问路径，替换默认/actuator
      base-path: /monitor
      # 设置是否暴露端点 默认只有health和info可见
      exposure:
        # include: env   # 方式1: 暴露端点env，配置多个以,隔开
        include: "*"     # 方式2: 包括所有端点，注意需要添加引号
        # 排除端点
        exclude: shutdown
  server:
    port: 9595  #新开监控端口，不和应用用同一个端口
  endpoint:
    health:
      show-details: always # 显示db、redis、rabbti连接情况等
    shutdown:
      enabled: true  #默认情况下，除shutdown以外的所有端点均已启用。手动开启

endpoint:
 env:
    enabled: false

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

spring:
 security:
    user:
      password: 123456
      name: jaler

package com.jaler.common.common.config; 
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.env.Environment;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 
@Configuration
@EnableWebSecurity
public class ActuatorSecurityConfig extends WebSecurityConfigurerAdapter {
 
  @Autowired
  Environment env;
 
  @Override
  protected void configure(HttpSecurity security) throws Exception { 
        String contextPath = env.getProperty("management.endpoints.web.base-path");
        if(StringUtils.isEmpty(contextPath)) {
            contextPath = "";
        }
        security.csrf().disable();
        security.authorizeRequests()
                .antMatchers("/**"+contextPath+"/**")
                .authenticated()
                .anyRequest()
                .permitAll()
                .and()
                .httpBasic(); 
     }
}