SpringBoot应用监控Actuator使用隐患及解决方案

        <!-- 监控端点-->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>

management:
  endpoints:
    web:
      # actuator的访问路径，默认/actuator
      base-path: /actuator
      # 设置是否暴露端点 默认只有health和info可见
      exposure:
        # 如需暴漏指定端口，在下方输入，端口名称，多个端点之间用“，”分割。如：env,session。开放所        
        # 有用*号表示，如下所示
        include: "*"
  #新开监控端口，不设置采取项目端口（默认）
  server:
    port: 8081  
  endpoint:
    health:
      # 显示db、redis、rabbti连接情况等
      show-details: always 
    shutdown:
      enabled: true  

        <dependency>
            <groupId>cn.pomit</groupId>
            <artifactId>spring-boot-monitor</artifactId>
            <version>0.0.4</version>
        </dependency>

endpoint:
 env:
    enabled: false

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

spring:
  security:
    user:
      name: root
      password: 123456
      roles: ADMIN

@Configuration
@EnableWebSecurity
public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {
 
    @Override
    protected void configure(HttpSecurity http) {
        http.csrf().disable();
        http.formLogin().and()
                .authorizeRequests()
                .antMatchers("/**actuator/**","/**monitor/**")
                .authenticated()
                .anyRequest()
                .permitAll()
                .and()
                .httpBasic();
    }
 
    //添加账号、密码、权限
    @Autowired
    public  void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
                .withUser("root")
                .password(new BCryptPasswordEncoder().encode("123456"))
                .roles("ADMIN");
    }
 
 
}