Spring引导执行器：当其他执行器的endpoint被固定时，健康endpoint不显示详细信息

Question

目标：保护除信息和健康之外的所有执行器endpoint，但健康endpoint显示用户身份验证时的详细信息。

@Configuration
public class ActuatorSecurity extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.requestMatcher(EndpointRequest.toAnyEndpoint().excluding("info", "health"))
        .authorizeRequests()
        .anyRequest().authenticated()
        .and()
        .httpBasic();
  }
}

management:
  endpoints:
    web:
      exposure:
        include: "*"
  endpoint:
    health:
      show-details: "when-authorized"

谁有办法解决这个问题？

Answer 1

应使用

 protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
        .requestMatchers(EndpointRequest.toAnyEndpoint()
        .excluding("info", "health")).authenticated()
        .and().httpBasic();
  }

或

 protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
        .requestMatchers(EndpointRequest.to("info", "health"))
        .permitAll()
        .anyRequest().authenticated()
        .and().httpBasic();
  }