Spring防尘套无法拦截执行器访问

Question

在SpringBoot版本2.1.6中，无法拦截访问执行器请求，现在我有了一个全局拦截器

@Component
public class ServiceFilter implements HandlerInterceptor {
//log4j
static final Logger logger = LogManager.getLogger(ServiceFilter.class);
private final RateLimiter limiter = RateLimiter.create(Runtime.getRuntime().availableProcessors() * 2 + 1);
private final ThreadLocal<ExecuteRecordDto> executeRecord = new ThreadLocal<>();

public ServiceFilter() {

}

@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
    ExecuteRecordDto recordDto =  ExecuteRecordDto.bulider(request);
    executeRecord.set(recordDto);
    if (!limiter.tryAcquire()) {
        logger.warn("rate limiter ; json logger :  {}",CommonUtil.toJSONString(recordDto));
        response.getWriter().print(CommonUtil.toJSONString(ResultStatus.status(407, "rate limiter")));
        return false;
    }

    if (ObjectUtils.isEmpty(request.getHeader("Authorization"))) {
        logger.warn("illegal request, json logger : {} ",CommonUtil.toJSONString(recordDto));
        response.getWriter().print(CommonUtil.toJSONString(ResultStatus.status(403, "Permission denied")));
        return false;
    }
    switch (TokenHandle.checkToken(request.getHeader("Authorization"))) {
        //正常放行token
        case 0:
            response.getWriter().print(CommonUtil.toJSONString(ResultStatus.status(407, "rate limiter")));
            return true;
        //token 过期
        case 1:
            response.getWriter().println(CommonUtil.toJSONString(ResultStatus.status(408, "Token expire")));
            break;
        //非法token
        case 2:
            logger.warn("illegal token, json logger : {} ",CommonUtil.toJSONString(recordDto));
            response.getWriter().print(CommonUtil.toJSONString(ResultStatus.status(409, "Illegal token ")));
            break;
        default:
            throw new RuntimeException("server runtime exception");
    }
    return true;
}

@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
    ExecuteRecordDto recordDto = executeRecord.get();
    logger.info("json logger : {}",CommonUtil.toJSONString(recordDto));
    executeRecord.remove();
}

}

让它工作起来

@Configuration
public class ConfigFilter implements WebMvcConfigurer {
private final ServiceFilter filter;
@Autowired
public ConfigFilter(ServiceFilter filter){
    this.filter = filter;
}
@Override
public void addInterceptors(InterceptorRegistry registry) {
    registry.addInterceptor(filter).addPathPatterns("/**");
}
}

Answer 1

执行器正在使用不同的HandlerMap（请参阅：org.springframework.boot.actuate.endpoint.web.servlet.WebMvcEndpoint HandlerMap）。

由于顺序（-100 vs 0），此Handler映射将选择在您配置的Request HandlerMaps之上。您可以在DispatcherServlet中看到这一点，正是方法HandlerExecutionChain getHandler（HttpServletRequest）。

在我们的项目中，我们使用spring security配置对执行器endpoint的访问，因此我不知道是否有任何推荐的方法，但：

处理程序是按顺序选择的，因此这是需要考虑的事情，您还可以尝试操作执行器WebMvcEndpoint HandlerMap。

就像我说的，我不确定正确的解决方案，但我希望它能指引你找到正确的解决方案。

问候，WiPu