无法更改 Spring 引导管理中的日志级别

Question

I'm trying to change log levels at runtime in a Spring Boot Application using Spring Boot Admin but i get a 401 in the browser console and the log level is also not changed.

What i did is made a springadmin Application and a client named SpringBootClient , the admin would be changing the log levels of the client at runtime. When i log in into the springadmin Application and i give the username and password specified, i get logged in into the springadmin Application, and i can see my client as UP there, but when i go to change its logs in the loggers tab, i see a message like Configuring WARN failed , when i check the browser console it does a POST request to http://localhost:8080/instances/8723817f5b45/actuator/loggers/com.muktadirkhan and gives a 401 .

This is my application.properties of the springadmin application

spring.security.user.name=admin
spring.security.user.password=admin

management.endpoints.web.exposure.include=httptrace,loggers,health,info,metrics
spring.boot.admin.routes.endpoints=env, metrics, trace, jolokia, info, configprops

springadminApplication.java is like this:

package com.muktadirkhan.springboot;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Configuration;
import de.codecentric.boot.admin.server.config.EnableAdminServer;

@EnableAdminServer
@Configuration
@SpringBootApplication

public class SpringadminApplication {

    public static void main(String[] args) {
        SpringApplication.run(SpringadminApplication.class, args);
    }

}

I have also created a WebSecurityConfig.java in springadmin application which is like this:

package com.muktadirkhan.springboot;

import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

import de.codecentric.boot.admin.server.config.AdminServerProperties;
import de.codecentric.boot.admin.server.web.PathUtils;
import java.util.*;



import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.boot.convert.DurationUnit;
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    private final AdminServerProperties adminServer;

    public WebSecurityConfig(AdminServerProperties adminServer) {
        this.adminServer = adminServer;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        SavedRequestAwareAuthenticationSuccessHandler successHandler = 
          new SavedRequestAwareAuthenticationSuccessHandler();
        successHandler.setTargetUrlParameter("redirectTo");
        successHandler.setDefaultTargetUrl(this.adminServer.getContextPath() + "/");

        http
            .authorizeRequests()
                .antMatchers(this.adminServer.getContextPath() + "/assets/**").permitAll()
                .antMatchers(this.adminServer.getContextPath() + "/login").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage(this.adminServer.getContextPath() + "/login")
                .successHandler(successHandler)
                .and()
            .logout()
                .logoutUrl(this.adminServer.getContextPath() + "/logout")
                .and()
            .httpBasic()
                .and()
            .csrf()
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                .ignoringRequestMatchers(
                  new AntPathRequestMatcher(this.adminServer.getContextPath() + 
                    "/instances", HttpMethod.POST.toString()), 
                  new AntPathRequestMatcher(this.adminServer.getContextPath() + 
                    "/instances/*", HttpMethod.DELETE.toString()),
                  new AntPathRequestMatcher(this.adminServer.getContextPath() + "/actuator/**"))
                .and()
                .rememberMe()
                .key(UUID.randomUUID().toString())
                .tokenValiditySeconds(1209600);
    }
}

And regarding the client, my SpringBootClientApplication.java is:

package com.muktadirkhan.springboot;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class SpringBootClientApplication {

    public static void main(String[] args) {
        SpringApplication.run(SpringBootClientApplication.class, args);
    }

}

The application.properties of the client:

server.port=8090
spring.boot.admin.client.url=http://localhost:8080
spring.boot.admin.url=http://localhost:8080

spring.boot.admin.client.username=admin
spring.boot.admin.client.password=admin

management.endpoints.web.exposure.include=*
management.endpoint.health.show-details=always

spring.security.user.name=admin
spring.security.user.password=admin
spring.boot.admin.client.instance.metadata.user.name=${spring.security.user.name}
spring.boot.admin.client.instance.metadata.user.password=${spring.security.user.password}

Answer 1

You probably have csrf security setup on your client that applies on the actuator endpoints exposed by this one, thus not allowing the spring boot admin server to do any POST request