如何在 Spring Cloud Gateway 中的执行器端点上设置密码

Question

I use spring cloud gateway HoxtonSR8, spring boot 2.3.4 and spring actuator

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-actuator</artifactId>
    </dependency>

I want to set password on all actuator endpoints including health and info so only authenticated user can call them. But as far as I know it only can be done using spring security but this framework is incompatible with gateway.

How I can set password on actuator in cloud gateway?

Answer 1

Actuator endpoints reveal sensitive information about the application.

To password protect the actuator endpoints follow the below steps :

Step 1 : Add spring-boot-starter-security dependency in pom.xml .

   <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
   </dependency>

Thanks to SpringBoot Auto Configuration . It automatically initialises all the security related components.

Step 2 : Define a username and password in your property/yaml file.

See the below configuration.

spring:
  security:
    user:
      name: admin
      password: ********

Step 3 : Restart the application and try to access Secured Endpoints.

You should get “401 Unauthorized” response.

Step 4 : Open actuator endpoint in a Browser and it will prompt for username/password.

If you want just to secure you actuator endpoints, Add below config :

server:
  port: 8080
  context-path: /MyApplication

security:
   user:
       name: admin
       password: secret
   basic:
       enabled: false

management:
   context-path: /actuator
   security:
             enabled: true

This will make sure that application security is disabled but is enabled for actuator endpoints.

Note : Don't configure username/password under management security otherwise it will not work.