漏洞扫描修改

mhd-visual/mhd-monitor/src/main/java/com/mhd/modules/monitor/config/WebSecurityConfigurer.java

@@ -1,6 +1,7 @@
 package com.mhd.modules.monitor.config;
 
 import de.codecentric.boot.admin.server.config.AdminServerProperties;
+import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
 import org.springframework.context.annotation.Bean;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
@@ -9,7 +10,7 @@ import org.springframework.security.web.authentication.SavedRequestAwareAuthenti
 
 /**
  * 监控权限配置
- * 
+ *
  * @author mhd
  */
 @EnableWebSecurity
@@ -32,11 +33,23 @@ public class WebSecurityConfigurer
         return httpSecurity
                 .headers().frameOptions().disable()
                 .and().authorizeRequests()
+                .antMatchers("/actuator/health", "/actuator/info").permitAll() //扫描漏洞添加
+                .antMatchers("/actuator/**").authenticated() //扫描漏洞添加
                 .antMatchers(adminContextPath + "/assets/**"
                         , adminContextPath + "/login"
                         , adminContextPath + "/actuator/**"
                         , adminContextPath + "/instances/**"
                 ).permitAll()
+                // 管理端点需要认证
+                .antMatchers("/actuator/**").hasRole("ADMIN")//扫描漏洞添加
+                .antMatchers("/admin/**").hasRole("ADMIN")//扫描漏洞添加
+                .antMatchers("/actuator/env").hasRole("plat_admin") // 仅允许ADMIN角色访问/env端点 //扫描漏洞添加
+                // 允许公开访问的端点
+                .requestMatchers(EndpointRequest.to("health", "info", "prometheus"))//扫描漏洞添加
+                .permitAll()
+                // 敏感端点需要管理员权限
+                .requestMatchers(EndpointRequest.to("env", "configprops", "beans", "mappings"))//扫描漏洞添加
+                .hasRole("ADMIN")
                 .anyRequest().authenticated()
                 .and()
                 .formLogin().loginPage(adminContextPath + "/login")