spring/spring-boot
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-boot.git synced 2026-09-17 12:09:16 +00:00
Code Issues Projects Releases Wiki Activity

Improve EndpointRequest matcher documentation

Browse Source 
Prior to this commit, `EndpointRequest` exposed factory methods for
creating security matchers in the context of Actuator endpoints. This is
using the popular pattern matching approach for security matchers.
Such matchers are not as focused as method-level security and will match
the endpoint path itself (`"actuator/endpoint"`) as well as everything
beneath it (`"actuator/endpoint/**"`).

This commit improves the Javadoc and reference documentation to make
this behavior more explicit.

Closes gh-49520
This commit is contained in:
Brian Clozel
2026-03-09 11:25:39 +01:00
parent a249315be3
commit e487a6b499
3 changed files with 22 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/spring-boot-docs/src/docs/antora/modules/reference/pages/actuator/endpoints.adoc
+3
View File
@@ -248,6 +248,9 @@ The preceding example uses `EndpointRequest.toAnyEndpoint()` to match a request
Several other matcher methods are also available on javadoc:org.springframework.boot.security.autoconfigure.actuate.web.servlet.EndpointRequest[].
See the xref:api:rest/actuator/index.adoc[API documentation] for details.
NOTE: When matching for Actuator endpoints, `EndpointRequest.to("endpoint")` will consider the endpoint root and all its subpaths,
effectively matching `"/actuator/endpoint/**"` even if the endpoint does not declare nested routes.
If you deploy applications behind a firewall, you may prefer that all your actuator endpoints can be accessed without requiring authentication.
You can do so by changing the configprop:management.endpoints.web.exposure.include[] property, as follows:
module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java
+10 -9
View File
@@ -69,11 +69,12 @@ public final class EndpointRequest {
}
/**
* Returns a matcher that includes all {@link Endpoint actuator endpoints}. It also
* includes the links endpoint which is present at the base path of the actuator
* endpoints. The {@link EndpointServerWebExchangeMatcher#excluding(Class...)
* excluding} method can be used to further remove specific endpoints if required. For
* example: <pre class="code">
* Returns a matcher that includes all {@link Endpoint actuator endpoints} and
* everything beneath them. It also includes the links endpoint which is present at
* the base path of the actuator endpoints. The
* {@link EndpointServerWebExchangeMatcher#excluding(Class...) excluding} method can
* be used to further remove specific endpoints if required. For example:
* <pre class="code">
* EndpointRequest.toAnyEndpoint().excluding(ShutdownEndpoint.class)
* </pre>
* @return the configured {@link ServerWebExchangeMatcher}
@@ -83,8 +84,8 @@ public final class EndpointRequest {
}
/**
* Returns a matcher that includes the specified {@link Endpoint actuator endpoints}.
* For example: <pre class="code">
* Returns a matcher that includes the specified {@link Endpoint actuator endpoints}
* everything beneath them. For example: <pre class="code">
* EndpointRequest.to(ShutdownEndpoint.class, HealthEndpoint.class)
* </pre>
* @param endpoints the endpoints to include
@@ -95,8 +96,8 @@ public final class EndpointRequest {
}
/**
* Returns a matcher that includes the specified {@link Endpoint actuator endpoints}.
* For example: <pre class="code">
* Returns a matcher that includes the specified {@link Endpoint actuator endpoints}
* everything beneath them. For example: <pre class="code">
* EndpointRequest.to("shutdown", "health")
* </pre>
* @param endpoints the endpoints to include
module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequest.java
+9 -9
View File
@@ -67,11 +67,11 @@ public final class EndpointRequest {
}
/**
* Returns a matcher that includes all {@link Endpoint actuator endpoints}. It also
* includes the links endpoint which is present at the base path of the actuator
* endpoints. The {@link EndpointRequestMatcher#excluding(Class...) excluding} method
* can be used to further remove specific endpoints if required. For example:
* <pre class="code">
* Returns a matcher that includes all {@link Endpoint actuator endpoints} and
* everything beneath them. It also includes the links endpoint which is present at
* the base path of the actuator endpoints. The
* {@link EndpointRequestMatcher#excluding(Class...) excluding} method can be used to
* further remove specific endpoints if required. For example: <pre class="code">
* EndpointRequest.toAnyEndpoint().excluding(ShutdownEndpoint.class)
* </pre>
* @return the configured {@link RequestMatcher}
@@ -81,8 +81,8 @@ public final class EndpointRequest {
}
/**
* Returns a matcher that includes the specified {@link Endpoint actuator endpoints}.
* For example: <pre class="code">
* Returns a matcher that includes the specified {@link Endpoint actuator endpoints}
* and everything beneath them. For example: <pre class="code">
* EndpointRequest.to(ShutdownEndpoint.class, HealthEndpoint.class)
* </pre>
* @param endpoints the endpoints to include
@@ -93,8 +93,8 @@ public final class EndpointRequest {
}
/**
* Returns a matcher that includes the specified {@link Endpoint actuator endpoints}.
* For example: <pre class="code">
* Returns a matcher that includes the specified {@link Endpoint actuator endpoints}
* and everything beneath them. For example: <pre class="code">
* EndpointRequest.to("shutdown", "health")
* </pre>
* @param endpoints the endpoints to include