From e7e3284f26ad1f5f33ea48e1e9d8e4f854777e09 Mon Sep 17 00:00:00 2001 From: kl Date: Thu, 8 Oct 2026 14:17:07 +0800 Subject: [PATCH] fix: expose only aggregate health information by default --- server/src/main/config/application.properties | 4 +-- .../config/ActuatorExposureSecurityTests.java | 30 +++++++++++++++++++ 2 files changed, 32 insertions(+), 2 deletions(-) create mode 100644 server/src/test/java/cn/keking/config/ActuatorExposureSecurityTests.java diff --git a/server/src/main/config/application.properties b/server/src/main/config/application.properties index 3e3913bc..9bc1bd9e 100644 --- a/server/src/main/config/application.properties +++ b/server/src/main/config/application.properties @@ -35,8 +35,8 @@ spring.freemarker.request-context-attribute = request spring.freemarker.suffix = .ftl # Spring Boot Actuator监控端点配置 -management.endpoints.web.exposure.include = health,info,metrics -management.endpoint.health.show-details = always +management.endpoints.web.exposure.include = health +management.endpoint.health.show-details = never management.health.defaults.enabled = true diff --git a/server/src/test/java/cn/keking/config/ActuatorExposureSecurityTests.java b/server/src/test/java/cn/keking/config/ActuatorExposureSecurityTests.java new file mode 100644 index 00000000..792aa31b --- /dev/null +++ b/server/src/test/java/cn/keking/config/ActuatorExposureSecurityTests.java @@ -0,0 +1,30 @@ +package cn.keking.config; + +import org.junit.jupiter.api.Test; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.boot.autoconfigure.EnableAutoConfiguration; +import org.springframework.boot.test.context.SpringBootTest; +import org.springframework.boot.test.web.client.TestRestTemplate; +import org.springframework.context.annotation.Configuration; +import org.springframework.http.HttpStatus; + +import static org.junit.jupiter.api.Assertions.*; + +@SpringBootTest(classes = ActuatorExposureSecurityTests.ManagementApp.class, + webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT) +class ActuatorExposureSecurityTests { + @Configuration(proxyBeanMethods = false) + @EnableAutoConfiguration + static class ManagementApp { } + + @Autowired TestRestTemplate http; + + @Test void shippedDefaultsExposeOnlyAnAggregateHealthStatus() { + var health = http.getForEntity("/actuator/health", String.class); + assertEquals(HttpStatus.OK, health.getStatusCode()); + assertEquals("{\"status\":\"UP\"}", health.getBody()); + assertEquals(HttpStatus.NOT_FOUND, http.getForEntity("/actuator/info", String.class).getStatusCode()); + assertEquals(HttpStatus.NOT_FOUND, http.getForEntity("/actuator/metrics", String.class).getStatusCode()); + assertEquals(HttpStatus.NOT_FOUND, http.getForEntity("/actuator/metrics/jvm.memory.used", String.class).getStatusCode()); + } +}