springboot 1.3.6中使用actuator默认开启监控，如何防止数据泄漏

最新推荐文章于 2025-06-27 10:41:18 发布

loongshawn

最新推荐文章于 2025-06-27 10:41:18 发布

阅读量2.8k

点赞数

CC 4.0 BY-SA版权

分类专栏： JAVA SpringBoot 文章标签： springboot actuator url filter

本文链接：https://blog.youkuaiyun.com/loongshawn/article/details/83346595

本文介绍了在SpringBoot 1.3.6版本中，由于actuator默认开启监控可能导致数据泄漏的问题。在非Web工程且提供API服务的情况下，未过滤的监控URL可能会暴露敏感信息。虽然在SpringBoot 2.0可以通过配置关闭监控，但在1.x版本中，作者建议通过URL过滤的方式来防止数据泄漏，即设定URL过滤器只允许特定URL访问，拦截其他不必要的监控URL。

在添加完依赖后

<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-actuator</artifactId>
</dependency>

启动工程时会看到如下日志：

2018-10-24 15:48:59.355  INFO 15657 --- [           main] o.s.b.a.e.mvc.EndpointHandlerMapping     : Mapped "{[/env/{name:.*}],methods=[GET],produces=[application/json]}" onto public java.lang.Object org.springframework.boot.actuate.endpoint.mvc.EnvironmentMvcEndpoint.value(java.lang.String)
2018-10-24 15:48:59.355  INFO 15657 --- [           main] o.s.b.a.e.mvc.EndpointHandlerMapping     : Mapped "{[/env || /env.json],methods=[GET],produces=[application/json]}" onto public java.lang.Object org.springframework.boot.actuate.endpoint.mvc.EndpointMvcAdapter.invoke()
2018-10-24 15:48:59.356  INFO 15657 --- [           main] o.s.b.a.e.mvc.EndpointHandlerMapping     : Mapped "{[/info || /info.json],methods=[GET],produces=[application/json]}" onto public java.lang.Object org.springframework.boot.actuate.endpoint.mvc.EndpointMvcAdapter.invoke()
2018-10-24 15:48:59.356  INFO 15657 --- [           main] o.s.b.a.e.mvc.EndpointHandlerMapping     : Mapped "{[/beans || /beans.json],methods=[GET],produces=[application/json]}" onto public java.lang.Object org.springframework.boot.actuate.endpoint.mvc.EndpointMvcAdapter.invoke()
2018-10-24 15:48:59.357  INFO 15657 --- [           main] o.s.b.a.e.mvc.EndpointHandlerMapping     : Mapped "{[/health || /health.json],produces=[application/json]}" onto public java.lang.Object org.springframework.boot.actuate.endpoint.mvc.HealthMvcEndpoint.invoke(java.security.Principal)
2018-10-24 15:48:59.357  INFO 15657 --- [           main] o.s.b.a.e.mvc.EndpointHandlerMapping     : Mapped "{[/metrics/{name:.*}],methods=[GET],produces=[application/json]}" onto public java.lang.Object org.springframework.boot.actuate.endpoint.mvc.MetricsMvcEndpoint.value(java.lang.String)
2018-10-24 15:48:59.357  INFO 15657 --- [           main] o.s.b.a.e.mvc.EndpointHandlerMapping     : Mapped "{[/metrics || /metrics.json],methods=[GET],produces=[application/json]}" onto public java.lang.Object org.springframework.boot.actuate.endpoint.mvc.EndpointMvcAdapter.invoke()
2018-10-24 15:48:59.358  INFO 15657 --- [           main] o.s.b.a.e.mvc.EndpointHandlerMapping     : Mapped "{[/dump || /dump.json],methods=[GET],produces=[application/json]}" onto public java.lang.Object org.springframework.boot.actuate.endpoint.mvc.EndpointMvcAdapter.invoke()
2018-10-24 15:48:59.359  INFO 15657 --- [           main] o.s.b.a.e.mvc.EndpointHandlerMapping     : Mapped "{[/autoconfig || /autoconfig.json],methods=[GET],produces=[application/json]}" onto public java.lang.Object org.springframework.boot.actuate.endpoint.mvc.EndpointMvcAdapter.invoke()
2018-10-24 15:48:59.359  INFO 15657 --- [           main] o.s.b.a.e.mvc.EndpointHandlerMapping     : Mapped "{[