From b9c39ad990fddb92869059b107fc9ea1c00357b6 Mon Sep 17 00:00:00 2001 From: hitanshu310 Date: Tue, 28 Jul 2026 11:45:33 +0530 Subject: [PATCH] Hithomelabs/CFTunnels#149: Fix actuator security to allow unauthenticated health/info on management port - Upgrade ActuatorSecurityConfig to @Order(Ordered.HIGHEST_PRECEDENCE) at class level to ensure filter chain is evaluated before auto-configured management security - Replace string-based securityMatcher with EndpointRequest.toAnyEndpoint() for proper Spring Boot actuator endpoint matching - Add belt-and-suspenders permitAll() for /actuator/health and /actuator/info in SecuirtyConfig so health endpoints are accessible even if filter chain ordering fails - Root cause: SecuirtyConfig catch-all (no securityMatcher) was intercepting actuator requests on the separate management port (management.server.port=8081) and redirecting to OIDC login before ActuatorSecurityConfig filter chain could apply --- .../Config/Security/ActuatorSecurityConfig.java | 11 +++++++++-- .../cftunnels/Config/Security/SecuirtyConfig.java | 1 + 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/cftunnels-service/src/main/java/com/hithomelabs/cftunnels/Config/Security/ActuatorSecurityConfig.java b/cftunnels-service/src/main/java/com/hithomelabs/cftunnels/Config/Security/ActuatorSecurityConfig.java index 727d819..8aed60a 100644 --- a/cftunnels-service/src/main/java/com/hithomelabs/cftunnels/Config/Security/ActuatorSecurityConfig.java +++ b/cftunnels-service/src/main/java/com/hithomelabs/cftunnels/Config/Security/ActuatorSecurityConfig.java @@ -2,9 +2,11 @@ package com.hithomelabs.cftunnels.Config.Security; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.core.Ordered; import org.springframework.core.annotation.Order; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.web.SecurityFilterChain; +import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest; /** * Security configuration for Spring Boot Actuator endpoints. @@ -12,15 +14,20 @@ import org.springframework.security.web.SecurityFilterChain; * This configuration permits unauthenticated access to /actuator/health and /actuator/info * endpoints, enabling health monitoring by Uptime Kuma without requiring OIDC authentication. * All other actuator endpoints remain protected and require authentication. + * + * Uses @Order(Ordered.HIGHEST_PRECEDENCE) to ensure this filter chain is evaluated BEFORE + * any auto-configured management security filter chains (e.g., ManagementWebSecurityAutoConfiguration). + * Without this, the catch-all SecurityFilterChain in SecuirtyConfig can intercept actuator + * requests on the separate management port (management.server.port=8081) and redirect to OIDC login. */ @Configuration +@Order(Ordered.HIGHEST_PRECEDENCE) public class ActuatorSecurityConfig { @Bean - @Order(1) public SecurityFilterChain actuatorSecurityChain(HttpSecurity http) throws Exception { http - .securityMatcher("/actuator/**") + .securityMatcher(EndpointRequest.toAnyEndpoint()) .authorizeHttpRequests(auth -> auth .requestMatchers("/actuator/health", "/actuator/info").permitAll() .anyRequest().authenticated() diff --git a/cftunnels-service/src/main/java/com/hithomelabs/cftunnels/Config/Security/SecuirtyConfig.java b/cftunnels-service/src/main/java/com/hithomelabs/cftunnels/Config/Security/SecuirtyConfig.java index 6dd3073..2f004e7 100644 --- a/cftunnels-service/src/main/java/com/hithomelabs/cftunnels/Config/Security/SecuirtyConfig.java +++ b/cftunnels-service/src/main/java/com/hithomelabs/cftunnels/Config/Security/SecuirtyConfig.java @@ -29,6 +29,7 @@ public class SecuirtyConfig { http .authorizeHttpRequests(auth -> auth //.requestMatchers( "/v3/api-docs/**", "/swagger-ui/**", "/swagger-ui.html" ).permitAll() + .requestMatchers("/actuator/health", "/actuator/info").permitAll() .anyRequest().authenticated() ).csrf(csrf -> csrf.disable()) .with(new OAuth2LoginConfigurer<>(),