Hithomelabs/CFTunnels
10
0
Fork 4
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

Hithomelabs/CFTunnels#149: Fix actuator security to allow unauthenticated health/info on management port #162

Merged
hitanshu merged 1 commits from main into test 2026-08-02 17:46:05 +00:00
Conversation 0 Commits 1 Files Changed 2 +10 -2
hitanshu commented 2026-08-02 17:42:33 +00:00
Owner
Copy Link
  • Upgrade ActuatorSecurityConfig to @Order(Ordered.HIGHEST_PRECEDENCE) at class level
    to ensure filter chain is evaluated before auto-configured management security
  • Replace string-based securityMatcher with EndpointRequest.toAnyEndpoint() for
    proper Spring Boot actuator endpoint matching
  • Add belt-and-suspenders permitAll() for /actuator/health and /actuator/info in
    SecuirtyConfig so health endpoints are accessible even if filter chain ordering fails
  • Root cause: SecuirtyConfig catch-all (no securityMatcher) was intercepting actuator
    requests on the separate management port (management.server.port=8081) and
    redirecting to OIDC login before ActuatorSecurityConfig filter chain could apply
- Upgrade ActuatorSecurityConfig to @Order(Ordered.HIGHEST_PRECEDENCE) at class level to ensure filter chain is evaluated before auto-configured management security - Replace string-based securityMatcher with EndpointRequest.toAnyEndpoint() for proper Spring Boot actuator endpoint matching - Add belt-and-suspenders permitAll() for /actuator/health and /actuator/info in SecuirtyConfig so health endpoints are accessible even if filter chain ordering fails - Root cause: SecuirtyConfig catch-all (no securityMatcher) was intercepting actuator requests on the separate management port (management.server.port=8081) and redirecting to OIDC login before ActuatorSecurityConfig filter chain could apply
hitanshu added 1 commit 2026-08-02 17:42:33 +00:00
Hithomelabs/CFTunnels#149: Fix actuator security to allow unauthenticated health/info on management port
All checks were successful
Daily cloudflare API integration test / cloudflare-api-test (push) Successful in 1m46s
Details
sample gradle build and test / build (pull_request) Successful in 1m58s
Details
Build & Push Portainer Automation / version (push) Successful in 6s
Details
Build & Push Portainer Automation / build-and-push (push) Successful in 2m11s
Details
Build & Push CFTunnels / version (push) Successful in 6s
Details
Build & Push CFTunnels / build-and-push (push) Successful in 2m45s
Details
b9c39ad990 
- Upgrade ActuatorSecurityConfig to @Order(Ordered.HIGHEST_PRECEDENCE) at class level
  to ensure filter chain is evaluated before auto-configured management security
- Replace string-based securityMatcher with EndpointRequest.toAnyEndpoint() for
  proper Spring Boot actuator endpoint matching
- Add belt-and-suspenders permitAll() for /actuator/health and /actuator/info in
  SecuirtyConfig so health endpoints are accessible even if filter chain ordering fails
- Root cause: SecuirtyConfig catch-all (no securityMatcher) was intercepting actuator
  requests on the separate management port (management.server.port=8081) and
  redirecting to OIDC login before ActuatorSecurityConfig filter chain could apply
hitanshu merged commit b9c39ad990 into test 2026-08-02 17:46:05 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
architect:complete

Architecture analysis completed

  
blocked-by:#139

Blocked by issue #139

  
blocks:#140

Blocks issue #140

  
bug

Defect or regression

  
CI/CD

CI/CD pipeline improvements

  
complexity:low

Low complexity - straightforward implementation

  
complexity:medium

Medium complexity - some unknowns

  
complexity:medium

Medium complexity - some nuance and risk areas

  
config

Configuration files and settings

  
depends-on:#124

Depends on architecture decision issue #124

  
docker

Docker-related tasks

  
docs

Documentation updates and improvements

  
effort:l

L effort estimate - 2-4 weeks (large feature, complex)

  
effort:s

S effort estimate - 2-5 days (small feature, well-defined)

  
effort:xs

XS effort estimate - 1-2 days

  
epic/development

Epic for development phase work

  
lead:complete

Lead engineer review completed

  
needs-decision

Requires human decision before proceeding

  
performance

Performance improvements

  
priority:critical

Must do immediately

  
priority:high

Important for current milestone

  
priority:low

Nice to have

  
priority:medium

Valuable but not urgent

  
security

Security-related concerns

  
spike

Research / exploration

  
story-points:1

Trivial effort

  
story-points:3

Small effort

  
story-points:5

Medium effort

  
story-points:8

Large effort

  
tech-debt

Refactoring / improvement

  
test

Testing-related tasks

  
user-story

Standard user story

  
architect:complete

Architect phase completed

  
complexity:high

High complexity

  
complexity:low

Low complexity

  
complexity:medium

Medium complexity

  
cross-repo

Cross-repository item

  
cross-repo-dev

Cross-repository development

  
dev:in-progress

Development in progress

  
effort:l

Large effort (2-4 weeks)

  
effort:m

Medium effort (1-2 weeks)

  
effort:s

Small effort (2-5 days)

  
effort:xl

Extra large effort (4+ weeks)

  
effort:xs

Extra small effort (1-2 days)

  
epic
analytics
Data analytics of platform data and logs analysis.

  
epic
development
Developing new features, services. front and and back end as well as batch jobs

  
epic
devops
Epic related to CI/CD pipeline, runners, setup and workflow triggers

  
epic
infra
Epic related to infrastructure tasks, configuring hard drives, network equipment, firewalls, anything involving getting hands dirty.

  
epic
observability
Observability stack, uptime, service discovery, network, firewall, processes, resource consumption etc.

  
epic
platform
Related to authentication, authorization, keys, passwords, configs. Updates and upgrades related to platform.

  
epic
product
Issues discussing products and features come over here.

  
lead:complete

Lead/Code review phase completed

  
needs-decision

Requires user decision/selection

  
pipeline-complete

Pipeline completed successfully

  
pipeline-error

Pipeline failed with error

  
pipeline-running

Pipeline is currently running

  
priority
later
To be done but can wait. Generally areas that don't want immediate attention and warrant pre-planning, analysis and/or design

  
priority
next
Not a burning issue but needs to be worked on next. Generally should not be blocked by any issue other than priority::now

  
priority
now
Immediate priority, critical for PROD go-live

  
start-pipeline

Trigger the SDLC pipeline to start

  
status
acceptance
Testing results are good and issue looks good to deploy. It is a pre-deployment sign-off of test results

  
status
blocked
Need to solve another issue before this issue can be picked. The issue is blocked till the blocking issue isn't resolved

  
status
done
Issue deployment successful.

  
status
in progress
Issue has been picked up and someone is working on it.

  
status
in review
The issue has been work on but, a review has been requested, generally good to transition to this if all PRs raised require review or are reviewed.

  
status
in testing
Code review complete and issue is in testing in lower environment. P.S. This means unit tests have already been written.

  
status
ready
Issue does not have any blocker and is ready to be picked.

  
status
refine
Something working already well in PROD but a change that makes life a little more easier, like skip into in netflix. Issues that signify added convenience.

  
status
triage
Issue is requested but not scoped. Need to be added to systematically review and categorize

  
subtask

Subtask issue

  
type
analysis
An issue to perform analysis, exploring deign and implementation decisions/ considerations.

  
type
bug
A bug, needs to be fixed, raised out of an incident.

  
type
hygiene
Features remain the same, makes the platform, faster, better and less-error prone. Makes developer/ system-admin life easier

  
type
mantainence
Primarily version upgrades

  
type
story
Something new, a new feature !

  
user-story

PM-created user story

No Label
architect:complete
blocked-by:#139
blocks:#140
bug
CI/CD
complexity:low
complexity:medium
complexity:medium
config
depends-on:#124
docker
docs
effort:l
effort:s
effort:xs
epic/development
lead:complete
needs-decision
performance
priority:critical
priority:high
priority:low
priority:medium
security
spike
story-points:1
story-points:3
story-points:5
story-points:8
tech-debt
test
user-story
architect:complete
complexity:high
complexity:low
complexity:medium
cross-repo
cross-repo-dev
dev:in-progress
effort:l
effort:m
effort:s
effort:xl
effort:xs
epic
analytics
epic
development
epic
devops
epic
infra
epic
observability
epic
platform
epic
product
lead:complete
needs-decision
pipeline-complete
pipeline-error
pipeline-running
priority
later
priority
next
priority
now
start-pipeline
status
acceptance
status
blocked
status
done
status
in progress
status
in review
status
in testing
status
ready
status
refine
status
triage
subtask
type
analysis
type
bug
type
hygiene
type
mantainence
type
story
user-story
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: Hithomelabs/CFTunnels#162
No description provided.
Delete Branch "main"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?