1. 背景
項目組使用的 Spring Boot 比較老，是 1.5.4.RELEASE 。最近被檢測出 Spring Eureka 未授權訪問漏洞。
現狀是瀏覽器直接訪問 Eureka Server 可以直接進去，看到已經注冊的服務信息。
2. 方法
2.1 Eureka Server 添加安全組件
Eureka Server 添加 pom 依賴：
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
2.2 Eureka Server 添加參數
spring.application.name:demo-eureka
server.port: 8088
eureka.instance.hostname=localhost
#禁用將自己作為客戶端注冊，禁用客戶端注冊行為
eureka.client.register-with-eureka=false
eureka.client.fetch-registry=false
#eureka地址
eureka.client.service-url.defaultZone=http://${spring.security.user.name}:${spring.security.user.password}@${eureka.instance.hostname}:${server.port}/eureka
#eureka.client.service-url.defaultZone=http://${eureka.instance.hostname}:${server.port}/eureka
#關閉自我保護 --本地開發(fā)環(huán)境可以關閉，生產環(huán)境
eureka.server.enable-self-preservation = false
#清理節(jié)點時間
eureka.server.eviction-interval-timer-in-ms = 60000
spring.security.basic.enabled=true
spring.security.user.name=demo
spring.security.user.password=123abcd
2.3 重啟 Eureka Server
重啟 Eureka Server ，然后刷新訪問頁面，顯示登錄框：
輸入配置的用戶名和密碼。
spring.security.user.name=demo
spring.security.user.password=123abcd
然后就報錯了：Reason: Bad credentials。
奇怪，明明是按照配置文件里面輸入的，怎么還會報用戶名或密碼錯誤呢。
查了一些資料，說跟 security 加密方法有關，整了半天搞不定。
2.4 Eureka Server 升級版本
實在沒招了，只能懷疑用的框架版本太低，去重新整一個，eureka 就用了個服務發(fā)現，問題不大。
訪問：https://start.spring.io/
把項目下載到本地，依賴已經加好了：
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-netflix-eureka-server</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-dependencies</artifactId>
<version>${spring-cloud.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
在啟動類上加上注解：
package com.demo.cloudeurekaserver;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.cloud.netflix.eureka.server.EnableEurekaServer;
@EnableEurekaServer
@SpringBootApplication
public class CloudEurekaServerApplication {
public static void main(String[] args) {
SpringApplication.run(CloudEurekaServerApplication.class, args);
}
}
再把 2.2 的參數加到 properties 文件中（最好換個 server.port），然后 run 啟動類，訪問 eureka ，輸入用戶名和密碼，進去了：
2.5 Eureka Client 配置
eureka client 參數：
eureka.client.enabled=true
eureka.client.eureka-server-port=8089
eureka.client.service-url.defaultZone=http://demo:123abcd@localhost:8089/eureka/
啟動 eureka client，報錯：
javax.ws.rs.WebApplicationException: null
at com.netflix.discovery.provider.DiscoveryJerseyProvider.readFrom(DiscoveryJerseyProvider.java:110)
at com.sun.jersey.api.client.ClientResponse.getEntity(ClientResponse.java:634)
at com.sun.jersey.api.client.ClientResponse.getEntity(ClientResponse.java:586)
at com.netflix.discovery.shared.transport.jersey.AbstractJerseyEurekaHttpClient.sendHeartBeat(AbstractJerseyEurekaHttpClient.java:105)
at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$3.execute(EurekaHttpClientDecorator.java:92)
at com.netflix.discovery.shared.transport.decorator.MetricsCollectingEurekaHttpClient.execute(MetricsCollectingEurekaHttpClient.java:73)
at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89)
at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$3.execute(EurekaHttpClientDecorator.java:92)
at com.netflix.discovery.shared.transport.decorator.RedirectingEurekaHttpClient.executeOnNewServer(RedirectingEurekaHttpClient.java:118)
at com.netflix.discovery.shared.transport.decorator.RedirectingEurekaHttpClient.execute(RedirectingEurekaHttpClient.java:79)
at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89)
at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$3.execute(EurekaHttpClientDecorator.java:92)
at com.netflix.discovery.shared.transport.decorator.RetryableEurekaHttpClient.execute(RetryableEurekaHttpClient.java:119)
at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89)
at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$3.execute(EurekaHttpClientDecorator.java:92)
at com.netflix.discovery.shared.transport.decorator.SessionedEurekaHttpClient.execute(SessionedEurekaHttpClient.java:77)
at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89)
at com.netflix.discovery.DiscoveryClient.renew(DiscoveryClient.java:824)
at com.netflix.discovery.DiscoveryClient$HeartbeatThread.run(DiscoveryClient.java:1388)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
2023-11-03 14:41:26.339 WARN [test-app-service,,,] 16240 --- [tbeatExecutor-0] c.n.d.s.t.d.RetryableEurekaHttpClient : Request execution failed with message: null
2023-11-03 14:41:26.339 ERROR [test-app-service,,,] 16240 --- [tbeatExecutor-0] com.netflix.discovery.DiscoveryClient : DiscoveryClient_TEST-APP-SERVICE/10.136.44.122:test-app-service:60000 - was unable to send heartbeat!
com.netflix.discovery.shared.transport.TransportException: Cannot execute request on any known server
at com.netflix.discovery.shared.transport.decorator.RetryableEurekaHttpClient.execute(RetryableEurekaHttpClient.java:111)
at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89)
at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$3.execute(EurekaHttpClientDecorator.java:92)
at com.netflix.discovery.shared.transport.decorator.SessionedEurekaHttpClient.execute(SessionedEurekaHttpClient.java:77)
at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89)
at com.netflix.discovery.DiscoveryClient.renew(DiscoveryClient.java:824)
at com.netflix.discovery.DiscoveryClient$HeartbeatThread.run(DiscoveryClient.java:1388)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
刷新 eureka 頁面，也沒有服務信息，服務注冊失敗了。
這是因為從 Spring Boot 2.0 開始，默認情況下會啟用CSRF保護，以防止CSRF攻擊應用程序，導致服務注冊失敗。
2.6 Eureka Server 添加代碼
修改 Eureka Server ：
package com.demo.cloudeurekaserver;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.cloud.netflix.eureka.server.EnableEurekaServer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@EnableEurekaServer
@SpringBootApplication
public class CloudEurekaServerApplication {
public static void main(String[] args) {
SpringApplication.run(CloudEurekaServerApplication.class, args);
}
/**
* springboot 從 2.0 開始，默認情況下會啟用CSRF保護
* 需要關閉
*/
@EnableWebSecurity
static class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
//方法1：關閉csrf
// http.csrf().disable();
//方法2：忽略/eureka/** 所有請求
http.csrf().ignoringAntMatchers("/eureka/**");
super.configure(http);
}
}
}
重啟 Eureka Server 和 Eureka Client ，這次沒有報錯，刷新頁面，重新登錄后，看到注冊的服務信息：
2.7 其他問題
在 Spring Security 5.7.0-M2 中，WebSecurityConfigurerAdapter 被棄用了，Spring 鼓勵用戶轉向基于組件的安全配置。這意味著，現在應該使用基于組件的安全配置來配置 HttpSecurity，而不是繼承 WebSecurityConfigurerAdapter。這種方式更加靈活，可以更好地支持 Spring Boot 2.x 和 Spring 5.x。
我試了幾個方法，沒有替換掉，靠你了，耿小姐。文章來源：http://www.zghlxwxcb.cn/news/detail-753487.html
先這樣吧。
（圖網，侵刪）文章來源地址http://www.zghlxwxcb.cn/news/detail-753487.html
到了這里，關于Java配置47-Spring Eureka 未授權訪問漏洞修復的文章就介紹完了。如果您還想了解更多內容，請在右上角搜索TOY模板網以前的文章或繼續(xù)瀏覽下面的相關文章，希望大家以后多多支持TOY模板網！
