BJ_ZTEITS-Developers / parking-cloud-yudao

Commit 792a6050ce99982b5c2492074cb60e9c987ac553

Authored by 芋道源码
Committed by Gitee
2 parents e2840d1c cee20192

!1515 feat: 修正SpringbootAdmin监控页面在iframe中可以正常显示 

Merge pull request !1515 from 好羊羊/fix/springboot-iframe-deny
Inline Side-by-side
Showing 2 changed files with 14 additions and 0 deletions
yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java
  View file @792a605
... ... @@ -40,6 +40,10 @@ public class AdminServerConfiguration {
40 40 @Value("${spring.boot.admin.client.password:admin}")
41 41 private String password;
42 42  
  43 + // 新增：注入允许的 frame 嵌入域名
  44 + @Value("${spring.boot.admin.frame-ancestors:'self'}")
  45 + private String frameAncestors;
  46 +
43 47 /**
44 48 * Spring Boot Admin 专用的 InMemoryUserDetailsManager
45 49 * 使用内存存储，与系统用户隔离
... ... @@ -100,6 +104,14 @@ public class AdminServerConfiguration {
100 104 adminSeverContextPath + "/instances", // Admin Client 注册端点忽略 CSRF
101 105 adminSeverContextPath + "/actuator/**" // Actuator 端点忽略 CSRF
102 106 )
  107 + )// 修正后的 headers 配置（替换原来报错的代码）
  108 + .headers(headers -> headers
  109 + // 关键修正：传入合法的基础 CSP 指令，而非空字符串
  110 + .contentSecurityPolicy(csp -> csp.policyDirectives(
  111 + "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-ancestors " + frameAncestors )
  112 + )
  113 + .frameOptions(frame -> frame.sameOrigin()) // 显式设置 X-Frame-Options 为 SAMEORIGIN
  114 + .cacheControl(cache -> cache.disable()) // 禁用缓存，避免旧配置生效
103 115 );
104 116 return httpSecurity.build();
105 117 }
... ...
yudao-server/src/main/resources/application-local.yaml
  View file @792a605
... ... @@ -163,6 +163,8 @@ spring:
163 163 password: admin
164 164 # Spring Boot Admin Server 服务端的相关配置
165 165 context-path: /admin # 配置 Spring
  166 + # 允许嵌入 iframe 的域名（支持通配符），实际部署时，可以改为 "'self' [你的公网域名]"
  167 + frame-ancestors: "'self' localhost localhost:48080 127.0.0.1 127.0.0.1:48080"
166 168  
167 169 # 日志文件配置
168 170 logging:
... ...