BJ_ZTEITS-Developers / parking-cloud-yudao

Commit eb57b222460ec11049d6cab891638ef4523b26ea

Authored by YunaiV
1 parent 792a6050

1515 feat: 修正SpringbootAdmin监控页面在iframe中可以正常显示

Inline Side-by-side
Showing 1 changed file with 9 additions and 7 deletions
yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java
  View file @eb57b22
... ... @@ -9,6 +9,7 @@ import org.springframework.context.annotation.Configuration;
9 9 import org.springframework.core.annotation.Order;
10 10 import org.springframework.security.config.Customizer;
11 11 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  12 +import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
12 13 import org.springframework.security.core.userdetails.User;
13 14 import org.springframework.security.core.userdetails.UserDetails;
14 15 import org.springframework.security.crypto.password.PasswordEncoder;
... ... @@ -40,7 +41,6 @@ public class AdminServerConfiguration {
40 41 @Value("${spring.boot.admin.client.password:admin}")
41 42 private String password;
42 43  
43   - // 新增：注入允许的 frame 嵌入域名
44 44 @Value("${spring.boot.admin.frame-ancestors:'self'}")
45 45 private String frameAncestors;
46 46  
... ... @@ -104,14 +104,16 @@ public class AdminServerConfiguration {
104 104 adminSeverContextPath + "/instances", // Admin Client 注册端点忽略 CSRF
105 105 adminSeverContextPath + "/actuator/**" // Actuator 端点忽略 CSRF
106 106 )
107   - )// 修正后的 headers 配置（替换原来报错的代码）
  107 + )
108 108 .headers(headers -> headers
109   - // 关键修正：传入合法的基础 CSP 指令，而非空字符串
  109 + // 特殊：Spring Boot Admin 前端基于 Vue，需 unsafe-inline ／ unsafe-eval 支持内联脚本与表达式
110 110 .contentSecurityPolicy(csp -> csp.policyDirectives(
111   - "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-ancestors " + frameAncestors )
112   - )
113   - .frameOptions(frame -> frame.sameOrigin()) // 显式设置 X-Frame-Options 为 SAMEORIGIN
114   - .cacheControl(cache -> cache.disable()) // 禁用缓存，避免旧配置生效
  111 + "default-src 'self'; "
  112 + + "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
  113 + + "style-src 'self' 'unsafe-inline'; "
  114 + + "frame-ancestors " + frameAncestors))
  115 + .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin) // 显式设置 X-Frame-Options 为 SAMEORIGIN
  116 + .cacheControl(HeadersConfigurer.CacheControlConfig::disable) // 禁用缓存，避免旧配置生效
115 117 );
116 118 return httpSecurity.build();
117 119 }
... ...