From eb57b222460ec11049d6cab891638ef4523b26ea Mon Sep 17 00:00:00 2001 From: YunaiV Date: Sun, 3 May 2026 10:42:48 +0800 Subject: [PATCH] 1515 feat: 修正SpringbootAdmin监控页面在iframe中可以正常显示 --- yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java b/yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java index 2fb726e..fc33ce1 100644 --- a/yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java +++ b/yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java @@ -9,6 +9,7 @@ import org.springframework.context.annotation.Configuration; import org.springframework.core.annotation.Order; import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.crypto.password.PasswordEncoder; @@ -40,7 +41,6 @@ public class AdminServerConfiguration { @Value("${spring.boot.admin.client.password:admin}") private String password; - // 新增：注入允许的 frame 嵌入域名 @Value("${spring.boot.admin.frame-ancestors:'self'}") private String frameAncestors; @@ -104,14 +104,16 @@ public class AdminServerConfiguration { adminSeverContextPath + "/instances", // Admin Client 注册端点忽略 CSRF adminSeverContextPath + "/actuator/**" // Actuator 端点忽略 CSRF ) - )// 修正后的 headers 配置（替换原来报错的代码） + ) .headers(headers -> headers - // 关键修正：传入合法的基础 CSP 指令，而非空字符串 + // 特殊：Spring Boot Admin 前端基于 Vue，需 unsafe-inline ／ unsafe-eval 支持内联脚本与表达式 .contentSecurityPolicy(csp -> csp.policyDirectives( - "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-ancestors " + frameAncestors ) - ) - .frameOptions(frame -> frame.sameOrigin()) // 显式设置 X-Frame-Options 为 SAMEORIGIN - .cacheControl(cache -> cache.disable()) // 禁用缓存，避免旧配置生效 + "default-src 'self'; " + + "script-src 'self' 'unsafe-inline' 'unsafe-eval'; " + + "style-src 'self' 'unsafe-inline'; " + + "frame-ancestors " + frameAncestors)) + .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin) // 显式设置 X-Frame-Options 为 SAMEORIGIN + .cacheControl(HeadersConfigurer.CacheControlConfig::disable) // 禁用缓存，避免旧配置生效 ); return httpSecurity.build(); } -- libgit2 0.21.4