BJ_ZTEITS-Developers / parking-cloud-yudao

Commit eb57b222460ec11049d6cab891638ef4523b26ea

Authored by YunaiV
1 parent 792a6050

1515 feat: 修正SpringbootAdmin监控页面在iframe中可以正常显示

Inline Side-by-side
Showing 1 changed file with 9 additions and 7 deletions
yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/framework/monitor/config/AdminServerConfiguration.java
  View file @eb57b22
@@ -9,6 +9,7 @@ import org.springframework.context.annotation.Configuration; @@ -9,6 +9,7 @@ import org.springframework.context.annotation.Configuration;
9 import org.springframework.core.annotation.Order; 9 import org.springframework.core.annotation.Order;
10 import org.springframework.security.config.Customizer; 10 import org.springframework.security.config.Customizer;
11 import org.springframework.security.config.annotation.web.builders.HttpSecurity; 11 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  12 +import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
12 import org.springframework.security.core.userdetails.User; 13 import org.springframework.security.core.userdetails.User;
13 import org.springframework.security.core.userdetails.UserDetails; 14 import org.springframework.security.core.userdetails.UserDetails;
14 import org.springframework.security.crypto.password.PasswordEncoder; 15 import org.springframework.security.crypto.password.PasswordEncoder;
@@ -40,7 +41,6 @@ public class AdminServerConfiguration { @@ -40,7 +41,6 @@ public class AdminServerConfiguration {
40 @Value("${spring.boot.admin.client.password:admin}") 41 @Value("${spring.boot.admin.client.password:admin}")
41 private String password; 42 private String password;
42 43
43 - // 新增：注入允许的 frame 嵌入域名  
44 @Value("${spring.boot.admin.frame-ancestors:'self'}") 44 @Value("${spring.boot.admin.frame-ancestors:'self'}")
45 private String frameAncestors; 45 private String frameAncestors;
46 46
@@ -104,14 +104,16 @@ public class AdminServerConfiguration { @@ -104,14 +104,16 @@ public class AdminServerConfiguration {
104 adminSeverContextPath + "/instances", // Admin Client 注册端点忽略 CSRF 104 adminSeverContextPath + "/instances", // Admin Client 注册端点忽略 CSRF
105 adminSeverContextPath + "/actuator/**" // Actuator 端点忽略 CSRF 105 adminSeverContextPath + "/actuator/**" // Actuator 端点忽略 CSRF
106 ) 106 )
107 - )// 修正后的 headers 配置（替换原来报错的代码） 107 + )
108 .headers(headers -> headers 108 .headers(headers -> headers
109 - // 关键修正：传入合法的基础 CSP 指令，而非空字符串 109 + // 特殊：Spring Boot Admin 前端基于 Vue，需 unsafe-inline ／ unsafe-eval 支持内联脚本与表达式
110 .contentSecurityPolicy(csp -> csp.policyDirectives( 110 .contentSecurityPolicy(csp -> csp.policyDirectives(
111 - "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-ancestors " + frameAncestors )  
112 - )  
113 - .frameOptions(frame -> frame.sameOrigin()) // 显式设置 X-Frame-Options 为 SAMEORIGIN  
114 - .cacheControl(cache -> cache.disable()) // 禁用缓存，避免旧配置生效 111 + "default-src 'self'; "
  112 + + "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
  113 + + "style-src 'self' 'unsafe-inline'; "
  114 + + "frame-ancestors " + frameAncestors))
  115 + .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin) // 显式设置 X-Frame-Options 为 SAMEORIGIN
  116 + .cacheControl(HeadersConfigurer.CacheControlConfig::disable) // 禁用缓存，避免旧配置生效
115 ); 117 );
116 return httpSecurity.build(); 118 return httpSecurity.build();
117 } 119 }