zqr10159 commented on PR #4277: URL: https://github.com/apache/hertzbeat/pull/4277#issuecomment-5127715107
Several compose/script Sureness files add `/actuator/**===get===[admin]` inside `excludedResource`. A resource listed there can bypass authentication before `resourceRole` is applied, so those distributions may remain exposed. Please move the rule into `resourceRole` consistently, assert that actuator paths are absent from every exclusion list, and add 401/403/admin-success tests across the packaged configurations. This PR also does not protect the collector management/Prometheus endpoint; that endpoint needs a separate bind/auth control. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
