Spring及Spring Boot仪表盘过滤器能否使用AND/OR条件表达式？

Hey there! Let's tackle your two questions about Spring Boot Actuator filters with AND/OR logic one by one:

If you're building custom filters for Actuator endpoints, implementing AND/OR logic is straightforward—you just need to combine conditions in your filter's core logic. Here are practical, actionable examples:

AND Condition Example #

Suppose you want to restrict access to Actuator endpoints only to requests coming from a specific IP AND with a valid auth token:

@Component
public class ActuatorAuthFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        String clientIp = request.getRemoteAddr();
        String authToken = request.getHeader("X-Auth-Token");
        
        // AND logic: both conditions must be satisfied to allow access
        if ("192.168.1.100".equals(clientIp) && "secure-token-456".equals(authToken)) {
            filterChain.doFilter(request, response);
        } else {
            response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access restricted to authorized clients only");
        }
    }

    @Override
    protected boolean shouldNotFilter(HttpServletRequest request) throws ServletException {
        // Apply filter only to Actuator endpoints
        return !request.getRequestURI().startsWith("/actuator/");
    }
}

OR Condition Example #

If you want to allow access from either a trusted IP OR a request with a valid token:

// Inside the doFilterInternal method
if ("192.168.1.100".equals(clientIp) || "secure-token-456".equals(authToken)) {
    filterChain.doFilter(request, response);
} else {
    response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access denied");
}

Mixed AND/OR Logic #

For more complex scenarios (e.g., (Trusted IP A OR Trusted IP B) AND valid token):

boolean isTrustedIp = "192.168.1.100".equals(clientIp) || "192.168.1.101".equals(clientIp);
boolean isValidToken = "secure-token-456".equals(authToken);

if (isTrustedIp && isValidToken) {
    filterChain.doFilter(request, response);
} else {
    response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access restricted");
}

Absolutely! If you're using Spring Security to secure Actuator endpoints, you can leverage Spring Expression Language (SpEL) to write concise, readable AND/OR expressions directly in your config or code. Here's how:

Using Properties File #

Define authorization rules with SpEL expressions in application.properties or application.yml:

# Use parentheses to control expression priority
spring.security.authorization.manager.rule./actuator/**=(hasIpAddress('192.168.1.100') or hasIpAddress('192.168.1.101')) and hasAuthority('ACTUATOR_ADMIN')

This rule means: allow access only if the request comes from either of the two IPs AND the authenticated user has the ACTUATOR_ADMIN authority.

Using Java Configuration #

If you prefer code-based config, embed SpEL expressions directly in your SecurityFilterChain:

@Configuration
public class ActuatorSecurityConfig {
    @Bean
    public SecurityFilterChain actuatorSecurityFilterChain(HttpSecurity http) throws Exception {
        http.securityMatcher("/actuator/**")
            .authorizeHttpRequests(auth -> auth
                .anyRequest().access("(hasIpAddress('192.168.1.100') or hasIpAddress('192.168.1.101')) and hasAuthority('ACTUATOR_ADMIN')")
            );
        return http.build();
    }
}

Dynamic Expression Parsing #

For even more flexibility (like loading expressions from a database or external config), use SpEL's ExpressionParser to evaluate custom AND/OR expressions at runtime:

// Inside your custom filter
ExpressionParser parser = new SpelExpressionParser();
// Define your AND/OR expression as a string
String accessRule = "(ip == '192.168.1.100' or ip == '192.168.1.101') and token == 'secure-token-456'";

// Create a context with request data
Map<String, Object> context = new HashMap<>();
context.put("ip", request.getRemoteAddr());
context.put("token", request.getHeader("X-Auth-Token"));

// Evaluate the expression
boolean isAllowed = (boolean) parser.parseExpression(accessRule).getValue(context);

if (isAllowed) {
    filterChain.doFilter(request, response);
} else {
    response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access denied");
}

内容的提问来源于stack exchange，提问作者Dhruv