Add security to Cloud Foundry actuator endpoints. Security is enforced
by a `HanderInterceptor` on `CloudFoundryEndpointHandlerMapping`. Each
endpoint call expects an 'Authorization' header containing a bearer
token. The token signature is checked against the UAA public keys then
passed to the Cloud Controller to obtain an ultimate access level.
The client may either have 'RESTRICTED' or FULL' access, with the latter
only providing access to a limited set of endpoints.
See gh-7108
Update `ManagementServerProperties` so that `security.sessions` no
longer uses `SessionCreationPolicy` from Spring Security. We now
use our own enun which allows `management.security.*` properties to
be set without the risk of a `ClassNotFoundException`.
Fixes gh-3888
Previously, if an exception was thrown during request handling after
the response had been committed, i.e. after the status and headers
had been written, the metrics filter would assume that it was a 500
response. This was potentially inaccurate as the status had already
been sent to the client and before the exception was thrown and it
may have been something other than a 500.
This commit updates MetricsFilter so that it will use the
status from the response if the response has been committed even when
an exception is thrown.
Closes gh-7277
If the resource chain is used, such as by using the
`"spring.resources.chain.strategy.content.enabled"` property,
resource chain caching can prevent the developer from seeing
changes made to resources, so that caching should be disabled
when DevTools is enabled.
This commit sets the `"spring.resources.chain.cache"` property
to `true` when devtools is enabled.
Madhura Bhave
Phillip Webb
Andy Wilkinson
Stephane Nicoll
Brian Clozel
Craig Andrews