Update AuthConfig.groovy

autopilot/canaries/{id} requests will be bypassed
spinnaker · Nov 6, 2020 · b0753d9 · b0753d9
1 parent d701fc2
commit b0753d9
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/gate-core/src/main/groovy/com/netflix/spinnaker/gate/config/AuthConfig.groovy b/gate-core/src/main/groovy/com/netflix/spinnaker/gate/config/AuthConfig.groovy
@@ -91,7 +91,7 @@ class AuthConfig {
         .antMatchers(PermissionRevokingLogoutSuccessHandler.LOGGED_OUT_URL).permitAll()
         .antMatchers('/auth/user').permitAll()
         .antMatchers(HttpMethod.POST,'/autopilot/registerCanary').permitAll()
-        .antMatchers(HttpMethod.GET,'/autopilot/canaries/**').permitAll()
+        .antMatchers(HttpMethod.GET,'/autopilot/canaries/{id}').permitAll()
         .antMatchers(HttpMethod.GET,'/autopilot/mgmt/**').permitAll()
         .antMatchers('/plugins/deck/**').permitAll()
         .antMatchers(HttpMethod.POST, '/webhooks/**').permitAll()
@@ -129,6 +129,7 @@ class AuthConfig {
       .authorizeRequests()
       .antMatchers("/auth/login").permitAll()
       .antMatchers(HttpMethod.POST,'/autopilot/registerCanary').permitAll()
+      .antMatchers(HttpMethod.GET,'/autopilot/canaries/{id}').permitAll()
       .antMatchers(HttpMethod.GET,'/autopilot/mgmt/**').permitAll()
       .antMatchers('/**/favicon.ico').permitAll()
       .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()