[AMQ-9477] Secure Jolokia/API by default

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 6.0.0, 6.0.1, 6.1.0, 6.1.1
• Fix Version/s: 6.2.0, 6.1.2
• Component/s: Broker
• Assignee: Jean-Baptiste Onofré
• Reporter: Jean-Baptiste Onofré
• Created: 10/Apr/24 20:13
• Updated: 10/Apr/24 20:20
• Resolved: 10/Apr/24 20:20

Description

The default security constraint defined in conf/jetty.xml secure the WebConsole.

However, it would make sense to secure all resources, including Jolokia and REST API.

The security constraint should be updated to:

<bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping">
  <property name="constraint" ref="securityConstraint" />
  <property name="pathSpec" value="/" />
</bean> 

Issue Links

• duplicates: AMQ-9476 Jetty config has invalid constraint mapping