Springboot 3.0 integrated nacos2.2.1 content can be Q in the comment area
Build environment:
-
Java version: 11.0.18
-
System: windows7
-
Database: mysql8.0.29
The first step is to download nacos, download address:
https://github.com/alibaba/nacos/releases/download/2.2.1/nacos-server-2.2.1.zip
The second step is to download and extract it to a directory of your own, as shown below:
The third step is to find the directory conf directory, create a database in mysql and execute the table creation statement:
The fourth step is to find the "startup.cmd" file in the bin directory and edit it.
Step 5: Find the "application.properties" file in the conf directory and edit it:
The first modification point:
The second one is to find the configuration "nacos.core.auth.plugin.nacos.token.secret.key",
Add nacos.core.auth.plugin.nacos.token.secret.key value
nacos.core.auth.plugin.nacos.token.secret.key=SecretKey012345678901234567890123456789012345678901234567890123456789
NVDB-CNVDB-2023674205 vulnerability: Nacos is a service management platform for building cloud native applications. The key is not modified under the default configuration, allowing attackers to bypass key authentication and enter the background, resulting in system control and other consequences. .
The specific manifestation is that the configuration items in the application.properties file have default values, but most users do not modify them. nacos.core.auth.default.token.secret.key=SecretKey012345678901234567890123456789012345678901234567890123456789
In the new version, nacos.core.auth.default.token.secret.key is deprecated and replaced by nacos.core.auth.plugin.nacos.token.secret.key, which has no default value. If you start it directly, the following error will be reported (the error message is mixed with numerous error messages, which is not obvious)
When customizing the key, it is recommended to set the configuration item to a Base64-encoded string, and the original key length must not be less than 32 characters.
Keys can be generated at the following address. Base64 online encoding and decoding | Base64 encryption and decryption - Base64.us
Then find the bin directory and execute "startup.cmd"
Finally, after starting up, the browser accesses http://localhost:8848/nacos
Account password: nacos/nacos
Start successfully