fix: Protect Prometheus metrics endpoint with token authentication (#17114)

Co-authored-by: wangruidong <940853815@qq.com>

apps/jumpserver/api.py

@@ -1,6 +1,8 @@
+import secrets
 import time
 from collections import defaultdict
 
+from django.conf import settings
 from django.core.cache import cache
 from django.db.models import Count, Max, F, CharField
 from django.db.models.functions import Cast
@@ -539,6 +541,11 @@ class PrometheusMetricsApi(HealthApiMixin):
     permission_classes = (AllowAny,)
 
     def get(self, request, *args, **kwargs):
+        expected_token = str(settings.PROMETHEUS_METRICS_TOKEN or '')
+        token = request.query_params.get('token', '')
+        if not expected_token or not secrets.compare_digest(token, expected_token):
+            return HttpResponse(status=403)
+
         util = ComponentsPrometheusMetricsUtil()
         metrics_text = util.get_prometheus_metrics_text()
         return HttpResponse(metrics_text, content_type='text/plain; version=0.0.4; charset=utf-8')

apps/jumpserver/conf.py

@@ -596,6 +596,7 @@ class Config(dict):
 
         'FORGOT_PASSWORD_URL': '',
         'HEALTH_CHECK_TOKEN': '',
+        'PROMETHEUS_METRICS_TOKEN': '',
 
         # Applet 等软件的下载地址
         'APPLET_DOWNLOAD_HOST': '',

apps/jumpserver/settings/custom.py

@@ -158,6 +158,7 @@ FORGOT_PASSWORD_URL = CONFIG.FORGOT_PASSWORD_URL
 # 自定义默认组织名
 GLOBAL_ORG_DISPLAY_NAME = CONFIG.GLOBAL_ORG_DISPLAY_NAME
 HEALTH_CHECK_TOKEN = CONFIG.HEALTH_CHECK_TOKEN
+PROMETHEUS_METRICS_TOKEN = CONFIG.PROMETHEUS_METRICS_TOKEN
 
 TERMINAL_RDP_ADDR = CONFIG.TERMINAL_RDP_ADDR
 SECURITY_LUNA_REMEMBER_AUTH = CONFIG.SECURITY_LUNA_REMEMBER_AUTH