disable tunnel detail-pages by default. #2232

site/docs/doc/tunnel.md

@@ -105,6 +105,10 @@ Tunnel server 会以`_`做分隔符，提取出`appName`，方便按应用进行
 
 ### Tunnel Server 的管理页面
 
+> 需要在spring boot的`application.properties`里配置 `arthas.enable-detail-pages=true`
+
+> **注意，开放管理页面有风险！管理页面没有安全拦截功能，务必自行增加安全措施。**
+
 在本地启动 tunnel-server，然后使用`as.sh` attach，并且指定应用名`--app-name test`：
 
 ```
@@ -141,9 +145,14 @@ id         test_PE3LZO9NA9ENJYTPGL9L
 
 ![](/images/tunnel-server-agents.png)
 
-### 权限管理
+### 安全和权限管理
 
-目前 tunnel server 没有专门的权限管理，用户需要自行开发，对 app name 鉴权。
+**强烈建议不要把tunnel server直接暴露到公网上。**
+
+目前 tunnel server 没有专门的权限管理
+
+1. 用户需要自行开发，对 app name 鉴权.
+2. 如果开放管理页面，需要增加安全措施。
 
 ### 集群方式管理
 

site/docs/en/doc/tunnel.md

@@ -100,6 +100,10 @@ Alternatively, you can configure `appName` in `arthas.properties` in the unzippe
 :::
 
 ### Tunnel Server Management Page
+> Need to configure `arthas.enable-detail-pages=true` in `application.properties` of spring boot
+
+> **Attention, opening admin pages is risky! There is no security blocking function on the management page, you must add security measures by yourself.**
+
 
 Start the tunnel-server locally, then use `as.sh` attach, and specify the application name `--app-name test`:
 
@@ -137,9 +141,14 @@ Then open the details, you can see a list of all connected agents:
 
 ![](/images/tunnel-server-agents.png)
 
-### Authority Management
+### Security and Privilege Management
 
-At present, the tunnel server does not have special authority management. Users need to develop their own and authenticate the app name.
+**It is strongly recommended not to expose the tunnel server directly to the public network.**
+
+Currently tunnel server does not have special permission management
+
+1. Users need to develop by themselves and authenticate the app name.
+2. If the management page is opened, security measures need to be added.
 
 ### Cluster Management
 

tunnel-server/src/main/resources/application.properties

@@ -9,8 +9,9 @@ management.endpoints.web.exposure.include=*
 # default user name
 spring.security.user.name=arthas
 
+# If set to true, be sure to do security protection to ensure that the server will not be illegally accessed
+arthas.enable-detail-pages=false
 
-arthas.enable-detail-pages=true
 spring.cache.type=caffeine
 spring.cache.cache-names=inMemoryClusterCache
 spring.cache.caffeine.spec=maximumSize=3000,expireAfterAccess=3600s