Spring Boot Actuator: What to Expose, What to Hide, and What to Check Before Adding Endpoints

Short summary

Spring Boot Actuator endpoints expose operational data by default, but many developers blindly enable all endpoints without understanding the security implications. The article provides a practical matrix recommending which endpoints to expose vs. restrict, with specific risks like environment variable leakage or heap dumps. A key recommendation is separating the management port from the application port to make security structural.

• •Don't blindly expose all actuator endpoints—understand the security risks of /env, /heapdump, /shutdown, and others
• •Use a decision matrix: health/info safe to expose, but restrict env, configprops, heapdump to authorized access only
• •Separate management port (e.g., 8081) from app port to make security structural instead of code-dependent

Generated with AI, which can make mistakes.