Spring Security with Spring Boot Actuator: the authorization model that survived the incident

Short summary

This post details how implicit Spring Security configuration led to a real production incident exposing Actuator endpoints without authentication. The fix: create explicit, ordered SecurityFilterChain beans for Actuator and the main application with granular role-based endpoint access control. This approach makes security intent readable in code and breaks loudly during dependency upgrades instead of silently.

• •Implicit Spring Boot security defaults hide dangerous Actuator misconfigurations like unauthenticated /env endpoint access
• •Solution: separate SecurityFilterChain beans with @Order annotation and explicit ACTUATOR_ADMIN role requirements
• •This approach makes security contracts version-safe and causes breaks to fail loudly rather than silently

Generated with AI, which can make mistakes.