Spring Boot Actuator in Production: The Endpoints I Left Open by Accident and How I Closed Them

Short summary

Spring Boot Actuator exposes sensitive endpoints by default in production, leaking environment variables, heap dumps, and bean structures to unauthenticated users. The common practice of using management.endpoints.web.exposure.include=* from tutorials is a security trap. Harden by explicitly whitelisting only health/info/metrics, disabling dangerous endpoints, and optionally running Actuator on a separate internal port.

• •Actuator /actuator index enumerates all endpoints, including ones not exposed via HTTP
• •Critical risk: /actuator/env leaks environment variables; /actuator/heapdump serves full JVM dumps
• •Fix: whitelist only necessary endpoints (health, info, metrics), disable dangerous ones, use separate management port

Generated with AI, which can make mistakes.