Securing actuator endpoints in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the default behavior of Spring Boot actuator endpoints regarding security?

By default, how are Spring Boot actuator endpoints secured when no explicit security configuration is provided?

A Only the health and info endpoints are publicly accessible; others require authentication.

B All actuator endpoints are publicly accessible without authentication.

C All actuator endpoints require authentication and are secured by default.

D Actuator endpoints are disabled by default and must be enabled explicitly.

💡 Hint

Think about which endpoints provide non-sensitive information by default.

By default, Spring Boot actuator exposes only the health and info endpoints publicly. Other endpoints require authentication.

📝 Syntax

intermediate

Which configuration snippet correctly restricts actuator endpoints to users with role ADMIN?

Given a Spring Security configuration, which snippet correctly restricts access to all actuator endpoints to users with the role ADMIN?

A http.authorizeHttpRequests().requestMatchers("/actuator/**").permitAll().and().formLogin();

B http.authorizeHttpRequests().requestMatchers("/actuator/**").hasRole("ADMIN").and().httpBasic();

C http.authorizeHttpRequests().requestMatchers("/actuator/**").hasAuthority("ROLE_ADMIN").and().httpBasic();

D http.authorizeHttpRequests().requestMatchers("/actuator/**").authenticated().and().httpBasic();

💡 Hint

Remember the difference between hasRole and hasAuthority in Spring Security.

The hasRole("ADMIN") method automatically prefixes the role with ROLE_. Using hasAuthority("ROLE_ADMIN") is valid but less common. Option B uses the correct and common pattern.

🔧 Debug

advanced

Why does this actuator security configuration fail to restrict access?

Consider this Spring Security configuration snippet: http.authorizeHttpRequests() .requestMatchers("/actuator/**").authenticated() .and() .httpBasic(); Users without roles can access actuator endpoints without authentication. Why?

Spring Boot

http.authorizeHttpRequests()
  .requestMatchers("/actuator/**").authenticated()
  .and()
  .httpBasic();

A Because the security filter chain is not applied to actuator endpoints by default.

B Because the <code>authenticated()</code> method allows anonymous users by mistake.

C Because HTTP Basic authentication is not enabled properly.

D Because the order of matchers is incorrect and another rule permits access before this one.

💡 Hint

Think about how Spring Security processes multiple rules and their order.

Spring Security applies rules in order. If a more permissive rule matches before the restrictive one, the restrictive rule is ignored. The configuration likely has a rule permitting access before this one.

❓ state_output

advanced

What is the effect of setting management.endpoints.web.exposure.include=* in application.properties?

If you add the following line to your Spring Boot application's application.properties file: management.endpoints.web.exposure.include=* What is the effect on actuator endpoints?

A No actuator endpoints are exposed until explicitly enabled individually.

B Only health and info endpoints remain exposed; others stay hidden.

C All actuator endpoints become exposed over HTTP, including sensitive ones.

D Only custom actuator endpoints are exposed; built-in ones remain hidden.

💡 Hint

Consider what the wildcard * means in this context.

The wildcard * means all actuator endpoints are exposed over HTTP, including sensitive ones like shutdown or metrics.

🧠 Conceptual

expert

Which approach best secures actuator endpoints in a production Spring Boot application?

In a production environment, what is the best practice to secure Spring Boot actuator endpoints?

A Expose only necessary endpoints and restrict access using role-based authentication with HTTPS.

B Use default settings without changes, as Spring Boot secures endpoints automatically.

C Disable all actuator endpoints to avoid any security risks.

D Expose all actuator endpoints publicly and rely on network firewalls for protection.

💡 Hint

Think about balancing functionality and security in production.

Best practice is to expose only needed endpoints, secure them with role-based authentication, and use HTTPS to protect data in transit.

Practice

1. What is the main purpose of securing Spring Boot actuator endpoints?

easy

A. To improve application performance by disabling endpoints

B. To automatically update actuator endpoints without manual configuration

C. To enable actuator endpoints for all users without restrictions

D. To protect sensitive application information from unauthorized access

Solution

1. Step 1: Understand actuator endpoints role

   Actuator endpoints provide information about the app's health, metrics, and configuration.

2. Step 2: Recognize security importance

   Since these endpoints expose sensitive data, securing them prevents unauthorized users from accessing this info.

3. Final Answer:

   To protect sensitive application information from unauthorized access -> Option D

4. Quick Check:

   Actuator security = protect info [OK]

Hint: Actuator endpoints show app info; protect them from strangers [OK]

Common Mistakes:

• Thinking actuator endpoints improve performance
• Assuming all endpoints should be open
• Believing security auto-applies without config

2. Which property correctly exposes only the health and info actuator endpoints in application.properties?

easy

A. management.endpoints.web.expose=health,info

B. management.endpoints.web.exposure.include=health,info

C. management.endpoints.exposure.include=health,info

D. management.web.endpoints.include=health,info

Solution

1. Step 1: Identify correct property name

   The correct property to expose endpoints is management.endpoints.web.exposure.include.

2. Step 2: Verify property value format

   Comma-separated list of endpoints like health,info is correct.

3. Final Answer:

   management.endpoints.web.exposure.include=health,info -> Option B

4. Quick Check:

   Correct property = management.endpoints.web.exposure.include [OK]

Hint: Use 'management.endpoints.web.exposure.include' to list endpoints [OK]

Common Mistakes:

• Using 'expose' instead of 'exposure.include'
• Missing 'web' in the property path
• Incorrect property structure or spelling

3. Given this Spring Security config snippet, what is the effect on actuator endpoints?

http
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/actuator/**").hasRole("ADMIN")
    .anyRequest().authenticated()
  )

medium

A. Only users with ADMIN role can access any actuator endpoint

B. All users can access actuator endpoints without login

C. Actuator endpoints are disabled

D. Only unauthenticated users can access actuator endpoints

Solution

1. Step 1: Analyze requestMatchers rule

   The matcher "/actuator/**" requires users to have role ADMIN to access.

2. Step 2: Understand anyRequest rule

   All other requests require authentication but no specific role.

3. Final Answer:

   Only users with ADMIN role can access any actuator endpoint -> Option A

4. Quick Check:

   Actuator access = ADMIN role required [OK]

Hint: Check role in requestMatchers for actuator URLs [OK]

Common Mistakes:

• Assuming actuator is open to all
• Confusing authentication with authorization
• Ignoring the role requirement

4. What is wrong with this security configuration for actuator endpoints?

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
  http
    .authorizeHttpRequests(auth -> auth
      .requestMatchers("/actuator/**").authenticated()
      .anyRequest().permitAll()
    );
  return http.build();
}

medium

A. The requestMatchers pattern is incorrect syntax

B. The method should return void, not SecurityFilterChain

C. Actuator endpoints require login but other URLs are open, risking security

D. The configuration disables all security

Solution

1. Step 1: Review authorization rules order

   Actuator endpoints require authentication, but all other requests are permitted without login.

2. Step 2: Identify security risk

   This means non-actuator URLs are open, which might expose sensitive parts unintentionally.

3. Final Answer:

   Actuator endpoints require login but other URLs are open, risking security -> Option C

4. Quick Check:

   PermitAll on anyRequest risks open access [OK]

Hint: Check if anyRequest().permitAll() opens unwanted URLs [OK]

Common Mistakes:

• Thinking method return type is wrong
• Assuming requestMatchers syntax is invalid
• Believing security is fully disabled

5. You want to expose only the health endpoint publicly and secure all other actuator endpoints to ADMIN role. Which configuration achieves this correctly?

hard

A. Expose health only and configure security to permit all on /actuator/health and ADMIN role on /actuator/** except health

B. Expose all endpoints and secure only /actuator/health to ADMIN role

C. Expose health and info endpoints and allow anonymous access to all actuator URLs

D. Expose no endpoints and disable security for actuator URLs

Solution

1. Step 1: Set exposure property

   Use management.endpoints.web.exposure.include=health to expose only health publicly.

2. Step 2: Configure security rules

   Permit all access to /actuator/health and require ADMIN role for other actuator endpoints using requestMatchers.

3. Final Answer:

   Expose health only and configure security to permit all on /actuator/health and ADMIN role on /actuator/** except health -> Option A

4. Quick Check:

   Expose health public + secure others ADMIN [OK]

Hint: Expose health only, secure others with ADMIN role [OK]

Common Mistakes:

• Exposing too many endpoints publicly
• Not securing non-health actuator endpoints
• Allowing anonymous access to sensitive endpoints