Securing actuator endpoints in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the default behavior of Spring Boot actuator endpoints regarding security?

By default, how are Spring Boot actuator endpoints secured when no explicit security configuration is provided?

A Only the health and info endpoints are publicly accessible; others require authentication.

B All actuator endpoints are publicly accessible without authentication.

C All actuator endpoints require authentication and are secured by default.

D Actuator endpoints are disabled by default and must be enabled explicitly.

💡 Hint

Think about which endpoints provide non-sensitive information by default.

By default, Spring Boot actuator exposes only the health and info endpoints publicly. Other endpoints require authentication.

📝 Syntax

intermediate

Which configuration snippet correctly restricts actuator endpoints to users with role ADMIN?

Given a Spring Security configuration, which snippet correctly restricts access to all actuator endpoints to users with the role ADMIN?

A http.authorizeHttpRequests().requestMatchers("/actuator/**").permitAll().and().formLogin();

B http.authorizeHttpRequests().requestMatchers("/actuator/**").hasRole("ADMIN").and().httpBasic();

C http.authorizeHttpRequests().requestMatchers("/actuator/**").hasAuthority("ROLE_ADMIN").and().httpBasic();

D http.authorizeHttpRequests().requestMatchers("/actuator/**").authenticated().and().httpBasic();

💡 Hint

Remember the difference between hasRole and hasAuthority in Spring Security.

The hasRole("ADMIN") method automatically prefixes the role with ROLE_. Using hasAuthority("ROLE_ADMIN") is valid but less common. Option B uses the correct and common pattern.

🔧 Debug

advanced

Why does this actuator security configuration fail to restrict access?

Consider this Spring Security configuration snippet: http.authorizeHttpRequests() .requestMatchers("/actuator/**").authenticated() .and() .httpBasic(); Users without roles can access actuator endpoints without authentication. Why?

Spring Boot

http.authorizeHttpRequests()
  .requestMatchers("/actuator/**").authenticated()
  .and()
  .httpBasic();

A Because the security filter chain is not applied to actuator endpoints by default.

B Because the <code>authenticated()</code> method allows anonymous users by mistake.

C Because HTTP Basic authentication is not enabled properly.

D Because the order of matchers is incorrect and another rule permits access before this one.

💡 Hint

Think about how Spring Security processes multiple rules and their order.

Spring Security applies rules in order. If a more permissive rule matches before the restrictive one, the restrictive rule is ignored. The configuration likely has a rule permitting access before this one.

❓ state_output

advanced

What is the effect of setting management.endpoints.web.exposure.include=* in application.properties?

If you add the following line to your Spring Boot application's application.properties file: management.endpoints.web.exposure.include=* What is the effect on actuator endpoints?

A No actuator endpoints are exposed until explicitly enabled individually.

B Only health and info endpoints remain exposed; others stay hidden.

C All actuator endpoints become exposed over HTTP, including sensitive ones.

D Only custom actuator endpoints are exposed; built-in ones remain hidden.

💡 Hint

Consider what the wildcard * means in this context.

The wildcard * means all actuator endpoints are exposed over HTTP, including sensitive ones like shutdown or metrics.

🧠 Conceptual

expert

Which approach best secures actuator endpoints in a production Spring Boot application?

In a production environment, what is the best practice to secure Spring Boot actuator endpoints?

A Expose only necessary endpoints and restrict access using role-based authentication with HTTPS.

B Use default settings without changes, as Spring Boot secures endpoints automatically.

C Disable all actuator endpoints to avoid any security risks.

D Expose all actuator endpoints publicly and rely on network firewalls for protection.

💡 Hint

Think about balancing functionality and security in production.

Best practice is to expose only needed endpoints, secure them with role-based authentication, and use HTTPS to protect data in transit.