Securing actuator endpoints in Spring Boot - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of securing actuator endpoints in Spring Boot?

Securing actuator endpoints protects sensitive application information and controls from unauthorized access, ensuring only trusted users can view or manage the app's health, metrics, and configurations.

intermediate

Which Spring Boot property enables security for actuator endpoints?

The property management.endpoints.web.exposure.include controls which endpoints are exposed, and management.endpoint.<endpoint>.enabled controls if an endpoint is active. Security is often configured with Spring Security to restrict access.

intermediate

How do you restrict actuator endpoints to authenticated users only?

Add Spring Security and configure HTTP security to require authentication for actuator endpoints, for example by matching /actuator/** and requiring login or specific roles.

beginner

What is the default exposure level of actuator endpoints in Spring Boot?

By default, only the health and info endpoints are exposed over HTTP. Other endpoints are not exposed unless explicitly configured.

beginner

Why should sensitive actuator endpoints like 'shutdown' be secured or disabled?

Endpoints like 'shutdown' can stop the application remotely. If left unsecured, attackers could disrupt service. Securing or disabling them prevents unauthorized control.

Which Spring Boot property controls which actuator endpoints are exposed over HTTP?

A spring.security.user.name

B management.endpoints.web.exposure.include

C server.port

D management.endpoint.enabled

The property management.endpoints.web.exposure.include defines which actuator endpoints are exposed over HTTP.

What is the best way to secure actuator endpoints in a Spring Boot app?

A Use Spring Security to require authentication for actuator URLs

B Disable all actuator endpoints

C Expose all endpoints publicly

D Change server port

Using Spring Security to require authentication ensures only authorized users can access actuator endpoints.

By default, which actuator endpoints are exposed over HTTP?

A health and info

B shutdown and metrics

C all endpoints

D none

Spring Boot exposes only the health and info endpoints by default.

What could happen if the 'shutdown' actuator endpoint is left unsecured?

A It will expose user data

B Nothing, it is safe by default

C Attackers could stop the application remotely

D It will slow down the app

An unsecured shutdown endpoint allows attackers to stop the app, causing downtime.

How can you disable a specific actuator endpoint like 'shutdown'?

A Remove Spring Security

B Delete the actuator dependency

C Set server.port=0

D Set management.endpoint.shutdown.enabled=false

Setting management.endpoint.shutdown.enabled=false disables the shutdown endpoint.

Explain how to secure actuator endpoints in a Spring Boot application.

Think about controlling who can see and use the actuator URLs.

Why is it important to limit access to actuator endpoints?

Consider what could happen if anyone could access these endpoints.