Securing actuator endpoints in Spring Boot - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable actuator endpoints in Spring Boot.

Spring Boot

@SpringBootApplication
public class Application {
    public static void main(String[] args) {
        SpringApplication.[1](Application.class, args);
    }
}

Drag options to blanks, or click blank then click option'

Arun

Blaunch

Cstart

Dexecute

Attempts:

3 left

💡 Hint

Common Mistakes

Using a method name other than 'run' to start the application.

The SpringApplication.run() method starts the Spring Boot application and enables actuator endpoints if configured.

2fill in blank

medium

Complete the code to expose all actuator endpoints in application.properties.

Spring Boot

management.endpoints.web.exposure.include=[1]

Drag options to blanks, or click blank then click option'

Ametrics

Bhealth

Cinfo

D*

Attempts:

3 left

💡 Hint

Common Mistakes

Specifying only one endpoint name instead of all.

Using * exposes all actuator endpoints.

3fill in blank

hard

Fix the error in the security configuration to require authentication for actuator endpoints.

Spring Boot

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
            .requestMatchers(EndpointRequest.toAnyEndpoint()).[1]()
            .anyRequest().authenticated()
            .and()
            .httpBasic();
    }
}

Drag options to blanks, or click blank then click option'

ApermitAll

Bauthenticated

CdenyAll

Danonymous

Attempts:

3 left

💡 Hint

Common Mistakes

Using permitAll() which allows open access.

Using denyAll() which blocks all access.

The authenticated() method requires users to be logged in to access actuator endpoints.

4fill in blank

hard

Fill both blanks to configure HTTP Basic authentication and disable CSRF for actuator endpoints.

Spring Boot

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .csrf().[1]()
        .and()
        .authorizeRequests()
        .requestMatchers(EndpointRequest.toAnyEndpoint()).authenticated()
        .and()
        .[2]();
}

Drag options to blanks, or click blank then click option'

Adisable

Benable

ChttpBasic

DformLogin

Attempts:

3 left

💡 Hint

Common Mistakes

Enabling CSRF which can block actuator POST requests.

Using formLogin() instead of httpBasic() for actuator security.

CSRF protection is disabled for actuator endpoints using csrf().disable(). HTTP Basic authentication is enabled with httpBasic().

5fill in blank

hard

Fill all three blanks to create a user with username 'admin', password 'secret', and role 'ACTUATOR' in memory.

Spring Boot

@Bean
public UserDetailsService users() {
    UserDetails user = User.withDefaultPasswordEncoder()
        .username("[1]")
        .password("[2]")
        .roles("[3]")
        .build();
    return new InMemoryUserDetailsManager(user);
}

Drag options to blanks, or click blank then click option'

Aadmin

Bsecret

CACTUATOR

Duser

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect username or password strings.

Using a role other than 'ACTUATOR' which may not match security rules.

This code creates an in-memory user with username 'admin', password 'secret', and role 'ACTUATOR' to secure actuator endpoints.

Practice

1. What is the main purpose of securing Spring Boot actuator endpoints?

easy

A. To improve application performance by disabling endpoints

B. To automatically update actuator endpoints without manual configuration

C. To enable actuator endpoints for all users without restrictions

D. To protect sensitive application information from unauthorized access

Solution

1. Step 1: Understand actuator endpoints role

   Actuator endpoints provide information about the app's health, metrics, and configuration.

2. Step 2: Recognize security importance

   Since these endpoints expose sensitive data, securing them prevents unauthorized users from accessing this info.

3. Final Answer:

   To protect sensitive application information from unauthorized access -> Option D

4. Quick Check:

   Actuator security = protect info [OK]

Hint: Actuator endpoints show app info; protect them from strangers [OK]

Common Mistakes:

• Thinking actuator endpoints improve performance
• Assuming all endpoints should be open
• Believing security auto-applies without config

2. Which property correctly exposes only the health and info actuator endpoints in application.properties?

easy

A. management.endpoints.web.expose=health,info

B. management.endpoints.web.exposure.include=health,info

C. management.endpoints.exposure.include=health,info

D. management.web.endpoints.include=health,info

Solution

1. Step 1: Identify correct property name

   The correct property to expose endpoints is management.endpoints.web.exposure.include.

2. Step 2: Verify property value format

   Comma-separated list of endpoints like health,info is correct.

3. Final Answer:

   management.endpoints.web.exposure.include=health,info -> Option B

4. Quick Check:

   Correct property = management.endpoints.web.exposure.include [OK]

Hint: Use 'management.endpoints.web.exposure.include' to list endpoints [OK]

Common Mistakes:

• Using 'expose' instead of 'exposure.include'
• Missing 'web' in the property path
• Incorrect property structure or spelling

3. Given this Spring Security config snippet, what is the effect on actuator endpoints?

http
  .authorizeHttpRequests(auth -> auth
    .requestMatchers("/actuator/**").hasRole("ADMIN")
    .anyRequest().authenticated()
  )

medium

A. Only users with ADMIN role can access any actuator endpoint

B. All users can access actuator endpoints without login

C. Actuator endpoints are disabled

D. Only unauthenticated users can access actuator endpoints

Solution

1. Step 1: Analyze requestMatchers rule

   The matcher "/actuator/**" requires users to have role ADMIN to access.

2. Step 2: Understand anyRequest rule

   All other requests require authentication but no specific role.

3. Final Answer:

   Only users with ADMIN role can access any actuator endpoint -> Option A

4. Quick Check:

   Actuator access = ADMIN role required [OK]

Hint: Check role in requestMatchers for actuator URLs [OK]

Common Mistakes:

• Assuming actuator is open to all
• Confusing authentication with authorization
• Ignoring the role requirement

4. What is wrong with this security configuration for actuator endpoints?

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
  http
    .authorizeHttpRequests(auth -> auth
      .requestMatchers("/actuator/**").authenticated()
      .anyRequest().permitAll()
    );
  return http.build();
}

medium

A. The requestMatchers pattern is incorrect syntax

B. The method should return void, not SecurityFilterChain

C. Actuator endpoints require login but other URLs are open, risking security

D. The configuration disables all security

Solution

1. Step 1: Review authorization rules order

   Actuator endpoints require authentication, but all other requests are permitted without login.

2. Step 2: Identify security risk

   This means non-actuator URLs are open, which might expose sensitive parts unintentionally.

3. Final Answer:

   Actuator endpoints require login but other URLs are open, risking security -> Option C

4. Quick Check:

   PermitAll on anyRequest risks open access [OK]

Hint: Check if anyRequest().permitAll() opens unwanted URLs [OK]

Common Mistakes:

• Thinking method return type is wrong
• Assuming requestMatchers syntax is invalid
• Believing security is fully disabled

5. You want to expose only the health endpoint publicly and secure all other actuator endpoints to ADMIN role. Which configuration achieves this correctly?

hard

A. Expose health only and configure security to permit all on /actuator/health and ADMIN role on /actuator/** except health

B. Expose all endpoints and secure only /actuator/health to ADMIN role

C. Expose health and info endpoints and allow anonymous access to all actuator URLs

D. Expose no endpoints and disable security for actuator URLs

Solution

1. Step 1: Set exposure property

   Use management.endpoints.web.exposure.include=health to expose only health publicly.

2. Step 2: Configure security rules

   Permit all access to /actuator/health and require ADMIN role for other actuator endpoints using requestMatchers.

3. Final Answer:

   Expose health only and configure security to permit all on /actuator/health and ADMIN role on /actuator/** except health -> Option A

4. Quick Check:

   Expose health public + secure others ADMIN [OK]

Hint: Expose health only, secure others with ADMIN role [OK]

Common Mistakes:

• Exposing too many endpoints publicly
• Not securing non-health actuator endpoints
• Allowing anonymous access to sensitive endpoints