Securing actuator endpoints in Spring Boot - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable actuator endpoints in Spring Boot.

Spring Boot

@SpringBootApplication
public class Application {
    public static void main(String[] args) {
        SpringApplication.[1](Application.class, args);
    }
}

Drag options to blanks, or click blank then click option'

Arun

Blaunch

Cstart

Dexecute

Attempts:

3 left

💡 Hint

Common Mistakes

Using a method name other than 'run' to start the application.

The SpringApplication.run() method starts the Spring Boot application and enables actuator endpoints if configured.

2fill in blank

medium

Complete the code to expose all actuator endpoints in application.properties.

Spring Boot

management.endpoints.web.exposure.include=[1]

Drag options to blanks, or click blank then click option'

Ametrics

Bhealth

Cinfo

D*

Attempts:

3 left

💡 Hint

Common Mistakes

Specifying only one endpoint name instead of all.

Using * exposes all actuator endpoints.

3fill in blank

hard

Fix the error in the security configuration to require authentication for actuator endpoints.

Spring Boot

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
            .requestMatchers(EndpointRequest.toAnyEndpoint()).[1]()
            .anyRequest().authenticated()
            .and()
            .httpBasic();
    }
}

Drag options to blanks, or click blank then click option'

ApermitAll

Bauthenticated

CdenyAll

Danonymous

Attempts:

3 left

💡 Hint

Common Mistakes

Using permitAll() which allows open access.

Using denyAll() which blocks all access.

The authenticated() method requires users to be logged in to access actuator endpoints.

4fill in blank

hard

Fill both blanks to configure HTTP Basic authentication and disable CSRF for actuator endpoints.

Spring Boot

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .csrf().[1]()
        .and()
        .authorizeRequests()
        .requestMatchers(EndpointRequest.toAnyEndpoint()).authenticated()
        .and()
        .[2]();
}

Drag options to blanks, or click blank then click option'

Adisable

Benable

ChttpBasic

DformLogin

Attempts:

3 left

💡 Hint

Common Mistakes

Enabling CSRF which can block actuator POST requests.

Using formLogin() instead of httpBasic() for actuator security.

CSRF protection is disabled for actuator endpoints using csrf().disable(). HTTP Basic authentication is enabled with httpBasic().

5fill in blank

hard

Fill all three blanks to create a user with username 'admin', password 'secret', and role 'ACTUATOR' in memory.

Spring Boot

@Bean
public UserDetailsService users() {
    UserDetails user = User.withDefaultPasswordEncoder()
        .username("[1]")
        .password("[2]")
        .roles("[3]")
        .build();
    return new InMemoryUserDetailsManager(user);
}

Drag options to blanks, or click blank then click option'

Aadmin

Bsecret

CACTUATOR

Duser

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect username or password strings.

Using a role other than 'ACTUATOR' which may not match security rules.

This code creates an in-memory user with username 'admin', password 'secret', and role 'ACTUATOR' to secure actuator endpoints.