Actuator endpoint exposure

Spring Boot’s default is good, and saying so is the point of this page. From the Actuator reference:

Property	Default
management.endpoints.web.exposure.include	health
management.endpoints.jmx.exposure.include	health

For security purposes, only the /health endpoint is exposed over HTTP by default.

So “Actuator exposes everything” is folklore about Spring Boot 1.x. On any current version the finding is not a missing setting — it is a wildcard someone added, usually to make Prometheus, a Kubernetes probe, or an APM agent work, and usually without narrowing it afterwards.

the fix

management:
  endpoints:
    web:
      exposure:
        include: "health,info,prometheus"   # name them; never "*"
  endpoint:
    health:
      probes:
        enabled: true

verify it workedRun this in: http response

curl -s https://example.com/actuator | python3 -m json.tool | head -30

The discovery endpoint lists everything currently exposed. That list, from outside your network, is the real answer — not what the YAML says, because profiles and environment variables override files and a container image may carry different properties than the repo.

settings on this page

management.endpoints.web.exposure.includeproperty

Which Actuator endpoints are reachable over HTTP. Only health by default, so 'Actuator leaks everything' describes Boot 1.x rather than anything current. The finding is always a wildcard someone added for monitoring.

accepts

health | <endpoint ids> | "*"

default

[health]

set in

application.properties

Read in: Spring Boot 4.1.0 application-properties appendix

management.endpoints.web.exposure.excludeproperty

Takes precedence over include, so a wildcard include plus an exclude list is allow-then-subtract — which means the next endpoint Boot adds is exposed by default. Prefer naming what you want.

accepts

<endpoint ids> | "*"

set in

application.properties

Read in: Spring Boot 4.1.0 application-properties appendix

management.endpoints.web.base-pathproperty

Where the endpoints mount. Relative to the servlet context path when the management server shares the main port, and to management.server.base-path when a separate management.server.port is configured.

accepts

<path>

default

/actuator

set in

application.properties

Read in: Spring Boot 4.1.0 application-properties appendix

if you see this

Exposing 14 endpoints beneath base path '/actuator'

Logged at INFO on startup, and the fastest audit available: the count is what the running application actually publishes, not what the configuration appears to say. A number well above the default is the signal to go read the exposure include list.

Read in: spring-boot module/spring-boot-actuator/.../endpoint/web/EndpointLinksResolver.java

The wildcard is the whole finding

# The line to grep for.
management.endpoints.web.exposure.include: "*"

Boot’s documentation attaches an explicit warning to this property:

Before setting the management.endpoints.web.exposure.include, ensure that the exposed actuators do not contain sensitive information, are secured by placing them behind a firewall, or are secured by something like Spring Security.

* exposes /env, /configprops, /beans, /mappings, /threaddump, /heapdump, /loggers and more. Two of those deserve naming:

• /heapdump downloads the JVM heap. Every secret the process has loaded — database passwords, tokens, session contents — is in that file. It is not sanitized, because it cannot be.
• /loggers is writable. A POST changes log levels at runtime, which is a denial-of-service lever and a way to make an application log data it normally would not.

The exclude property takes precedence over include, so include: "*" with exclude: "env,heapdump" is a real pattern — but it is an allow-everything-then-subtract design, and the next endpoint Spring Boot adds is exposed by default. Prefer naming what you want.

before you ship this

Narrowing exposure breaks whatever was consuming the endpoints you removed — Prometheus scraping /actuator/prometheus, a liveness probe hitting a path you did not keep, an APM agent reading /metrics.

Find the consumers before you tighten, and add them by name. Kubernetes probes should use management.endpoint.health.probes.enabled and the /health/liveness and /health/readiness groups rather than a broad exposure.

Moving Actuator to its own port (management.server.port) is the stronger control if you can: it lets the network keep the endpoints unreachable regardless of what the exposure list says.

Related

• SecurityFilterChain — defining one stops Boot securing these for you
• Actuator sensitive values — what /env actually shows
• Actuator exposed to the internet — the threat page