Actuator endpoint exposure

Spring Boot’s default is good, and saying so is the point of this page. From the Actuator reference:

Property	Default
management.endpoints.web.exposure.include	health
management.endpoints.jmx.exposure.include	health

For security purposes, only the /health endpoint is exposed over HTTP by default.

So “Actuator exposes everything” is folklore about Spring Boot 1.x. On any current version the finding is not a missing setting — it is a wildcard someone added, usually to make Prometheus, a Kubernetes probe, or an APM agent work, and usually without narrowing it afterwards.

the fix

management:
  endpoints:
    web:
      exposure:
        include: "health,info,prometheus"   # name them; never "*"
  endpoint:
    health:
      probes:
        enabled: true

verify it workedRun this in: http response

curl -s https://example.com/actuator | python3 -m json.tool | head -30

The discovery endpoint lists everything currently exposed. That list, from outside your network, is the real answer — not what the YAML says, because profiles and environment variables override files and a container image may carry different properties than the repo.

The wildcard is the whole finding

# The line to grep for.
management.endpoints.web.exposure.include: "*"

Boot’s documentation attaches an explicit warning to this property:

Before setting the management.endpoints.web.exposure.include, ensure that the exposed actuators do not contain sensitive information, are secured by placing them behind a firewall, or are secured by something like Spring Security.

* exposes /env, /configprops, /beans, /mappings, /threaddump, /heapdump, /loggers and more. Two of those deserve naming:

• /heapdump downloads the JVM heap. Every secret the process has loaded — database passwords, tokens, session contents — is in that file. It is not sanitized, because it cannot be.
• /loggers is writable. A POST changes log levels at runtime, which is a denial-of-service lever and a way to make an application log data it normally would not.

The exclude property takes precedence over include, so include: "*" with exclude: "env,heapdump" is a real pattern — but it is an allow-everything-then-subtract design, and the next endpoint Spring Boot adds is exposed by default. Prefer naming what you want.

before you ship this

Narrowing exposure breaks whatever was consuming the endpoints you removed — Prometheus scraping /actuator/prometheus, a liveness probe hitting a path you did not keep, an APM agent reading /metrics.

Find the consumers before you tighten, and add them by name. Kubernetes probes should use management.endpoint.health.probes.enabled and the /health/liveness and /health/readiness groups rather than a broad exposure.

Moving Actuator to its own port (management.server.port) is the stronger control if you can: it lets the network keep the endpoints unreachable regardless of what the exposure list says.

Related

• SecurityFilterChain — defining one stops Boot securing these for you
• Actuator sensitive values — what /env actually shows
• Actuator exposed to the internet — the threat page