What /env actually shows

“/actuator/env leaks your database password” is the usual claim, and on a current Spring Boot it is wrong by default. From the Actuator reference:

Information returned by the /env, /configprops and /quartz endpoints can be sensitive, so by default values are always fully sanitized (replaced by ******).

Likewise management.endpoint.health.show-details defaults to never.

So this is another verify page. Three things can turn the protection off, and they are what to look for.

1. show-values

# The line to grep for.
management:
  endpoint:
    env:
      show-values: always

show-values accepts never (default), always, or when-authorized. always shows real values to everyone who can reach the endpoint. If you need them, use when-authorized with a role:

the fix

management:
  endpoint:
    env:
      show-values: when-authorized
      roles: "admin"
    health:
      show-details: when-authorized
      roles: "admin"

Note the default authorization rule: “By default, any authenticated user is authorized.” Without a roles list, when-authorized means every logged-in user — which on a consumer-facing application is not the audience you meant.

And from the same docs: “For JMX endpoints, all users are always authorized.” Sanitization is an HTTP-layer concept; anyone reaching JMX gets the values.

2. A custom SanitizingFunction

Values are only shown unsanitized when no custom SanitizingFunction bean applies. The inverse is the risk: a project that added one to un-sanitize a specific key has narrowed the default protection, and that bean is easy to miss in review.

3. Endpoints that cannot be sanitized

Sanitization applies to /env, /configprops and /quartz. It does not and cannot apply to:

• /heapdump — a dump of the JVM heap. Every secret the process has loaded is in it, in memory form, regardless of any property setting.
• /threaddump — stack traces with arguments, which frequently include tokens.

No show-values setting protects these. The only control is not exposing them, which is exposure, or not letting anyone reach them.

verify it workedRun this in: http response

curl -s https://example.com/actuator/env | grep -c '\*\*\*\*\*\*'
curl -s https://example.com/actuator/env | grep -iE 'password|secret|token' | head -5

You want the first number high and the second to show only ****** values. Run it authenticated and unauthenticated — the difference between them is exactly what when-authorized is doing.

before you ship this

Turning show-values back to never breaks whatever was reading real values — usually a support runbook or an internal dashboard someone built. That workflow was reading production credentials over HTTP, so it needs replacing rather than restoring.

show-details: never on health makes the endpoint return {"status":"UP"} with no component breakdown, which some monitoring tools parse for detail. Use health groups to expose a detailed view on an internal path instead of loosening the public one.

Related

• Actuator exposure — the control that matters more than sanitization
• Actuator exposed to the internet — the threat page