Hands-On Reactive Programming in Spring 5

Securing actuator endpoints

In the previous sections, we covered the essentials of a Spring Boot actuator and implemented our custom reactive actuator endpoint. Notice that, when exposing useful information, a Spring Boot actuator may also disclose sensitive information. Access to environment variables, a structure of the application, configuration properties, ability to do heap and thread dumps, and other factors might simplify the lives of bad guys who are trying to hack our application. In these cases, a Spring Boot actuator may also expose private users' data. Therefore, we have to care about secured access for all actuator endpoints as well as the usual REST endpoints.

Due to the fact that a Spring Boot actuator shares a security model ...