asmhatre/spring-boot-demo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Spring Boot 4 Actuator in production: endpoints, security, custom health indicators

Browse Source 
Companion repository for the ankurm.com article. Every transcript in docs/output/
was produced by running this project; scripts/run-all.sh regenerates all of them.

Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 /
Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.
This commit is contained in:
Ankur Mhatre
2026-09-04 10:40:04 +05:30
commit 4b6cefa60a
64 changed files with 3195 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
docs/output/00-versions.txt Normal file
View File

@@ -0,0 +1,23 @@
$ java -version
openjdk version "25.0.4.1" 2026-08-18 LTS
OpenJDK Runtime Environment Temurin-25.0.4.1+1 (build 25.0.4.1+1-LTS)
OpenJDK 64-Bit Server VM Temurin-25.0.4.1+1 (build 25.0.4.1+1-LTS, mixed mode, sharing)
$ mvn -v | head -3
Apache Maven 3.9.11 (3e54c93a704957b63ee3494413a2b544fd3d825b)
Maven home: /tmp/tools/apache-maven-3.9.11
Java version: 25.0.4.1, vendor: Eclipse Adoptium, runtime: /tmp/tools/jdk-25.0.4.1+1
$ mvn dependency:list -- the resolved versions behind spring-boot-starter-parent 4.1.1
com.h2database:h2 2.4.240
io.micrometer:micrometer-core 1.17.1
io.micrometer:micrometer-registry-prometheus 1.17.1
org.apache.kafka:kafka-clients 4.2.1
org.springframework.boot:spring-boot 4.1.1
org.springframework.boot:spring-boot-actuator 4.1.1
org.springframework.boot:spring-boot-health 4.1.1
org.springframework.boot:spring-boot-restclient 4.1.1
org.springframework.security:spring-security-core 7.1.1
org.springframework.security:spring-security-web 7.1.1
org.springframework:spring-core 7.0.9
org.springframework:spring-web 7.0.9

35
docs/output/01-default-exposure.txt Normal file
View File

@@ -0,0 +1,35 @@
### Spring Boot Actuator, starter added, ZERO management.* configuration
$ curl -s -u ops:ops-password http://localhost:8080/actuator
{
"_links": {
"self": {
"href": "http://localhost:8080/actuator",
"templated": false
},
"health": {
"href": "http://localhost:8080/actuator/health",
"templated": false
},
"health-path": {
"href": "http://localhost:8080/actuator/health/{*path}",
"templated": true
}
}
}
$ curl -s -o /dev/null -w '%{http_code}' -u ops:ops-password http://localhost:8080/actuator/env
404
404 = discovered but NOT exposed over HTTP. Exposure and existence are different things.
$ curl -s -u ops:ops-password http://localhost:8080/actuator/health
{
"groups": [
"liveness",
"readiness"
],
"status": "DOWN"
}
Only 'health' is web-exposed by default. show-details defaults to 'never', so even an
authenticated caller sees a bare status until you say otherwise.

80
docs/output/02-endpoint-catalogue.txt Normal file
View File

@@ -0,0 +1,80 @@
### Every web-exposed endpoint, read from the running application
### profiles: exposeall,open management.endpoints.web.exposure.include: "*"
$ curl -s http://localhost:8080/actuator/diag
{
"activeProfiles": [
"exposeall",
"open"
],
"serverPort": "8080",
"managementPort": "(same as server.port)",
"managementBasePath": "/actuator",
"exposureInclude": "*",
"exposureExclude": "(none)",
"healthShowDetails": "always",
"exposedWebEndpointCount": 14,
"exposedWebEndpoints": {
"beans": [
"GET beans"
],
"conditions": [
"GET conditions"
],
"configprops": [
"GET configprops",
"GET configprops/{prefix}"
],
"diag": [
"GET diag"
],
"env": [
"GET env",
"GET env/{toMatch}"
],
"health": [
"GET health",
"GET health/{*path}"
],
"info": [
"GET info"
],
"loggers": [
"GET loggers",
"GET loggers/{name}",
"POST loggers/{name}"
],
"mappings": [
"GET mappings"
],
"metrics": [
"GET metrics",
"GET metrics/{requiredMetricName}"
],
"prometheus": [
"GET prometheus"
],
"sbom": [
"GET sbom",
"GET sbom/{id}"
],
"scheduledtasks": [
"GET scheduledtasks"
],
"threaddump": [
"GET threaddump",
"GET threaddump"
]
},
"healthContributors": [
"db (DataSourceHealthIndicator)",
"diskSpace (DiskSpaceHealthIndicator)",
"externalApi (ExternalApiHealthIndicator)",
"kafka (KafkaHealthIndicator)",
"livenessState (LivenessStateHealthIndicator)",
"ordersDatabase (OrdersDatabaseHealthIndicator)",
"ping (PingHealthIndicator)",
"readinessState (ReadinessStateHealthIndicator)",
"ssl (SslHealthIndicator)"
]
}

39
docs/output/03-open-actuator-leak.txt Normal file
View File

@@ -0,0 +1,39 @@
### profiles: exposeall,open -- NO credentials are sent on any request below
--- 1. /actuator/env does NOT leak values in Spring Boot 4 ---
$ curl -s http://localhost:8080/actuator/env/spring.datasource.password | jq .property
{
"source": "Config resource 'class path resource [application.yaml]' via location 'optional:classpath:/'",
"value": "******"
}
$ curl -s http://localhost:8080/actuator/env/acme.partner.credential | jq .property
{
"source": "Config resource 'class path resource [application.yaml]' via location 'optional:classpath:/'",
"value": "******"
}
Note the second one. 'acme.partner.credential' matches none of the classic
password/secret/token key patterns, and it is still masked. Masking is driven by
management.endpoint.env.show-values, which defaults to 'never' - not by key names.
--- 2. /actuator/heapdump is NOT exposed by 'include: "*"' ---
$ curl -s -o /dev/null -w '%{http_code}' http://localhost:8080/actuator/heapdump
404
management.endpoint.heapdump.access defaults to 'none'. So does shutdown.
They are the only two endpoints that do.
--- 3. /actuator/loggers: an unauthenticated WRITE ---
$ curl -s -X POST -d '{"configuredLevel":"TRACE"}' -H 'Content-Type: application/json' http://localhost:8080/actuator/loggers/org.springframework
status=204
$ curl -s http://localhost:8080/actuator/loggers/org.springframework
{
"configuredLevel": "TRACE",
"effectiveLevel": "TRACE"
}
(level reset). An attacker who can flip your root logger to TRACE has both a
denial-of-service primitive and a way to get request bodies written to disk.
--- 4. /actuator/beans and /actuator/mappings: your whole application, described ---
$ curl -s http://localhost:8080/actuator/mappings | python3 -c 'count the URL patterns'
30 servlet mappings disclosed
426 beans disclosed, each with its type and dependencies

13
docs/output/04-heapdump-leak.txt Normal file
View File

@@ -0,0 +1,13 @@
### profiles: exposeall,open PLUS --management.endpoint.heapdump.access=unrestricted
$ curl -s -o /tmp/heap.hprof -w 'status=%{http_code} bytes=%{size_download} type=%{content_type}' http://localhost:8080/actuator/heapdump
status=200 bytes=59186852 type=application/octet-stream
$ strings /tmp/heap.hprof | grep -c 'S3CRET-partner-credential'
1
$ strings /tmp/heap.hprof | grep -o 'not-a-real-password[^"]*' | head -1
not-a-real-password-but-watch-what-/actuator/env-does-with-it!
/actuator/env masked both of these to ******.
/actuator/heapdump handed over the process memory that contains them in plaintext.
Sanitisation is a property-rendering feature. It is not a security boundary.

106
docs/output/05-secured-matrix.txt Normal file
View File

@@ -0,0 +1,106 @@
### profile: secured (SecuredActuatorConfig + application-secured.yaml)
### exposure is "*" - the security chain, not the exposure list, is what protects it
ANONYMOUS
GET /actuator/health 503
GET /actuator/info 200
GET /actuator/env 401
GET /actuator/beans 401
GET /actuator/threaddump 401
GET /actuator (the links index) 401
AUTHENTICATED as ops (ROLE_ACTUATOR)
GET /actuator/health 503
GET /actuator/env 200
GET /actuator/beans 200
GET /actuator/threaddump 200
WRONG PASSWORD
GET /actuator/env 401
--- health body, anonymous (show-details: when-authorized) ---
{
"groups": [
"liveness",
"readiness"
],
"status": "DOWN"
}
--- health body, authenticated as ROLE_ACTUATOR ---
{
"components": {
"db": {
"details": {
"database": "H2",
"validationQuery": "isValid()"
},
"status": "UP"
},
"diskSpace": {
"details": {
"total": 10213466112,
"free": 3877920768,
"threshold": 10485760,
"path": "/tmp/work/spring-boot-demo/.",
"exists": true
},
"status": "UP"
},
"externalApi": {
"details": {
"url": "http://localhost:8080/stub/upstream/ping",
"response": "pong",
"latencyMs": 4,
"timeoutMs": 750
},
"status": "UP"
},
"kafka": {
"details": {
"bootstrap": "localhost:9092",
"tuned": true,
"error": "TimeoutException: Timed out waiting for a node assignment. Call: listNodes",
"probeMs": 1500,
"budgetMs": 1500
},
"status": "DOWN"
},
"livenessState": {
"status": "UP"
},
"ordersDatabase": {
"details": {
"orders": 3,
"queryMs": 0,
"slowThresholdMs": 250
},
"status": "UP"
},
"ping": {
"status": "UP"
},
"readinessState": {
"status": "UP"
},
"ssl": {
"details": {
"expiringChains": [],
"invalidChains": [],
"validChains": []
},
"status": "UP"
}
},
"groups": [
"liveness",
"readiness"
],
"status": "DOWN"
}
Same endpoint, same status code, different body. An anonymous prober learns that the
service is unhealthy but not WHICH dependency is unhealthy.
--- the business endpoint is untouched by the actuator chain ---
GET /orders/count (anonymous) 200

101
docs/output/06-management-port.txt Normal file
View File

@@ -0,0 +1,101 @@
### profile: mgmtport
### management.server.port: 9001 / management.server.address: 127.0.0.1 / base-path: /manage
--- the application port no longer serves Actuator at all ---
GET :8080/actuator/health 401
GET :8080/manage/health 401
GET :8080/orders/count 200
--- the management port serves it on the new base path ---
GET :9001/manage/health 503
GET :9001/actuator/health 404
GET :9001/orders/count 404
Note the last line. The management context has its own DispatcherServlet and does NOT
see application controllers. That is the isolation you are paying for.
--- what the management context reports about itself ---
$ curl -s -u ops:ops-password http://127.0.0.1:9001/manage/diag
{
"activeProfiles": [
"mgmtport"
],
"serverPort": "8080",
"managementPort": "9001",
"managementBasePath": "/manage",
"exposureInclude": "*",
"exposureExclude": "(none)",
"healthShowDetails": "never",
"exposedWebEndpointCount": 14,
"exposedWebEndpoints": {
"beans": [
"GET beans"
],
"conditions": [
"GET conditions"
],
"configprops": [
"GET configprops",
"GET configprops/{prefix}"
],
"diag": [
"GET diag"
],
"env": [
"GET env",
"GET env/{toMatch}"
],
"health": [
"GET health",
"GET health/{*path}"
],
"info": [
"GET info"
],
"loggers": [
"GET loggers",
"GET loggers/{name}",
"POST loggers/{name}"
],
"mappings": [
"GET mappings"
],
"metrics": [
"GET metrics",
"GET metrics/{requiredMetricName}"
],
"prometheus": [
"GET prometheus"
],
"sbom": [
"GET sbom",
"GET sbom/{id}"
],
"scheduledtasks": [
"GET scheduledtasks"
],
"threaddump": [
"GET threaddump",
"GET threaddump"
]
},
"healthContributors": [
"db (DataSourceHealthIndicator)",
"diskSpace (DiskSpaceHealthIndicator)",
"externalApi (ExternalApiHealthIndicator)",
"kafka (KafkaHealthIndicator)",
"livenessState (LivenessStateHealthIndicator)",
"ordersDatabase (OrdersDatabaseHealthIndicator)",
"ping (PingHealthIndicator)",
"readinessState (ReadinessStateHealthIndicator)",
"ssl (SslHealthIndicator)"
]
}
--- listening sockets ---
$ ss -ltn | grep -E ':(8080|9001)'
LISTEN 0 100 *:8080 *:*
LISTEN 0 100 [::ffff:127.0.0.1]:9001 *:*
9001 is bound to 127.0.0.1 only. 8080 is bound to *. An ingress that forwards to 8080
cannot reach Actuator no matter how the security rules are written.

121
docs/output/07-custom-health-indicators.txt Normal file
View File

@@ -0,0 +1,121 @@
### profile: details (show-details: always, show-components: always)
--- upstream UP ---
$ curl -s -o /dev/null -w '%{http_code}' http://localhost:8080/actuator/health
HTTP 503
{
"components": {
"db": {
"details": {
"database": "H2",
"validationQuery": "isValid()"
},
"status": "UP"
},
"diskSpace": {
"details": {
"total": 10213466112,
"free": 3877675008,
"threshold": 10485760,
"path": "/tmp/work/spring-boot-demo/.",
"exists": true
},
"status": "UP"
},
"externalApi": {
"details": {
"url": "http://localhost:8080/stub/upstream/ping",
"response": "pong",
"latencyMs": 66,
"timeoutMs": 750
},
"status": "UP"
},
"kafka": {
"details": {
"bootstrap": "localhost:9092",
"tuned": true,
"error": "TimeoutException: null",
"probeMs": 1500,
"budgetMs": 1500
},
"status": "DOWN"
},
"livenessState": {
"status": "UP"
},
"ordersDatabase": {
"details": {
"orders": 3,
"queryMs": 0,
"slowThresholdMs": 250
},
"status": "UP"
},
"ping": {
"status": "UP"
},
"readinessState": {
"status": "UP"
},
"ssl": {
"details": {
"expiringChains": [],
"invalidChains": [],
"validChains": []
},
"status": "UP"
}
},
"groups": [
"liveness",
"readiness"
],
"status": "DOWN"
}
--- flip the upstream to DOWN, change nothing else ---
$ curl -s -X POST 'http://localhost:8080/stub/upstream/mode?value=down'
upstream mode = DOWN
HTTP 503
{
"status": "DOWN",
"externalApi": {
"details": {
"error": "org.springframework.web.client.HttpServerErrorException$ServiceUnavailable: 503 : \"upstream unavailable\"",
"url": "http://localhost:8080/stub/upstream/ping",
"latencyMs": 67,
"timeoutMs": 750
},
"status": "DOWN"
}
}
The aggregate went DOWN and /actuator/health now answers 503. If that URL is your
Kubernetes readiness probe, every pod in the deployment has just left the load
balancer because a third party had a bad minute.
--- a single component, addressed directly ---
$ curl -s http://localhost:8080/actuator/health/ordersDatabase
{
"details": {
"orders": 3,
"queryMs": 0,
"slowThresholdMs": 250
},
"status": "UP"
}
$ curl -s http://localhost:8080/actuator/health/kafka
{
"details": {
"bootstrap": "localhost:9092",
"tuned": true,
"error": "TimeoutException: null",
"probeMs": 1500,
"budgetMs": 1500
},
"status": "DOWN"
}
--- restore ---
upstream mode = UP

65
docs/output/08-groups-and-probes.txt Normal file
View File

@@ -0,0 +1,65 @@
### profile: groups
--- baseline: upstream UP ---
GET /actuator/health HTTP 503
GET /actuator/health/liveness HTTP 200
GET /actuator/health/readiness HTTP 200
GET /actuator/health/startup HTTP 200
--- upstream DOWN (a third party is having an outage) ---
GET /actuator/health HTTP 503
GET /actuator/health/liveness HTTP 200
GET /actuator/health/readiness HTTP 503
GET /actuator/health/startup HTTP 200
liveness stayed 200. readiness went 503.
Kubernetes takes this instance out of the Service and leaves the process alone.
Wire readiness to /actuator/health and you get a restart loop instead.
--- what each group contains ---
$ curl -s http://localhost:8080/actuator/health/liveness
{
"components": {
"diskSpace": {
"details": {
"total": 10213466112,
"free": 3877605376,
"threshold": 10485760,
"path": "/tmp/work/spring-boot-demo/.",
"exists": true
},
"status": "UP"
},
"livenessState": {
"status": "UP"
}
},
"status": "UP"
}
$ curl -s http://localhost:8080/actuator/health/readiness
{
"components": {
"externalApi": {
"details": {
"error": "org.springframework.web.client.HttpServerErrorException$ServiceUnavailable: 503 : \"upstream unavailable\"",
"url": "http://localhost:8080/stub/upstream/ping",
"latencyMs": 66,
"timeoutMs": 750
},
"status": "DOWN"
},
"ordersDatabase": {
"details": {
"orders": 3,
"queryMs": 0,
"slowThresholdMs": 250
},
"status": "UP"
},
"readinessState": {
"status": "UP"
}
},
"status": "DOWN"
}

15
docs/output/09-kafka-timeout.txt.naive Normal file
View File

@@ -0,0 +1,15 @@
### Kafka health check against an unreachable broker -- naive
$ time curl -s http://localhost:8080/actuator/health/kafka
{
"details": {
"bootstrap": "localhost:9092",
"tuned": false,
"error": "TimeoutException: Timed out waiting for a node assignment. Call: listNodes",
"probeMs": 60002,
"budgetMs": 180000
},
"status": "DOWN"
}
wall clock: 60.2 s

15
docs/output/09-kafka-timeout.txt.tuned Normal file
View File

@@ -0,0 +1,15 @@
### Kafka health check against an unreachable broker -- tuned
$ time curl -s http://localhost:8080/actuator/health/kafka
{
"details": {
"bootstrap": "localhost:9092",
"tuned": true,
"error": "TimeoutException: null",
"probeMs": 1500,
"budgetMs": 1500
},
"status": "DOWN"
}
wall clock: 1.6 s

18
docs/output/10-slow-upstream.txt Normal file
View File

@@ -0,0 +1,18 @@
### profile: details upstream deliberately sleeping 30s per request
### demo.upstream.timeout-ms = 750, so the indicator gives up long before the stub replies
$ time curl -s http://localhost:8080/actuator/health/externalApi
{
"details": {
"error": "org.springframework.web.client.ResourceAccessException: I/O error on GET request for \"http://localhost:8080/stub/upstream/ping\": Read timed out",
"url": "http://localhost:8080/stub/upstream/ping",
"latencyMs": 753,
"timeoutMs": 750
},
"status": "DOWN"
}
wall clock: 0.84 s
The read timeout is what bounds this, not the endpoint. Remove setReadTimeout from
ExternalApiHealthIndicator and this call blocks for the full 30 seconds, holding a
Tomcat worker the whole time.