asmhatre/spring-boot-demo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Spring Boot 4 Actuator in production: endpoints, security, custom health indicators

Browse Source 
Companion repository for the ankurm.com article. Every transcript in docs/output/
was produced by running this project; scripts/run-all.sh regenerates all of them.

Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 /
Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.
This commit is contained in:
Ankur Mhatre
2026-09-04 10:40:04 +05:30
commit 4b6cefa60a
64 changed files with 3195 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
docs/output/04-heapdump-leak.txt Normal file
View File

@@ -0,0 +1,13 @@
### profiles: exposeall,open PLUS --management.endpoint.heapdump.access=unrestricted
$ curl -s -o /tmp/heap.hprof -w 'status=%{http_code} bytes=%{size_download} type=%{content_type}' http://localhost:8080/actuator/heapdump
status=200 bytes=59186852 type=application/octet-stream
$ strings /tmp/heap.hprof | grep -c 'S3CRET-partner-credential'
1
$ strings /tmp/heap.hprof | grep -o 'not-a-real-password[^"]*' | head -1
not-a-real-password-but-watch-what-/actuator/env-does-with-it!
/actuator/env masked both of these to ******.
/actuator/heapdump handed over the process memory that contains them in plaintext.
Sanitisation is a property-rendering feature. It is not a security boundary.