Spring Boot 4 Actuator in production: endpoints, security, custom health indicators

Companion repository for the ankurm.com article. Every transcript in docs/output/
was produced by running this project; scripts/run-all.sh regenerates all of them.

Verified against Spring Boot 4.1.1 / Framework 7.0.9 / Security 7.1.1 /
Micrometer 1.17.1 / kafka-clients 4.2.1 on Temurin JDK 25.0.4.1+1.

scripts/demo-open-actuator.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# What an unauthenticated caller actually gets when exposure is "*" and the chain permits all.
+set -uo pipefail
+cd "$(dirname "$0")/.."
+OUT=docs/output/03-open-actuator-leak.txt
+B=http://localhost:8080/actuator
+{
+  echo "### profiles: exposeall,open   -- NO credentials are sent on any request below"
+  echo
+  echo "--- 1. /actuator/env does NOT leak values in Spring Boot 4 ---"
+  echo "\$ curl -s $B/env/spring.datasource.password | jq .property"
+  curl -s "$B/env/spring.datasource.password" | python3 -c 'import json,sys;print(json.dumps(json.load(sys.stdin)["property"],indent=2))'
+  echo "\$ curl -s $B/env/acme.partner.credential | jq .property"
+  curl -s "$B/env/acme.partner.credential" | python3 -c 'import json,sys;print(json.dumps(json.load(sys.stdin)["property"],indent=2))'
+  echo
+  echo "  Note the second one. 'acme.partner.credential' matches none of the classic"
+  echo "  password/secret/token key patterns, and it is still masked. Masking is driven by"
+  echo "  management.endpoint.env.show-values, which defaults to 'never' - not by key names."
+  echo
+  echo "--- 2. /actuator/heapdump is NOT exposed by 'include: \"*\"' ---"
+  echo "\$ curl -s -o /dev/null -w '%{http_code}' $B/heapdump"
+  curl -s -o /dev/null -w '%{http_code}\n' "$B/heapdump"
+  echo "  management.endpoint.heapdump.access defaults to 'none'. So does shutdown."
+  echo "  They are the only two endpoints that do."
+  echo
+  echo "--- 3. /actuator/loggers: an unauthenticated WRITE ---"
+  echo "\$ curl -s -X POST -d '{\"configuredLevel\":\"TRACE\"}' -H 'Content-Type: application/json' $B/loggers/org.springframework"
+  curl -s -o /dev/null -w '  status=%{http_code}\n' -X POST -H 'Content-Type: application/json' \
+       -d '{"configuredLevel":"TRACE"}' "$B/loggers/org.springframework"
+  echo "\$ curl -s $B/loggers/org.springframework"
+  curl -s "$B/loggers/org.springframework" | python3 -m json.tool
+  curl -s -o /dev/null -X POST -H 'Content-Type: application/json' \
+       -d '{"configuredLevel":null}' "$B/loggers/org.springframework"
+  echo "  (level reset). An attacker who can flip your root logger to TRACE has both a"
+  echo "  denial-of-service primitive and a way to get request bodies written to disk."
+  echo
+  echo "--- 4. /actuator/beans and /actuator/mappings: your whole application, described ---"
+  echo "\$ curl -s $B/mappings | python3 -c 'count the URL patterns'"
+  curl -s "$B/mappings" | python3 -c '
+import json,sys
+d=json.load(sys.stdin)
+n=0
+for ctx in d["contexts"].values():
+    for m in ctx["mappings"].get("dispatcherServlets",{}).values():
+        n+=len(m)
+print(f"  {n} servlet mappings disclosed")'
+  curl -s "$B/beans" | python3 -c '
+import json,sys
+d=json.load(sys.stdin)
+n=sum(len(c["beans"]) for c in d["contexts"].values())
+print(f"  {n} beans disclosed, each with its type and dependencies")'
+} > "$OUT" 2>&1
+echo "wrote $OUT"