Planned lessonJNR-042-L03

Locking down Actuator

On This Lesson 4 topics

This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.

In this lesson

expose only the safe operational endpoints.

Actuator exposes health, metrics, environment, and more; some endpoints reveal secrets or allow actions.
Expose only what is needed: management.endpoints.web.exposure.include=health,info.
Never expose env, heapdump, beans, or shutdown publicly.
Protect the rest with authentication and a role, or run them on a separate management port.
Hide health details from anonymous callers.

Draft outline details

yaml

management:
  endpoints.web.exposure.include: health,info
  endpoint.health.show-details: never

Which endpoint can leak configuration values?

Show answer

/actuator/env.

Apply this lesson with the module's lab, exercises and quiz.

Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.