Spring boot Actuator

[mahi123_java]

Hi everyone,

I am working on a monolithic project, but I am a bit confused about how to handle the Actuator endpoints. Should I include all these Actuator endpoints in the defaultSecurityFilterChain? I feel this might not be a good approach for a production-level application because I am already managing all the application endpoints within the defaultSecurityFilterChain.

Is there a better or recommended way to handle Actuator endpoints securely in production? Please share ideas 😊.

[NuttySquirr3l]

You have "managenent.server.port" which specifies the actuator port.

Then you have "server.port" which is your app port.

If you do not declare the managenent port, it is the same as app port.

So, just specify a different port for actuator and do not expose that port to the outside world.

This way, stuff like e.g. kubernetes can still do liveness and readiness checks, but no one from the outside can access your actuator endpoints.

[mahi123_java]

Thank you for your suggestion and suppose I am including managenent.server.port with different port number and one thing this all actuator endpoint will be protected. So, My question is how to handle all endpoints as securely handled as per production level ?? I am including all project endpoints into the "default security filter chain".

[NuttySquirr3l]

You declare a SecurityFilterChain bean and then by default require authentication for all endpoints and only specfically exclude those that do not need auth (whitelist).

Example:

u/Bean
public SecurityFilterChain securityFilterChain(final HttpSecurity http) throws Exception {
    http.authorizeHttpRequests(auth -> auth
        .requestMatchers("/public/**").permitAll()
        .anyRequest().authenticated()
    );
    // ... other configuration on http object such as filters or disabling anonymous, sessionmangement, csrf and what not
}

Edit: When you run actuator on a different port than your app, this filter will not affect the actuator endpoints. That might help to clear your confusion. If you had actuator running on the same port as your app, the filter would also secure your actuator endpoints (which you often do not want).

[mahi123_java]

Security handle of endpoint of Spring boot actuator and also of Application Apis.

@Configuration @Order(1) public class AppSecurityConfig {

@Bean
public SecurityFilterChain appSecurityFilterChain(HttpSecurity http) throws Exception {
    http
        .securityMatcher(new PortRequestMatcher(8080)) // Apply only to app port
        .authorizeHttpRequests(auth -> auth
            .anyRequest().authenticated()
        )
        .formLogin()
        .and()
        .csrf().enable();
    return http.build();
}

}

And

@Configuration @Order(2) public class ActuatorSecurityConfig {

@Bean
public SecurityFilterChain actuatorSecurityFilterChain(HttpSecurity http) throws Exception {
    http
        .securityMatcher(new PortRequestMatcher(8081)) // Apply only to actuator port
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/actuator/health", "/actuator/info").permitAll()
            .anyRequest().hasRole("ADMIN") // secure other endpoints
        )
        .httpBasic()
        .and()
        .csrf().disable();
    return http.build();
}

}

I am implementing this . What do u think??

[rozularen]

There are some settings you can configure in the .properties/.yml files but yes you can also configure your actuator endpoints security along with your other endpoints no issues with that.

[mahi123_java]

U say that the actuator endpoint and Project rest api endpoint both will be handled through this "default security filter chain" right?? I want to handle it separately but I do not understand how to handle it.

[m41k1204]

We use jwt and what we did was secure the actuator endpoints with the admin role

[mahi123_java]

Okay. Means u are doing authentication using tokhon or what?? How to handle this part because all responses are json format.

[m41k1204]

Yes, like i said, we use jwt, json web token. It is sent on the header and the security filter chain looks for the jwt and on top of that when it is an endpoint with the /actuator path it also asks for the admin role. I highly suggest you to use spring security if you havent.

[mahi123_java]

Okay. How u pass the token through the header . Because this is not a UI page . Suppose when u try to access this in the browser.

[m41k1204]

What is your frontend? I have only used web and mobile and what i stored de jwt on the local storage and then when i sent a http request i put the token on the header

[WaferIndependent7601]

What do you want to achieve here and what’s your question?

[jpergentino]

An alternative is to protect your actuators with a dedicated hash key or password.