2018-12-18 10:05:15 +00:00
|
|
|
# Insecure management interface
|
|
|
|
|
|
|
|
|
|
## Springboot-Actuator
|
|
|
|
|
|
2018-12-24 14:02:50 +00:00
|
|
|
Actuator endpoints let you monitor and interact with your application.
|
|
|
|
|
Spring Boot includes a number of built-in endpoints and lets you add your own.
|
|
|
|
|
For example, the health endpoint provides basic application health information.
|
|
|
|
|
Some of them contains sensitive info such as :
|
2018-12-18 10:05:15 +00:00
|
|
|
|
2018-12-24 14:02:50 +00:00
|
|
|
- `/trace` (by default the last 100 HTTP requests with headers)
|
|
|
|
|
- `/env` (the current environment properties)
|
|
|
|
|
- `/heapdump` (builds and returns a heap dump from the JVM used by our application).
|
2018-12-18 10:05:15 +00:00
|
|
|
|
2018-12-24 14:02:50 +00:00
|
|
|
These endpoints are enabled by default in Springboot 1.X. Since Springboot 2.x only `/health` and `/info` are enabled by default.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## References
|
|
|
|
|
|
|
|
|
|
* [Springboot - Official Documentation](https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-endpoints.html)
|
