SpringCloud/spring-cloud-commons
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

note section added for security implications of exposed actuator env. (#1231)

Browse Source
This commit is contained in:
omernaci
2023-05-05 03:10:51 +03:00
committed by GitHub
parent b4010c9cf8
commit f00cc0e052
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/src/main/asciidoc/spring-cloud-commons.adoc
View File

@@ -248,6 +248,10 @@ For a Spring Boot Actuator application, some additional management endpoints are
* `/actuator/restart` to close the `ApplicationContext` and restart it (disabled by default).
* `/actuator/pause` and `/actuator/resume` for calling the `Lifecycle` methods (`stop()` and `start()` on the `ApplicationContext`).
NOTE: While enabling the `POST` method for `/actuator/env` endpoint can provide flexibility and convenience in managing your application environment variables,
it's critical to ensure that the endpoint is secured and monitored to prevent potential security risks.
Add a `spring-boot-starter-security` dependency to configure access control for the actuator’s endpoint.
NOTE: If you disable the `/actuator/restart` endpoint then the `/actuator/pause` and `/actuator/resume` endpoints
will also be disabled since they are just a special case of `/actuator/restart`.