Spring Boot Actuator - Cannot disable /info endpoint

Question

I tried disabling all actuator endpoints for production environment in application.yml configuration file:

endpoints.enabled: false

It works for all endpoints except for /info. How can I turn off all endpoints for given environment?

UPDATE:

Project I am working on is also acting as Eureka client. In documentation for Spring Cloud Netflix in section Status Page and Health Indicator (http://cloud.spring.io/spring-cloud-netflix/spring-cloud-netflix.html) it says that "Eureka instance default to "/info" and "/health" respectively".

Is there any solution to disable those endpoints?

I was able to disable /health endpoint with endpoints.enabled: false, but not the /info endpoint.

Securing the endpoint may be your only option. Disabling in production seems a strange choice since you are turning off you ability to use actuator. — code
I was able to secure /info endpoint with additional web security configuration (which works beside actuator's default security conf). What I don't like is that all actuator endpoints except /info can be secured by actuator configuration i.e. management.security.enabled: true. But in order to secure /info endpoint I need to create separate web security configuration only for this endpoint. It seems like I am doing a bit of hack in the code. — Saša

Saša Saša · Accepted Answer · 2015-12-24T09:56:14

Finally I managed to solve my problem. I enabled only /info and /health endpoints in actuator. And to allow access to /info endpoint only to users with role ADMIN I needed to mix actuator management security and spring security configuration.

So my application.yml looks like this:

endpoints.enabled: false

endpoints:
    info.enabled: true
    health.enabled: true

management.security.role: ADMIN

And spring security configuration like this (where I needed to change order of ManagementSecurityConfig to have higher priority):

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfiguration {


    @Configuration
    protected static class AuthenticationSecurity extends GlobalAuthenticationConfigurerAdapter {

        @Autowired
        private AuthenticationProvider authenticationProvider;

        public AuthenticationSecurity() {
            super();
        }

        @Override
        public void init(AuthenticationManagerBuilder auth) throws Exception {
             auth.inMemoryAuthentication().withUser("admin").password("secret").roles("ADMIN");
        }
    }

    @Configuration
    @Order(Ordered.HIGHEST_PRECEDENCE + 2)
    public static class ManagementSecurityConfig extends WebSecurityConfigurerAdapter {


        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf().disable()
                    .requestMatchers()
                    .antMatchers("/info/**")
                    .and()
                    .authorizeRequests()
                    .anyRequest().hasRole("ADMIN")
                    .and()
                    .httpBasic();
        }
    }

    @Configuration
    public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {

        protected void configure(HttpSecurity http) throws Exception {
            // API security configuration
        }

    }
}

Spring Boot Actuator - Cannot disable /info endpoint

2 Answers