advancedScenario Questions

Scenario 19: A security audit flags that /actuator/heapdump and /actuator/env are reachable from the public internet on your production Spring Boot service.

This is a Security Misconfiguration (OWASP): several Actuator endpoints can leak secrets (environment variables, memory contents) or allow disruptive actions if left exposed without protection. Fix by restricting Actuator to a separate internal management port not exposed publicly, and/or explicitly securing sensitive actuator endpoints behind authentication with a dedicated SecurityFilterChain matcher.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to Scenario 20: A penetration test shows that submitting {"role":"ADMIN"} in the registration JSON body silently grants the new account admin privileges. →← Back to all Spring Security questions