commit 3220db4832492146ab00fc072884fddd13056341
author Lei Zhang <zhanglei@apache.org> Wed Mar 13 13:20:28 2024 +0800
committer Willem Jiang <willem.jiang@gmail.com> Thu Mar 14 11:42:13 2024 +0800
tree 806f5562fb6fc79db2684c09a7fe8fb8f252634f
parent 10bd2b432b3d21e4b5b1bf7ad66aa416ace86588

Disable insecure spring boot actuator endpoints by default.

Spring Boot Actuator only exposes the /actuator/health /actuator/info endpoint by default

alpha/alpha-server/src/main/resources/application.yaml

diff --git a/alpha/alpha-server/src/main/resources/application.yaml b/alpha/alpha-server/src/main/resources/application.yaml
index 59ed23f..3cb99aa 100644
--- a/alpha/alpha-server/src/main/resources/application.yaml
+++ b/alpha/alpha-server/src/main/resources/application.yaml
@@ -140,7 +140,7 @@
   endpoints:
     web:
       exposure:
-        include: "*"
+        include: "health,info"
   health:
     redis:
       enabled: false