Spring Boot service: securely expose internal API through independent management port

This article details how to use built-in configuration to isolate internal management APIs (such as Actuator endpoints) from public business APIs in Spring Boot applications. By configuring independent management ports and precisely controlling exposed endpoints, service security can be effectively enhanced to ensure that only authorized internal systems can access monitoring and management functions, while public traffic is completely isolated from the main service port, avoiding additional proxy layer configuration.

In modern microservice architecture, Spring Boot applications are usually deployed behind a load balancer to provide public business APIs to the outside world. However, in addition to these public interfaces, services often need to expose some APIs for monitoring, health checking or management purposes, such as Prometheus indicator grabbing endpoints or various management endpoints provided by Spring Boot Actuator. How to safely and effectively isolate these internal APIs to prevent them from being accessed by outsiders without authorization is a common challenge.

A common idea is to introduce an additional proxy layer, such as Nginx, to forward and filter requests in front of each service instance. While this approach works, it increases deployment complexity and maintenance costs. Fortunately, Spring Boot itself provides powerful configuration options that can solve this problem natively and achieve internal API isolation.

Spring Boot management port and endpoint exposure mechanism

The Spring Boot Actuator module provides production-level monitoring and management capabilities for applications. By default, all Actuator endpoints are exposed on the application's main HTTP port. To decouple these internal management endpoints from the public business API, Spring Boot introduces the management.server.port configuration property.

Core configuration principles:

1. Independent management port (management.server.port) : By setting the management.server.port property, you can specify an independent HTTP port for the Actuator endpoint. This means that the Spring Boot application will listen on two ports at the same time: one for handling business requests (usually 8080 or the port configured through server.port), and another specifically for handling management endpoint requests. This physical port isolation is the first step towards internal API security.
2. Precise control over exposed endpoints (management.endpoints.web.exposure.include) : Even with a separate management port, we may not want all Actuator endpoints to be exposed. The management.endpoints.web.exposure.include property allows us to explicitly specify which Actuator endpoints should be exposed via Web (HTTP). This provides fine-grained control, exposing only necessary endpoints, further reducing the attack surface.

Configuration example

Suppose we want to expose the Prometheus metrics and health check endpoints on a separate management port 9090, and only allow these two endpoints to be accessed. In Spring Boot 2.7.X and later versions, you can configure the following in application.properties or application.yml:

application.properties:

 # Specify the port management.server.port=9090 that the management endpoint listens on

#Explicitly specify that only health and prometheus endpoints are exposed management.endpoints.web.exposure.include=health,prometheus

application.yml:

 management:
  server:
    port: 9090
  endpoints:
    web:
      exposure:
        include: health,prometheus

Configuration instructions:

• management.server.port=9090: This will migrate the Actuator endpoint from the default server.port to port 9090. The main application's business API is still accessed through server.port (e.g. 8080).
• management.endpoints.web.exposure.include=health,prometheus: This configuration instructs Spring Boot to only expose the /actuator/health and /actuator/prometheus endpoints through the Web. All other Actuator endpoints (such as /actuator/info, /actuator/beans, etc.) will not be exposed via HTTP on any port.

Practices and Notes

1. Network firewall configuration : Even if you isolate management endpoints to separate ports, it is highly recommended to restrict access to management ports at the network level (such as server firewall or cloud security group). Only IP addresses from internal monitoring systems, CI/CD tools, or specific operation and maintenance networks are allowed to access this port.
2. Authentication and Authorization : For sensitive internal APIs, even on standalone ports, consider adding additional authentication and authorization mechanisms, such as using Spring Security to provide basic authentication, OAuth2, or API Key verification for requests to the management port. This provides double protection for internal APIs.
3. Avoid default exposure : management.endpoints.web.exposure.include The default value is *, which exposes all endpoints. For security reasons, it is always recommended to explicitly list the endpoints that need to be exposed instead of relying on default values ​​or using management.endpoints.web.exposure.exclude to exclude.
4. Version compatibility : The above configuration is valid in Spring Boot 2.x and higher. For earlier versions, the configuration properties may be slightly different, please consult the official documentation for the corresponding version.
5. Logging and monitoring : Ensure that access to management ports is also adequately logged and monitored to detect abnormal access patterns in a timely manner.

Summarize

By utilizing the management.server.port and management.endpoints.web.exposure.include configurations provided by Spring Boot, we can elegantly and efficiently isolate the internal management API from the public business API. This approach not only avoids the introduction of additional proxy layers and reduces system complexity, but also significantly improves application security through physical port isolation and fine-grained endpoint control. Combined with appropriate network firewalls and authentication and authorization mechanisms, a Spring Boot service can be built that is both powerful and secure.

The above is the detailed content of Spring Boot service: securely expose internal API through independent management port. For more information, please follow other related articles on the PHP Chinese website!