Skip to content

[MOSIP-44770] Actuator endpoints are publicly accessible with broad exposure. #1845

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Md-Humair-KK wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

[MOSIP-44770] Actuator endpoints are publicly accessible with broad exposure. #1845

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
96821a6
security issue fixes
Md-Humair-KK May 13, 2026
dc4d806
security issue fixes
Md-Humair-KK May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions esignet-service/src/main/resources/application-default.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,13 +108,16 @@ mosip.esignet.security.auth.post-urls={'/client-mgmt/**' : {'SCOPE_add_oidc_clie
mosip.esignet.security.auth.put-urls={'/client-mgmt/**' : { 'SCOPE_update_oidc_client'} }
mosip.esignet.security.auth.get-urls={'/system-info/**' : { 'SCOPE_get_certificate'} }

mosip.esignet.security.ignore-csrf-urls=/oidc/**,/oauth/**,/actuator/**,/favicon.ico,/error,\
mosip.esignet.security.ignore-csrf-urls=/oidc/**,/oauth/**,/actuator/health,/actuator/health/**,/actuator/info,/actuator/prometheus,/favicon.ico,/error,\
/swagger-ui/**,/v3/api-docs/**,/linked-authorization/link-transaction,/linked-authorization/authenticate,\
/linked-authorization/consent,/binding/**,/client-mgmt/**,/system-info/**,/linked-authorization/v2/link-transaction,\
/linked-authorization/v2/authenticate,/linked-authorization/v2/consent

# SECURITY: Do NOT whitelist /actuator/** here. Only allow the specific safe endpoints (health, info, prometheus)
# to be reachable without authentication. All other actuator endpoints must require auth (or be blocked at network level).
mosip.esignet.security.ignore-auth-urls=/csrf/**,/authorization/**,/linked-authorization/**,/oidc/**,/oauth/**,\
/actuator/**,/favicon.ico,/error,/swagger-ui/**,/v3/api-docs/**,/binding/**
/actuator/health,/actuator/health/**,/actuator/info,/actuator/prometheus,\
/favicon.ico,/error,/swagger-ui/**,/v3/api-docs/**,/binding/**

spring.security.oauth2.resourceserver.jwt.issuer-uri=${keycloak.external.url}/auth/realms/mosip
spring.security.oauth2.resourceserver.jwt.jwk-set-uri=${keycloak.external.url}/auth/realms/mosip/protocol/openid-connect/certs
Expand Down
13 changes: 10 additions & 3 deletions esignet-service/src/main/resources/bootstrap.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,12 +36,19 @@ server.tomcat.accesslog.file-date-format=
server.tomcat.basedir=.
server.tomcat.accesslog.pattern={"@timestamp":"%{yyyy-MM-dd'T'HH:mm:ss.SSS'Z'}t","level":"ACCESS","level_value":70000,"traceId":"%{X-B3-TraceId}i","spanId":"%{X-B3-SpanId}i","statusCode":%s,"req.requestURI":"%U","bytesSent":%b,"timeTaken":%T,"appName":"${spring.application.name}","req.userAgent":"%{User-Agent}i","req.xForwardedFor":"%{X-Forwarded-For}i","req.referer":"%{Referer}i","req.method":"%m","req.remoteHost":"%a"}

## Prometheus
## Prometheus / Actuator
# SECURITY: Restrict actuator exposure to only required endpoints. Do NOT use '*',
# as that exposes sensitive endpoints such as /actuator/env, /actuator/beans, /actuator/configprops, /actuator/heapdump.
management.endpoints.web.exposure.include=health,info,prometheus
management.endpoints.web.exposure.exclude=env,beans,configprops,heapdump,threaddump,loggers,mappings,scheduledtasks,caches,conditions,httptrace,shutdown
management.endpoint.metrics.access=read-only
management.endpoints.web.exposure.include=*
management.endpoint.prometheus.access=read-only
management.prometheus.metrics.export.enabled=true
management.endpoint.env.show-values=ALWAYS
# SECURITY: Never reveal raw env / configprops values; hide health details from anonymous callers.
management.endpoint.env.show-values=NEVER
management.endpoint.configprops.show-values=NEVER
management.endpoint.health.show-details=never
management.endpoint.health.show-components=never

# disable mapping unknown endpoints to static resources instead throw exception
spring.web.resources.add-mappings=false
Loading