Fix Improper Assets Management in Spring WebFlux
Improper Assets Management in Spring WebFlux occurs when legacy API versions, shadow endpoints, or internal management routes are left exposed. In reactive stacks, this often manifests as unauthenticated 'zombie' routes or overly broad static resource mapping. Attackers hunt for these unmonitored assets to bypass security controls implemented on newer endpoints. We fix this by enforcing strict API versioning, implementing a 'Default Deny' security policy, and hardening Actuator exposure.
The Vulnerable Pattern
@Configuration public class WebConfig implements WebFluxConfigurer { @Override public void addResourceHandlers(ResourceHandlerRegistry registry) { // VULNERABILITY: Mapping the root path to internal directories // This can expose sensitive config files or internal scripts registry.addResourceHandler("/**") .addResourceLocations("classpath:/static/", "file:/app/config/"); }@Bean public RouterFunction<ServerResponse> legacyRoutes() { // VULNERABILITY: Legacy unversioned endpoint with no security context return route(GET("/debug/user-dump"), req -> ServerResponse.ok().bodyValue(userRepo.findAll())); }
}
The Secure Implementation
The fix involves three pillars: 1. Attack Surface Reduction: Use 'RouterFunctions.prefix' to force API versioning, allowing old 'v1' routes to be decommissioned or isolated. 2. Strict Resource Mapping: Never map '/**' to file system locations; use specific subdirectories like '/assets/public/'. 3. Default Deny Policy: Use Spring Security's 'ServerHttpSecurity' to explicitly deny any exchange that doesn't match a known, managed asset. This prevents 'Shadow APIs' from existing in the background without developer knowledge.
@Configuration @EnableWebFluxSecurity public class SecurityConfig { @Bean public SecurityWebFilterChain securityFilterChain(ServerHttpSecurity http) { return http .authorizeExchange(exchanges -> exchanges // 1. Explicitly permit only public assets .pathMatchers("/assets/public/**").permitAll() // 2. Enforce versioning for API access .pathMatchers("/api/v2/**").authenticated() // 3. Secure Actuator endpoints .pathMatchers("/actuator/health", "/actuator/info").permitAll() // 4. Default Deny: Kill shadow APIs and legacy routes .anyExchange().denyAll() ) .httpBasic(Customizer.withDefaults()) .build(); }@Bean public RouterFunction<ServerResponse> apiRoutes() { // SECURE: Versioned path and internal logic removed from public reach return RouterFunctions.prefix("/api/v2", route(GET("/users"), req -> ServerResponse.ok().body(userRepo.findAll(), User.class))); }
}
Your Spring WebFlux API
might be exposed to Improper Assets Management
74% of Spring WebFlux apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.