Fix Security Misconfiguration in Micronaut

Micronaut's management endpoints provide deep introspection into application state. Leaving these exposed without authentication is an invitation for attackers to map your internal architecture, leak environment variables, or trigger remote shutdowns. Hardening these is non-negotiable for any production-grade microservice.

The Vulnerable Pattern

endpoints:
  all:
    enabled: true
    sensitive: false
# This configuration exposes all management beans, environment variables,
# and route mappings to the public internet without any auth challenge.

The Secure Implementation

The vulnerable configuration sets 'sensitive: false' globally, exposing critical metadata like /env (environment variables) or /beans to the public. The secure fix follows the principle of least privilege: disable all endpoints by default, explicitly enable only what is necessary (e.g., /health for Kubernetes probes), and enforce authentication via Micronaut Security interceptors for sensitive metadata. By routing management traffic through security filters, you ensure that only authorized principals can access the application's internal state.

endpoints:
  all:
    enabled: false
  health:
    enabled: true
    sensitive: false
  info:
    enabled: true
    sensitive: true
micronaut:
security:
enabled: true
interceptors:
- path: /health
access: isAnonymous()
- path: /info
access: isAuthenticated()
- path: /management/**
access: hasRole(‘ROLE_ADMIN’)