Fix Shadow API Exposure in Dropwizard
Shadow APIs in Dropwizard environments are undocumented endpoints that bypass security controls because they aren't tracked in the official OpenAPI/Swagger spec or registered via standard lifecycle management. These usually manifest as 'hidden' debug resources or experimental features registered directly to the Jersey environment, often leaking sensitive system internals or providing unauthorized administrative capabilities.
The Vulnerable Pattern
public class MyApiApplication extends Application{ @Override public void run(MyConfig config, Environment environment) { // VULNERABILITY: Registering a powerful debug resource directly to the public API environment // This endpoint will be exposed on the default port (8080) and is likely undocumented. environment.jersey().register(new InternalSystemDebugResource()); // VULNERABILITY: Classpath scanning can pick up 'Shadow' resources automatically // environment.jersey().packages("com.company.api.experimental"); }
}
The Secure Implementation
To kill Shadow APIs, you must enforce strict resource registration and network segregation. First, disable generic package scanning in Jersey to prevent accidental exposure of experimental classes. Second, utilize Dropwizard's dual-port architecture: public business logic stays on the Application port (8080), while diagnostic, debug, and 'shadow' administrative tools are moved to the Admin port (8081). Finally, ensure all public resources are annotated for OpenAPI generation to maintain a single source of truth for your attack surface. If it's not in the spec, it shouldn't be in the code.
public class MyApiApplication extends Application{ @Override public void run(MyConfig config, Environment environment) { // FIX 1: Explicitly register public resources only. environment.jersey().register(new PublicUserResource()); // FIX 2: Move sensitive/internal tools to the Admin Port (default 8081). // This ensures they are not reachable via the public-facing load balancer. environment.admin().addTask(new InternalDiagnosticTask()); // FIX 3: Use a dedicated Admin-only Servlet context if you need RESTful admin tools. environment.admin().addServlet("InternalDebug", new InternalDebugServlet()) .addMapping("/debug/*"); }
}
Your Dropwizard API
might be exposed to Shadow API Exposure
74% of Dropwizard apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.