Fix Shadow API Exposure in Micronaut

Shadow APIs in Micronaut are the 'ghosts in the machine'—untracked endpoints, legacy management beans, or dev-only controllers that leak into production. Attackers scan for default paths like /beans, /routes, or /env to map your internal architecture. If you aren't explicitly defining what is public, you're likely exposing a back door.

The Vulnerable Pattern

application.yml:
micronaut:
  endpoints:
    all:
      enabled: true
      sensitive: false
// Exposed Dev Controller
@Controller(“/internal”)
public class DebugController {
@Get(“/inspect”)
public Map<String, Object> dumpSystem() {
return System.getProperties();
}
}

The Secure Implementation

To kill shadow APIs, first adopt a 'deny-all' stance for management endpoints in application.yml. Only whitelist specific endpoints like 'health'. Use the @Requires(env = 'dev') annotation on any debugging controllers to ensure they are physically excluded from production builds. Finally, integrate Micronaut Security to enforce mandatory authentication on any remaining administrative routes, preventing unauthorized discovery via automated scanners.

application.yml:
micronaut:
  endpoints:
    all:
      enabled: false
    health:
      enabled: true
      sensitive: false
  security:
    enabled: true
    intercept-url-map:
      - pattern: /health
        access: isAnonymous()
// Secure Dev Controller
@Requires(env = Environment.DEVELOPMENT)
@Controller(“/internal”)
@Secured(SecurityRule.IS_AUTHENTICATED)
public class DebugController {
@Get(“/inspect”)
public Map<String, Object> dumpSystem() {
return System.getProperties();
}
}