Spring Boot Actuator: the wildcard is the bug, not the endpoint that sounds scary

Actuator has two knobs and they do not do the same job. Whether an endpoint is registered is set per endpoint; whether HTTP can reach it is set by `management.endpoints.web.exposure.include`, which since Spring Boot 2 resolves to `/health` and nothing else until someone changes it ^[2]. The criteria behind that default were drawn for development rather than production, which is the author's starting complaint ^[11]. The recipe under attack sets the exposure knob to the wildcard and then spends three lines arguing with the other one ^[5]. The ordering is what makes it fragile: the wildcard is evaluated against whatever is in the registry, so it stands as an instruction to publish endpoints nobody has read about yet ^[3][6]. The author's own comparison is the accurate one, a firewall that permits the ports you need rather than blocking the ones you have heard of ^[9].

Then do the subtraction. The post names five endpoints the asterisk sweeps in: `env`, `beans`, `configprops`, `heapdump`, `threaddump` ^[3]. The blocklist closes two of them, `env` and `heapdump`, and spends its third line on `shutdown`, which was not in that list at all ^[5]. That leaves `beans`, `configprops` and `threaddump` reachable ^[15]. A file that reads as hardening still serves three of the five endpoints its own author flagged, and one property line is what moved the app from a single exposed endpoint to the whole registry ^[16].

The two headline endpoints also fail differently. `/env` returns the PropertySource tree, and there is a filter made for it: `keys-to-sanitize` redacts by key name, so in the best case a leak degrades into a leak of names ^[7]. `/heapdump` has no key names to filter, because it is process memory serialised, and the post's argument is that live session tokens come out with it, putting a fetched dump in the same bracket as a token stolen through XSS ^[8].

On sourcing: this is one post by one author, published twice on dev.to, once in Spanish and once in English ^[17][1]. The English edition still carries the Spanish comments inside its code blocks ^[13], which is a fair sign the two are one text rather than two reports, so read it as an opinion with worked examples and not as corroboration. Both copies also stop before the allowlist snippet arrives ^[14]. The prescriptive half, meaning the endpoints this author would actually justify exposing, is not on the page. The direction of the default is, and that part survives without the snippet ^[10]. The reader likeliest to need it is the one holding an audit finding that named an endpoint ^[12], and that reader already has the properties file the subtraction applies to.