I have created a spring boot app having various endpoints secured and throttling is enabled on them like if more then certain calls will come in a minute it will give 429.
My /health endpoint doesn’t need any auth or apikey. So a person or attacker can call this api numerous times, will it impact my overall application performance making it slow?
I have tried reading the documentation but unable to find any checks against the above concern. Please let me know if any throttling or any check required here.
I am using spring boot 3
1
- You can add security check on
/healthendpoint
- add
spring-boot-starter-securitydependency - You can find default config in
org.springframework.boot.actuate.autoconfigure.security.servlet.ManagementWebSecurityAutoConfiguration. It check every endpoint besides/infoand/health, so you need exclude it since you need security check on/health.
@SpringBootApplication(exclude = {
SecurityAutoConfiguration.class,
ManagementWebSecurityAutoConfiguration.class
})
- Then add your personal security check in security config, such as limit only admin user can check
/health
http.requestMatcher(EndpointRequest.to("/health"))
.authorizeRequests((requests) -> requests.anyRequest().hasRole("ADMIN"));
- or just disable it by
management.endpoint.health.enabled=falseif you don’t need it.