Security Misconfiguration in Spring Boot – OWASP A05

Direct Answer

Security Misconfiguration is A02 in OWASP Top 10:2025; it was A05 in 2021. It includes an unsafe setting, unnecessary feature, exposed management endpoint, overly detailed error, permissive cloud policy, or missing hardening. Spring Boot examples arise when teams enable broad Actuator exposure, deploy the H2 console, publish sensitive health details, trust spoofable proxy headers, or expose debug errors. Review the effective production configuration and restrict each feature to the users and network that need it.

Code Example

// application-prod.properties
// Restrict Actuator endpoints to internal monitoring only
management.endpoints.web.exposure.include=health,info
management.endpoint.health.show-details=when-authorized
management.endpoints.web.base-path=/internal/actuator

// Disable H2 console completely in production
spring.h2.console.enabled=false

// Hide detailed error information
server.error.include-message=never
server.error.include-stacktrace=never
server.error.include-exception=false
server.error.include-binding-errors=never

@Configuration
public class ActuatorSecurityConfig {
    
    @Bean
    public SecurityFilterChain actuatorSecurity(HttpSecurity http) throws Exception {
        return http
            .securityMatcher("/internal/actuator/**")
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/internal/actuator/health").permitAll()
                .requestMatchers("/internal/actuator/**").hasRole("ADMIN")
            )
            .httpBasic(Customizer.withDefaults())
            .build();
    }
}

Common Mistakes & Pitfalls

• Copy-Pasting Dev Config: Using the same application.properties in production as development without reviewing each property—features like spring.h2.console.enabled=true slip through to production.
• Assuming Framework Security: Believing Spring Boot auto-secures its own features like Actuator or H2 console by default—it doesn't, convenience wins over security in development mode.
• Exposing All Actuator Endpoints: Setting management.endpoints.web.exposure.include=* to make monitoring setup easier, exposing dangerous endpoints like /shutdown, /heapdump, and /env that leak secrets or allow denial of service.
• Forgetting Swagger in Production: Leaving Swagger UI or SpringDoc OpenAPI endpoints publicly accessible, giving attackers a complete map of your API surface including undocumented endpoints and request formats.