Exposed Developer Consoles and Debug Endpoints

Fortify

Explanation

Turn these tools off where they are not needed, and put authentication and network controls in front of them where they are.

Insight

Configuration that differs by environment is easy to get wrong. Default to "off" in every profile and switch tools on only in local development.

Practical

Spring Boot (springdoc v2, Spring Security 6). The v2 artifact is springdoc-openapi-starter-webmvc-ui. Disable the UI and docs outside local development:

# application-prod.properties (and staging, and shared dev)
springdoc.swagger-ui.enabled=false
springdoc.api-docs.enabled=false
management.endpoints.web.exposure.include=health
management.server.port=8081
management.server.address=127.0.0.1

Spring Boot exposes only health over HTTP by default. Keep it that way, and never add heapdump or env to the exposure list on anything reachable from outside. A separate management port bound to localhost keeps Actuator off the public listener.

If an environment must keep the docs, protect them with a SecurityFilterChain bean. WebSecurityConfigurerAdapter and antMatchers were removed in Spring Security 6.

@Configuration
@EnableWebSecurity
class SecurityConfig {

    @Bean
    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/swagger-ui/**", "/v3/api-docs/**").hasRole("API_DOCS")
                .requestMatchers("/actuator/health").permitAll()
                .anyRequest().authenticated())
            .oauth2ResourceServer(oauth -> oauth.jwt(Customizer.withDefaults()));
        return http.build();
    }
}

Credentials come from your identity provider. Do not hardcode a password in the class or in application.properties.

GraphQL (Apollo Server). The apollo-server package (v3) is end-of-life, and so is Apollo Server 4. Use @apollo/server v5. It disables introspection when NODE_ENV=production; set it explicitly so a missing variable cannot turn it back on:

import { ApolloServer } from '@apollo/server';

const server = new ApolloServer({
    typeDefs,
    resolvers,
    introspection: process.env.ENABLE_INTROSPECTION === 'true',
});

Add query depth and complexity limits as well, so a public endpoint cannot be used for denial of service.

Other tools.

• Jupyter: keep token or password authentication on, bind to 127.0.0.1, and reach it over SSH or a VPN. Never start it with an empty token on 0.0.0.0.
• Jenkins: never expose the controller to the internet, enforce authentication with matrix-based or role-based authorisation, and give Overall/Administer (which grants the script console) to as few people as possible.
• JDWP: on JDK 9 and later, address=5005 binds to localhost only. Never use address=*:5005 in a shared or deployed image.
• Node: --inspect binds to 127.0.0.1:9229 by default. Never ship --inspect=0.0.0.0 in a container image.

Tools/Techniques

• Spring profiles and SecurityFilterChain.
• @apollo/server v5 with explicit introspection.
• An identity-aware proxy (Cloudflare Access, Google IAP, oauth2-proxy) in front of any internal tool that must be reachable remotely.

Metrics/Signal

• Deployed environments with Swagger UI, introspection or non-health Actuator endpoints enabled.
• Container images containing debug flags.