Keep the Spring Boot health endpoint at its default of never for public traffic. Details such as database and disk status help operators but also describe your infrastructure to outsiders. Use when-authorized with a named role for internal views, and use always only when the endpoint is not reachable by untrusted users.
What the property does
The Spring Boot docs say the information exposed by the health endpoint depends on management.endpoint.health.show-details and management.endpoint.health.show-components. Each takes one of three values.
| Value | Meaning | Good for |
|---|---|---|
| never | Details are never shown (default) | Public load balancer probes |
| when-authorized | Shown only to authorized users | Operators signed in with a role |
| always | Shown to all users | Private networks only |
A user is authorized when they hold one or more of the endpoint's roles. If no roles are configured, which is the default, all authenticated users are considered authorized. The roles are set with management.endpoint.health.roles.
Why details matter to an attacker
Component status can reveal which databases, message brokers or caches an application uses, and when one is failing. That helps someone plan an attack or time one. It is low severity alone, but it is free reconnaissance.
A practical setup
- Leave show-details as never for the main port.
- Move Actuator to a management port that is only reachable from your monitoring network, if your platform allows it.
- Set when-authorized and a dedicated role such as an ops role for human operators.
- For orchestrator probes, rely on the liveness and readiness groups, which the docs say are enabled automatically and can be turned off with a property.
- If you do choose always, the docs warn that your security configuration must permit access to health for both authenticated and unauthenticated users, so check that rule exists on purpose.
Mistakes to watch for
- Setting always in a shared profile that also runs in production.
- Assuming "authenticated" means "operator". Without roles, any logged in customer account is authorized.
- Exposing more endpoints at the same time, which compounds the exposure. See our guide to Actuator exposure and access.
- Forgetting that a custom security chain changes the defaults, as explained in does your own SecurityFilterChain remove Actuator security.
Safeguard scans dependencies, produces SBOMs and uses reachability analysis to show which findings your code can actually reach. You can run a free scan at gold.safeguard.sh/scan.
Quick check
What is the default for show-details?
The default value is never, so the health endpoint reports status without component details.
Do I need always for Kubernetes probes?
Not necessarily. The docs describe liveness and readiness health groups that serve that purpose.
Sources
Last reviewed: 19 October 2026.
