fix: expose only aggregate health information by default

server/src/main/config/application.properties

@@ -35,8 +35,8 @@ spring.freemarker.request-context-attribute = request
 spring.freemarker.suffix = .ftl
 
 # Spring Boot Actuator监控端点配置
-management.endpoints.web.exposure.include = health,info,metrics
-management.endpoint.health.show-details = always
+management.endpoints.web.exposure.include = health
+management.endpoint.health.show-details = never
 management.health.defaults.enabled = true
 
 

server/src/test/java/cn/keking/config/ActuatorExposureSecurityTests.java

@@ -0,0 +1,30 @@
+package cn.keking.config;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.web.client.TestRestTemplate;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpStatus;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+@SpringBootTest(classes = ActuatorExposureSecurityTests.ManagementApp.class,
+        webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+class ActuatorExposureSecurityTests {
+    @Configuration(proxyBeanMethods = false)
+    @EnableAutoConfiguration
+    static class ManagementApp { }
+
+    @Autowired TestRestTemplate http;
+
+    @Test void shippedDefaultsExposeOnlyAnAggregateHealthStatus() {
+        var health = http.getForEntity("/actuator/health", String.class);
+        assertEquals(HttpStatus.OK, health.getStatusCode());
+        assertEquals("{\"status\":\"UP\"}", health.getBody());
+        assertEquals(HttpStatus.NOT_FOUND, http.getForEntity("/actuator/info", String.class).getStatusCode());
+        assertEquals(HttpStatus.NOT_FOUND, http.getForEntity("/actuator/metrics", String.class).getStatusCode());
+        assertEquals(HttpStatus.NOT_FOUND, http.getForEntity("/actuator/metrics/jvm.memory.used", String.class).getStatusCode());
+    }
+}