In our configuration, we separate Actuator's endpoints from our APIs and make it available on port 9000. On the server, we will make port 9000 only accessible from the internal network by using the firewall. For example, we can create a standalone admin application, which is also a Spring Boot application. In this admin application, it can access the Actuator's endpoints from the server side through the internal network and display the result on a page that only authorized administrators can see.

Because port 9000 is only accessible from the internal network, behind the firewall, we can change the Spring Security configuration, as in the following, to make the endpoints accessible without authentication:

public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
   ...
  protected void configure(HttpSecurity http) throws Exception {
    http
      ...
        .antMatchers(PUBLIC).permitAll()
        .requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll()
        .anyRequest().authenticated()
      ...
  }
  ...
}