locally hosted web application that allows you to perform various operations on PDF files
Go to file
Anthony Stirling 853161e891
Fix: Whitelist health endpoints in Security and Enterprise Filter + fix keep original commit (#5494)
Community PR that had a bug, kept original Commit for history with bug
fixed, Merge dont squash merge

# Description of Changes

This PR fixes #5159 by allowing standard health check endpoints to be
accessed without authentication, which is required for container
orchestration (Kubernetes/Docker) liveness and readiness probes.

Changes:

1. **Security Whitelist (RequestUriUtils):** Added `/actuator/health`,
`/healthz`, `/liveness`, and `/readiness` to the public whitelist to
prevent 401 Unauthorized.

2. **Enterprise Filter (EnterpriseEndpointFilter):** Added an exception
for health endpoints. Previously, this filter was aggressively blocking
all /actuator/ requests for non-Pro users, returning 404 Not Found even
if the security config was correct.

**Testing:** Verified locally.

**Before:** `curl http://localhost:8080/actuator/health` returned `401
Unauthorized`.
**After:** curl `http://localhost:8080/actuator/health` returns `200 OK`
and `{"status":"UP"}`.

A sample response from cURL:
After the fix
```bash
$ curl -v http://localhost:8080/actuator/health
```
Now returns:
```bash
* Host localhost:8080 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:8080...
* Connected to localhost (::1) port 8080
> GET /actuator/health HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Date: Mon, 15 Dec 2025 18:39:18 GMT
< Vary: Origin
< Vary: Access-Control-Request-Method
< Vary: Access-Control-Request-Headers
< X-Request-Id: 775fb1ee-35de-400d-9e8b-bd1805e3c61a
< Content-Type: application/vnd.spring-boot.actuator.v3+json
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 0
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate
< Pragma: no-cache
< Expires: 0
< X-Frame-Options: DENY
< Transfer-Encoding: chunked
<
* Connection #0 to host localhost left intact
{"status":"UP"}
```

---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [x] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md)
(if applicable)
- [x] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation
**NOT APPLICABLE**
- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### UI Changes (if applicable)
**NOT APPLICABLE**
- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing)
for more details.

---------

# Description of Changes

<!--
Please provide a summary of the changes, including:

- What was changed
- Why the change was made
- Any challenges encountered

Closes #(issue_number)
-->

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/DeveloperGuide.md#6-testing)
for more details.

---------

Co-authored-by: Saksham Mittal <saksham2005mittal@gmail.com>
Co-authored-by: Dario Ghunney Ware <dariogware@gmail.com>
2026-01-22 16:14:29 +00:00
.devcontainer chore: update development configs, formatting tools, and CI enhancements (#4130) 2025-08-08 12:52:51 +01:00
.github build(deps): bump actions/checkout from 4.2.2 to 6.0.1 (#5465) 2026-01-21 22:26:01 +00:00
.vscode V2 Auto rename (#4244) 2025-09-05 17:12:52 +01:00
app Fix: Whitelist health endpoints in Security and Enterprise Filter + fix keep original commit (#5494) 2026-01-22 16:14:29 +00:00
devGuide refactor: remove legacy Thymeleaf web UI controllers and templates (#5406) 2026-01-21 21:58:29 +00:00
devTools build(deps-dev): bump stylelint-config-standard from 39.0.1 to 40.0.0 in /devTools (#5504) 2026-01-21 22:24:29 +00:00
docker Libre threads (#5303) 2026-01-15 19:14:45 +00:00
docs V1 merge (#5193) 2025-12-21 10:40:32 +00:00
frontend fix(annotations): fix error 300 on sign frontend (#5536) 2026-01-22 16:13:54 +00:00
gradle/wrapper
images Revert "[ImgBot] Optimize images" (#5293) 2025-12-22 22:10:23 +00:00
scripts Libre threads (#5303) 2026-01-15 19:14:45 +00:00
testing build(deps): bump reportlab from 4.4.5 to 4.4.9 in /testing/cucumber (#5505) 2026-01-21 22:24:58 +00:00
.dockerignore java frontend (#5097) 2025-12-02 17:15:29 +00:00
.editorconfig Add linting to frontend (#4341) 2025-09-04 14:08:28 +01:00
.git-blame-ignore-revs refactor: move modules under app/ directory and update file paths (#3938) 2025-07-14 20:53:11 +01:00
.gitattributes refactor: move modules under app/ directory and update file paths (#3938) 2025-07-14 20:53:11 +01:00
.gitignore photo scan V2 (#5255) 2025-12-30 18:55:56 +00:00
.pre-commit-config.yaml deps(ci): update Dependabot, pre-commit tooling, and testing dependencies (#5170) 2025-12-27 23:56:57 +00:00
ADDING_TOOLS.md refactor: remove legacy Thymeleaf web UI controllers and templates (#5406) 2026-01-21 21:58:29 +00:00
build.gradle scrollbar fixes (#5529) 2026-01-21 21:35:17 +00:00
CLAUDE.md refactor: remove legacy Thymeleaf web UI controllers and templates (#5406) 2026-01-21 21:58:29 +00:00
CONTRIBUTING.md
DATABASE.md feat(database): make backup schedule configurable via system keys (#4251) 2025-09-04 15:02:31 +01:00
DeveloperGuide.md refactor: remove legacy Thymeleaf web UI controllers and templates (#5406) 2026-01-21 21:58:29 +00:00
gradle.properties build(local): simplify writeVersion task with WriteProperties plugin and enable build caching (#4139) 2025-08-08 10:36:30 +01:00
gradlew
gradlew.bat
HowToUseOCR.md
launch4jConfig.xml ci: enhance GitHub Actions workflows with Gradle setup, caching improvements, and Docker image testing (#3956) 2025-07-16 17:17:11 +01:00
LICENSE Update LICENSE with proprietary directory details 2025-11-27 11:11:53 +00:00
README.md Update wording for third-party services reference 2025-12-02 19:14:03 +00:00
SECURITY.md
settings.gradle chore(ci): enable Gradle dependency caching across GitHub workflows (#5400) 2026-01-19 19:03:50 +00:00
test_globalsign.pdf V2 Validate PDF Signature tool (#4679) 2025-10-16 13:45:59 +01:00
test_irs_signed.pdf V2 Validate PDF Signature tool (#4679) 2025-10-16 13:45:59 +01:00
WINDOWS_SIGNING.md Add initial Windows signing infrastructure (#4945) 2025-11-20 12:21:42 +00:00

Stirling PDF logo

Stirling PDF - The Open-Source PDF Platform

Stirling PDF is a powerful, open-source PDF editing platform. Run it as a personal desktop app, in the browser, or deploy it on your own servers with a private API. Edit, sign, redact, convert, and automate PDFs without sending documents to external services.

Docker Pulls Discord OpenSSF Scorecard GitHub Repo stars

Stirling PDF - Dashboard

Key Capabilities

  • Everywhere you work - Desktop client, browser UI, and self-hosted server with a private API.
  • 50+ PDF tools - Edit, merge, split, sign, redact, convert, OCR, compress, and more.
  • Automation & workflows - No-code pipelines direct in UI with APIs to process millions of PDFs.
  • Enterprisegrade - SSO, auditing, and flexible onprem deployments.
  • Developer platform - REST APIs available for nearly all tools to integrate into your existing systems.
  • Global UI - Interface available in 40+ languages.

For a full feature list, see the docs: https://docs.stirlingpdf.com

Quick Start

docker run -p 8080:8080 docker.stirlingpdf.com/stirlingtools/stirling-pdf

Then open: http://localhost:8080

For full installation options (including desktop and Kubernetes), see our Documentation Guide.

Resources

Support

Contributing

We welcome contributions! Please see CONTRIBUTING.md for guidelines.

For development setup, see the Developer Guide.

For adding translations, see the Translation Guide.

License

Stirling PDF is open-core. See LICENSE for details.