Developing Java Applications with Spring and Spring Boot

Securing the Config Server

So, we've locked down chat, images, and comments. But what about the Config Server itself? Seeing how critical it is with each microservice's configuration details, we need to insulate ourselves from a malevolent Config Server being stood up in its place.

The simplest thing to do is to add Spring Security to our Config Server. So, let's do it!

    compile('org.springframework.boot:spring-boot-starter-security') 

By default, Spring Security will set username to user and password to something random. Since we can't be updating the other services every time we restart, let's override that with a fixed password, as follows:

  @Bean  UserDetailsService userDetailsService() {    return new InMemoryUserDetailsManager(      User .withUsername("user") ...