Securing the Config Server

So, we've locked down chat, images, and comments. But what about the Config Server itself? Seeing how critical it is with each microservice's configuration details, we need to insulate ourselves from a malevolent Config Server being stood up in its place.

The simplest thing to do is to add Spring Security to our Config Server. So, let's do it!

    compile('org.springframework.boot:spring-boot-starter-security') 

By default, Spring Security will set username to user and password to something random. Since we can't be updating the other services every time we restart, let's override that with a fixed password, as follows:

  @Bean
  UserDetailsService userDetailsService() {
    return new InMemoryUserDetailsManager(
      User
        .withUsername("user")
        .password("password")
        .roles("USER").build());
  } 

In Spring Boot 1.x, there was a security.password property to override. In the spirit of simplification, this property has been removed in Spring Boot...