So, we've locked down chat, images, and comments. But what about the Config Server itself? Seeing how critical it is with each microservice's configuration details, we need to insulate ourselves from a malevolent Config Server being stood up in its place.
The simplest thing to do is to add Spring Security to our Config Server. So, let's do it!
compile('org.springframework.boot:spring-boot-starter-security') By default, Spring Security will set username to user and password to something random. Since we can't be updating the other services every time we restart, let's override that with a fixed password, as follows:
@Bean
UserDetailsService userDetailsService() {
return new InMemoryUserDetailsManager(
User
.withUsername("user")
.password("password")
.roles("USER").build());
} In Spring Boot 1.x, there was a security.password property to override. In the spirit of simplification, this property has been removed in Spring Boot...