Secure Spring Cloud Config Server

How to Secure Spring Cloud Config Server and Client Connections

Securing your Spring Cloud Config Server and client connections is crucial for maintaining the integrity and confidentiality of your configuration data in microservices architectures. This comprehensive guide covers the essential security practices that every senior Java Spring Boot developer should implement to protect configuration management infrastructure from unauthorized access and data breaches.

Why Spring Cloud Config Security Matters

In microservices environments, configuration servers handle sensitive data including database credentials, API keys, and other critical application properties[1]. Without proper security measures, configuration servers become attractive targets for attackers seeking to gain unauthorized access to valuable data[3]. Security breaches at the configuration level can compromise entire application ecosystems, making robust security implementation essential for enterprise applications.

Authentication and Authorization

Basic Authentication Implementation

Spring Cloud Config Server supports HTTP Basic Authentication out of the box when Spring Security is included in the classpath[2][7]. To implement basic authentication:

Server Configuration:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Configure authentication credentials in application.properties:

spring.security.user.name=admin
spring.security.user.password=secret
server.port=8888

Create a security configuration class for fine-grained control:

 <?java
@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
            .requestMatchers("/actuator/**").permitAll()
            .anyRequest().authenticated()
            .and()
            .httpBasic();
        
        return http.build();
    }
}

Client Configuration:

Configure client authentication using URI credentials or separate properties[8]:

spring:
  cloud:
    config:
      uri: https://user:password@localhost:8888
      # OR
      uri: https://localhost:8888
      username: admin
      password: secret

Role-Based Access Control (RBAC)

Implement role-based access control to restrict configuration access based on user roles[61][64]:

 <?java
@Configuration
@EnableWebSecurity
public class RBACSecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
            .requestMatchers("/admin/**").hasRole("ADMIN")
            .requestMatchers("/user/**").hasRole("USER")
            .anyRequest().authenticated()
            .and()
            .httpBasic();
        
        return http.build();
    }
}

SSL/TLS and Mutual Authentication

Enabling HTTPS

Configure SSL/TLS to encrypt data in transit between config server and clients[1][3]:

Server SSL Configuration:

server:
  port: 8443
  ssl:
    enabled: true
    key-store: classpath:server.p12
    key-store-password: changeit
    key-store-type: PKCS12
    key-alias: configserver

Generate a keystore using Java's keytool:

keytool -genkey -alias configserver -storetype PKCS12 -keyalg RSA -keysize 2048 -keystore server.p12 -validity 3650

Mutual TLS (mTLS) Authentication

For enhanced security, implement mutual TLS authentication where both client and server verify each other's certificates[5][27]:

Server Configuration:

server:
  port: 8888
  ssl:
    enabled: true
    client-auth: need
    key-store: classpath:config.jks
    key-store-password: 123456
    trust-store: classpath:config.jks
    trust-store-password: 123456
    key-alias: discovery

Client Configuration:

Configure client-side SSL with custom RestTemplate[5]:

<?java
@Configuration
public class SSLConfigServiceBootstrapConfiguration {

    @Autowired
    ConfigClientProperties properties;

    @Bean
    public ConfigServicePropertySourceLocator configServicePropertySourceLocator() throws Exception {
        final char[] password = "123456".toCharArray();
        final ClassPathResource resource = new ClassPathResource("client.jks");
        
        SSLContext sslContext = SSLContexts.custom()
            .loadKeyMaterial(resource.getFile(), password, password)
            .loadTrustMaterial(resource.getFile(), password, new TrustSelfSignedStrategy())
            .build();
            
        CloseableHttpClient httpClient = HttpClients.custom()
            .setSSLContext(sslContext)
            .setSSLHostnameVerifier((s, sslSession) -> true)
            .build();
            
        HttpComponentsClientHttpRequestFactory requestFactory = 
            new HttpComponentsClientHttpRequestFactory(httpClient);
            
        ConfigServicePropertySourceLocator configServicePropertySourceLocator = 
            new ConfigServicePropertySourceLocator(properties);
        configServicePropertySourceLocator.setRestTemplate(new RestTemplate(requestFactory));
        
        return configServicePropertySourceLocator;
    }
}

For newer Spring Cloud versions, configure TLS properties directly[8]:

spring:
  cloud:
    config:
      uri: https://myconfig.mycompany.com
      tls:
        enabled: true
        key-store: <path-of-key-store>
        key-store-type: PKCS12
        key-store-password: <key-store-password>
        key-password: <key-password>
        trust-store: <path-of-trust-store>
        trust-store-type: PKCS12
        trust-store-password: <trust-store-password>

Data Encryption at Rest

Symmetric Encryption

Spring Cloud Config Server provides built-in encryption capabilities for sensitive configuration data[39][41]. Configure symmetric encryption:

Server Setup:

Set the encryption key in bootstrap.properties:

encrypt.key=your-symmetric-key-here

Or use an environment variable:

export ENCRYPT_KEY=your-symmetric-key-here

Encrypting Properties:

Use the /encrypt endpoint to encrypt sensitive values:

curl localhost:8888/encrypt -s -d "mysecret"
# Returns: 682bc583f4641835fa2db009355293665d2647dade3375c0ee201de2a49f7bda

Store encrypted values in configuration files with the {cipher} prefix:

database:
  password: '{cipher}682bc583f4641835fa2db009355293665d2647dade3375c0ee201de2a49f7bda'

Asymmetric Encryption

For enhanced security, use asymmetric encryption with RSA key pairs[29][41]:

Server Configuration:

encrypt.keyStore.location=classpath:server.jks
encrypt.keyStore.password=letmein
encrypt.keyStore.alias=mytestkey
encrypt.keyStore.secret=changeme

Generate RSA key pair:

keytool -genkeypair -alias mytestkey -keyalg RSA -dname "CN=Web Server,OU=Unit,O=Organization,L=City,S=State,C=US" -keypass changeme -keystore server.jks -storepass letmein

Integration with HashiCorp Vault

For enterprise-grade secret management, integrate Spring Cloud Config with HashiCorp Vault[10][40][44]:

Dependencies:

<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-vault-config</artifactId>
</dependency>

Configuration:

spring:
  cloud:
    vault:
      host: localhost
      port: 8200
      scheme: https
      authentication: TOKEN
      token: your-vault-token
      kv:
        enabled: true
        backend: secret
        default-context: application

Vault Backend for Config Server:

Enable Vault as a backend store[50]:

spring:
  profiles:
    active: vault
  cloud:
    config:
      server:
        vault:
          host: localhost
          port: 8200
          scheme: https
          authentication: TOKEN
          token: your-vault-token

OAuth2 and JWT Integration

Implement OAuth2 with JWT tokens for stateless authentication[22][28]:

Resource Server Configuration:

 <?java
@Configuration
@EnableWebSecurity
public class OAuth2SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/config/**").hasScope("config")
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));
        
        return http.build();
    }
}

Client Configuration:

spring:
  security:
    oauth2:
      client:
        registration:
          config-server:
            client-id: config-client
            client-secret: secret
            authorization-grant-type: client_credentials
            scope: config
        provider:
          config-server:
            token-uri: https://auth-server/oauth/token

Monitoring and Auditing

Spring Boot Actuator Security

Secure Actuator endpoints while maintaining monitoring capabilities[59][62]:

 <?java
@Configuration
public class ActuatorSecurityConfig {

    @Bean
    public SecurityFilterChain actuatorSecurityFilterChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher(EndpointRequest.toAnyEndpoint())
            .authorizeHttpRequests(requests -> 
                requests.requestMatchers(EndpointRequest.to(HealthEndpoint.class)).permitAll()
                       .anyRequest().hasRole("ACTUATOR_ADMIN")
            )
            .httpBasic(withDefaults());
        
        return http.build();
    }
}

Audit Logging

Implement comprehensive audit logging for configuration access[63][73]:

 <?java
@Component
public class ConfigAuditListener implements ApplicationEventPublisher {

    private static final Logger auditLogger = LoggerFactory.getLogger("AUDIT");

    @EventListener
    public void handleConfigAccess(EnvironmentChangeEvent event) {
        auditLogger.info("Configuration accessed: user={}, keys={}, timestamp={}", 
            getCurrentUser(), event.getKeys(), Instant.now());
    }
}

Configure logging levels for Spring Cloud Config[66]:

logging:
  level:
    org.springframework.cloud.config: DEBUG
    org.springframework.security: DEBUG

Network Security Best Practices

Firewall Configuration

• Restrict network access to configuration servers:
• Limit access to trusted networks and IP ranges
• Use VPN or private networks for client-server communication
• Implement network segmentation to isolate configuration infrastructure

Service Mesh Integration

Integrate with service mesh solutions like Istio for enhanced security:

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: config-server-mtls
spec:
  selector:
    matchLabels:
      app: config-server
  mtls:
    mode: STRICT

Security Validation and Testing

Automated Security Testing

Implement security tests to validate configuration server security:

 <?java
@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
class ConfigServerSecurityTest {

    @Test
    void shouldRequireAuthenticationForConfigEndpoints() {
        given()
            .when()
            .get("/config/application/default")
            .then()
            .statusCode(401);
    }

    @Test
    void shouldAllowAccessWithValidCredentials() {
        given()
            .auth().basic("admin", "secret")
            .when()
            .get("/config/application/default")
            .then()
            .statusCode(200);
    }
}

Vulnerability Scanning

• Regularly scan dependencies and configurations:
• Use tools like OWASP Dependency-Check for vulnerability assessment
• Implement automated security scanning in CI/CD pipelines
• Keep Spring Boot and Spring Cloud dependencies updated

Production Deployment Considerations

Environment-Specific Security

spring:
  profiles: production
  security:
    require-ssl: true
    user:
      password: ${CONFIG_SERVER_PASSWORD:}
  cloud:
    config:
      server:
        encrypt:
          enabled: true

Certificate Management

• Implement proper certificate lifecycle management:
• Use certificate authorities for production certificates
• Implement automated certificate renewal
• Monitor certificate expiration dates
• Maintain secure certificate storage

High Availability and Security

• Ensure security measures don't compromise availability:
• Implement load balancing with SSL termination
• Use health checks that don't expose sensitive information
• Configure graceful degradation for authentication failures

Securing Spring Cloud Config Server and client connections requires a multi-layered approach combining authentication, encryption, network security, and proper monitoring. By implementing these security measures, you can ensure that your configuration management infrastructure remains protected against unauthorized access while maintaining the flexibility and scalability required for modern microservices architectures. Regular security audits, dependency updates, and adherence to security best practices will help maintain a robust and secure configuration management system throughout your application lifecycle.

Citations: [1] HTML Character Entities https://www.w3schools.com/html/html_entities.asp [2] HTML Symbols https://www.w3schools.com/html/html_symbols.asp [3] HTML Symbols, Entities and Codes https://www.toptal.com/designers/htmlarrows/symbols/ [4] HTML Special Characters https://www.html.am/reference/html-special-characters.cfm [5] What is character entities in HTML https://www.geeksforgeeks.org/html/what-is-character-entities-in-html/ [6] HTML Entities https://www.geeksforgeeks.org/html/html-entities/ [7] List of XML and HTML character entity references https://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_references [8] Character Entities for HTML, CSS and Javascript - Oinam Github https://oinam.github.io/entities/ [9] Complete list of HTML entities https://www.freeformatter.com/html-entities.html [10] HTML Unicode Miscellaneous Symbols https://www.w3schools.com/charsets/ref_utf_symbols.asp