Secure configuration
On this page 8 topics
Overview
Topics
- Secrets management basics
- HTTPS
- dependency updates
- secure logging
Learn first
2 h of practice (estimate)
Learning outcomes
- Supply secrets through environment variables or a secret store, never source control.
- Enforce HTTPS-only behavior (redirects, HSTS) and secure headers.
- Restrict Actuator endpoints in production.
- Scan dependencies for known vulnerabilities and keep them updated (Dependabot or OWASP Dependency-Check).
- Audit logs for sensitive data.
Lessons
Lab and exercises
Lab
JNR-042-LAB1 · Production hardening
Outcomes: 1–5 · Time: ~2 h Create a prod profile with secrets from the environment, restricted Actuator, security headers, and dependency scanning in the build. Acceptance: completes the capstone's security controls document.
Exercises (assessment: hardening checklist review)
| ID | Outcome | Task |
|---|---|---|
| JNR-042-EX01 | 1 | Move a hard-coded database password and JWT key out of application.yml into environment variables. |
| JNR-042-EX02 | 1 | A secret was committed. List the steps to respond. |
| JNR-042-EX03 | 2 | Check response headers with curl and list which security headers are present or missing. |
| JNR-042-EX04 | 2 | Explain HSTS and when it is safe to enable. |
| JNR-042-EX05 | 3 | Configure Actuator so only health and info are exposed and verify /actuator/env returns 404. |
| JNR-042-EX06 | 4 | Add a dependency scanner to the build and triage one finding. |
| JNR-042-EX07 | 5 | Audit sample logs and list every sensitive item found, with the fix. |
| JNR-042-EX08 | 1-5 | Review a prod configuration against a hardening checklist. |
Show solutions
- EX01
password: ${DB_PASSWORD}andjwt.key: ${JWT_SIGNING_KEY}; set values in the environment or secret store; keep a sample file with placeholders only. - EX02 Rotate the secret first, then remove it from the code; consider history cleanup; check access logs for misuse; add a secret scanner.
- EX03
curl -I https://...; checkX-Content-Type-Options,Strict-Transport-Security,Content-Security-Policy, cache and referrer headers; add what is missing. - EX04 HSTS makes browsers use HTTPS only for a period; enable once HTTPS works for the whole domain, starting with a short
max-age. - EX05
management.endpoints.web.exposure.include=health,info;curl /actuator/envreturns 404 (or 401 when protected). - EX06 Add the scanner plugin or Dependabot; for a finding, update the library, or record the reason and a review date.
- EX07 Typical findings: password in a request body log,
Authorizationheader, personal data in debug lines; remove, mask, or lower the log level. - EX08 Cover secrets, HTTPS/headers, Actuator, dependencies, and logging, giving a pass or fix note for each.
Quiz
Outcomes: O1 secrets · O2 HTTPS and headers · O3 Actuator · O4 dependency scanning · O5 secure logging.
A self-check for you: nothing is graded, saved or sent anywhere. Choose an answer, then check it. You can try again as often as you like.
Practical part
Eight exercises JNR-042-EX01 to EX08 plus the lab; the hardening checklist review (EX08) is the assessment. Pass: at least seven exercises correct, /actuator/env not reachable, and no secrets in code or logs.
Common mistakes
Exposing /actuator/env; ignoring scanner warnings forever.
Assessment
Hardening checklist review.
Career relevance
Dependency security (MID-053) and secrets (MID-054).