Planned lessonJNR-042-L06

Demo: hardening the prod profile

On This Lesson 3 topics

This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.

In this lesson

apply all controls in one profile. Prepares JNR-042-LAB1.

Draft outline details

Create application-prod.yml; replace secrets with environment variables.
Restrict Actuator to health,info.
Add security headers and HSTS; set forwarded-header handling for the proxy.
Add the dependency scanner to the build and run it; read the report.
Planned mistake: leaving management.endpoints.web.exposure.include=* from development; /actuator/env shows config. Fix: restrict it and re-test.
Grep the logs for passwords and tokens.

Apply this lesson with the module's lab, exercises and quiz.

Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.