Keep in mind that opening up your CSP to allow for a CDN often allows many very old and vulnerable JavaScript libraries to be accessed. To force HTTPS in your Spring Boot app, you can extend WebSecurit圜onfigurerAdapter and require a secure public class Securit圜onfiguration extends WebSecurit圜onfigurerAdapter ĬSP is a good defense to prevent XSS attacks. Since they’re free, there’s no reason not to do it! Spring Boot Secured By Let’s Encrypt is a useful guide on how to do this. Generating and renewing Let’s Encrypt TLS certificates can be automated.

You might not be developing the next major website, but why limit yourself?! Troy Hunt, a well-known security researcher, has created a Why No HTTPS? site that tracks large websites not using HTTPS. While this has created a fair amount of controversy in the web community, it’s here to stay. These two developments have changed the game and caused TLS to become mainstream.Īs of July 24, 2018, Google Chrome now labels HTTP sites as “not secure”. Machines have become much faster, solving the performance problem, and Let’s Encrypt provides free TLS certificates. TLS/SSL certificates used to be expensive, and HTTPS was considered slow. Its primary goal is to ensure privacy and data integrity between computer applications. TLS is a cryptographic protocol that provides secure communication over a computer network. You might’ve heard it called SSL (Secure Sockets Layer). Transport Layer Security (TLS) is the official name for HTTPS. If you have additional suggestions from the ones we’ve listed, please add them in the comments! 1. We figured writing this post would be a fun way to give back to the community. We both work for companies in the security industry, love Java, and want to help developers create more secure applications. I collaborated on this post with Simon Maple, fellow Java Champion and Director of Developer Relations at Snyk.

This post aims to educate you on steps you can take to create a more secure Spring Boot application. If you’re a developer and you’re not concerned about security, chances are you think you should be. Much like code quality and testing, security has become a concern in developers minds. Spring Boot was first released in 2014, and a lot has changed since then. If you were used to Spring and lots of XML back in the day, Spring Boot is a breath of fresh air. Its autoconfiguration and starter dependencies reduce the amount of code and configuration you need to begin an app. Spring Boot has dramatically simplified the development of Spring applications.

Open source spring boot project