Spring Boot 4.1.1 config behavior surprises developer behind security linter

·1 views

A developer maintaining spring-config-guard, a static-analysis tool that flags Spring Boot security misconfigurations, began testing actual runtime behavior in Spring Boot 4.1.1 after finding that documentation alone was insufficient. Testing revealed that /actuator/configprops gives a more accurate post-binding view of resolved properties than /actuator/env, which only shows raw values per source without indicating which wins. Endpoint availability depends on both exposure and access settings, meaning management.endpoints.web.exposure.include=* alone does not expose heapdump or shutdown, which carry restricted access by default. However, setting endpoints.access.default=unrestricted alongside a wildcard include does expose both, including heapdump, which can leak secrets from application memory. These findings prompted the developer to update the linter's internal model to reflect actual Spring Boot resolution logic rather than assumed documentation behavior.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Build Reliable Node.js Image Processing Pipelines for Event Galleries

A technical guide outlines best practices for handling large photo batches in event gallery platforms using Node.js queues or serverless workers. Durable queues are recommended for steady, high-volume workloads requiring strict ordering and operator control, while serverless workers suit infrequent traffic spikes with minimal infrastructure overhead. The approach treats each gallery import as a parent job with individual child image items, each tracking its own processing state through a defined state machine. Cancellation is modeled as a cooperative signal that workers check at multiple processing checkpoints, preventing orphaned or stale derivatives from being published. The guide emphasizes defining output contracts — including format, quality range, and pixel dimensions — before writing any processing code to avoid downstream inconsistencies.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Observability Controls to Catch Missed Node.js Cron Jobs in Production

A robust Node.js cron health check strategy requires an external heartbeat monitor — not just internal logs — to detect when a scheduled job never runs at all. Each scheduled task should carry a single deterministic run_id across all retry attempts, with a terminal event recording key fields like pipeline_id, status, duration, and cost_center. Logs and metrics can explain runs that did execute, but only an outside monitor can flag a job that was never invoked by the scheduler or host. Alert routing should be explicitly owned, with a dedicated worker polling for failures rather than inferring missed jobs from absent application evidence. Data minimization obligations still apply to audit logs, meaning payment credentials and personal data must be excluded from structured log fields regardless of retention needs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Monolith vs. Microservices: How to Choose the Right Architecture for Your Project

Software architects often debate monolithic versus microservices architecture, with each approach carrying distinct trade-offs rather than one being inherently superior. A monolith runs all application functionality — such as auth, payments, and notifications — as a single codebase and deployment unit, while microservices split these into independently deployable services communicating over a network. Both approaches share the same core goals: maintainability, reliability, scalability, and team productivity, but achieve them in different ways. Experts recommend that most new projects start with a monolith due to its simpler development, easier debugging, and lower operational overhead. Migrating to microservices should be considered only when a concrete problem — such as team scale or independent deployment requirements — genuinely demands it.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Infrastructure Code Can Safely Manage Internal DNS Hostnames

Engineers managing internal DNS from infrastructure code must first distinguish between platform-owned and customer-owned DNS zones, as treating them as a single writable pool leads to flawed deployment models. The recommended approach stores desired DNS records in the infrastructure repository and reconciles them during each deployment, making the repo the single source of truth. Any out-of-band edits then surface as failed deployments rather than silent configuration drift. Customer-owned zones require stricter controls — the platform should only display required records unless DNS control has been explicitly delegated. Fast-changing hostnames are better handled by a service registry, and automatic deletion of records should be avoided to prevent large-scale incidents from a single malformed file.

0 comments Read more at DEV Community