So, we've locked down chat, images, and comments. But what about the Config Server itself? Seeing how critical it is with each microservice's configuration details, we need to insulate ourselves from a malevolent Config Server being stood up in its place.

The simplest thing to do is to add Spring Security to our Config Server. So, let's do it!

    compile('org.springframework.boot:spring-boot-starter-security') 

By default, Spring Security will set username to user and password to something random. Since we can't be updating the other services every time we restart, let's override that with a fixed password, as follows:

  @Bean
  UserDetailsService userDetailsService() {
    return new InMemoryUserDetailsManager(
      User
        .withUsername("user")
        .password("password")
        .roles(&quot...