fix(security): fail closed Config Server reads by default

[seonghobae]

Purpose

Advance #193 from exact protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 without inventing credentials. Protected Config Server allowed anonymous configuration reads. This direct-develop Draft establishes a narrower reference-only fail-closed default: health/info may remain intentionally public, while configuration-resource and every other application request is denied until a separately reviewed deployment-owned service identity exists.

This is path-disjoint from #189's outbound Git repository authority (application.yml) and #207's bootstrap/Javadoc lane. It does not invent a repository URI, username/password, certificate, issuer, client secret, Eureka identity, service mesh, or production authentication mechanism.

Exact current identity

• protected/live base: develop@622e5e6c3d534f230c390f10e3832efadfc01825;
• branch: security/config-server-reference-deny-622e5e6;
• fail-first source head: e5a43a723b934e67eeb11efe4403167a836094cf;
• exact current source head: c1772ad52cf6d59dd6977de82c2c44010e5cda3e;
• current GitHub merge preview: 350bc625edca5111200947501dc657e73ad6bacf;
• Draft: true;
• GitHub mergeability: true;
• formal reviews: none;
• unresolved inline review threads: zero.

Every predecessor-head check/review is historical and does not transfer.

RED — anonymous configuration reads were reachable

ConfigServerInboundSecurityTest was added before production security changed. It boots the real Config Server with the maintained native backend, requests /application/default and /actuator/health through the embedded web server, and requires 403 Forbidden for the anonymous configuration read while health remains 200 OK.

CI run 31367339613, macOS job 93388478026, checked out synthetic integration revision 9bc86a311a212b6202385d8bf23b9abf4da9fe39 (Merge e5a43a7... into 622e5e6...). ETL and CDC completed successfully, the Config Server application booted normally, and exactly the new Config Server test failed with zero test errors/skips:

expected: <403 FORBIDDEN> but was: <200 OK>.

This is valid RED at the intended inbound HTTP security boundary rather than setup/import/fixture/dependency failure. It remains synthetic-merge development evidence, not literal-source acceptance proof.

GREEN — credential-free fail-closed reference posture

Exact current source c1772ad52cf6d59dd6977de82c2c44010e5cda3e applies the smallest repository-owned correction:

• adds the maintained Spring Boot Security starter only to config-server;
• adds a Config Server-local SecurityFilterChain;
• permits only /actuator/health, /actuator/health/**, and /actuator/info;
• denies every other request;
• disables accidental Basic, form-login, logout, and CSRF surfaces for this credential-free reference-only posture;
• adds beginner-readable Javadoc explaining that a future authenticated production profile requires a separate deployment-owned identity contract;
• preserves fix(config): require explicit Config Server repository authority #189 repository selection, Config Server bootstrap behavior, and all external identity decisions.

No caller header is trusted as identity and no credential or trust root is embedded in source.

Exact-current-head hosted evidence

All exposed workflow aggregates associated with exact current source head c1772ad52cf6d59dd6977de82c2c44010e5cda3e are terminal-success:

• CI 31367570306: success;
• Dependency Review 31367570295: success;
• CycloneDX SBOM 31367570290: success;
• SAST Semgrep 31367570238: success;
• Security Scan 31367570211: success.

These results are not protected-merge authorization. Current protected PR workflows still execute GitHub synthetic merge revisions rather than accepted literal source; protected coverage evidence remains incomplete/non-vacuous only after #162/#164/#205 or equivalent accepted controls; #196 separately owns Maven dependency-resolution completeness; and no qualifying independent non-author formal approval exists.

Product/security boundary

This PR does not close #193's production service-identity decision. It makes the repository default safe while Config Server remains reference-only. A supported authenticated mode still needs an independently reviewed contract for identity issuance, rotation/revocation, application/profile/label authorization, TLS/provenance, degraded behavior, standalone/MSA deployment, and secret-safe audit/observability. Do not weaken this deny-by-default posture merely to make Config Server usable without that evidence.

Merge boundary

Keep Draft. Merge only when the unchanged exact source head has accepted literal-source deterministic/security evidence, complete same-revision dependency/vulnerability evidence, non-vacuous applicable owned-production coverage, zero valid unresolved findings, current canonical traceability, every live required gate, and qualifying independent non-author approval where governance requires it. No predecessor-head, synthetic-merge-only, incomplete-scanner, status-only, skipped-required, or other-PR evidence transfers.

Summary by CodeRabbit

• 보안

  • Config Server에 접근 제어가 적용되었습니다.
  • 설정 조회를 포함한 일반 요청은 인증 없이 접근할 수 없습니다.
  • 헬스 상태 및 서비스 정보 확인 엔드포인트는 인증 없이 사용할 수 있습니다.
  • 폼 로그인, 로그아웃, HTTP Basic 인증 및 CSRF 처리가 비활성화되었습니다.

• 테스트

  • 비인증 설정 조회 요청이 403 Forbidden을 반환하는지 검증합니다.
  • 헬스 엔드포인트가 정상적으로 200 OK를 반환하는지 확인합니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4f97dca0-946d-4990-80c8-c087f652c01c

📥 Commits

Reviewing files that changed from the base of the PR and between 622e5e6 and c1772ad.

📒 Files selected for processing (3)

• config-server/pom.xml
• config-server/src/main/java/com/xtrmetl/config/ConfigServerSecurityConfiguration.java
• config-server/src/test/java/com/xtrmetl/config/ConfigServerInboundSecurityTest.java

---

📝 Walkthrough

Walkthrough

Config Server에 Spring Security를 추가했습니다. 설정 조회 요청은 인증 없이 거부하고, 지정된 Actuator health 및 info 엔드포인트만 공개합니다. 통합 테스트는 설정 조회의 403 FORBIDDEN과 health 요청의 200 OK를 검증합니다.

Changes

Config Server 보안

Layer / File(s)	Summary
보안 경계 구성 config-server/pom.xml, config-server/src/main/java/com/xtrmetl/config/ConfigServerSecurityConfiguration.java	Spring Security 의존성을 추가했습니다. CSRF, HTTP Basic, 폼 로그인, 로그아웃을 비활성화했습니다. health 및 info Actuator 엔드포인트만 인증 없이 허용하고 나머지 요청은 거부합니다.
인바운드 보안 통합 검증 config-server/src/test/java/com/xtrmetl/config/ConfigServerInboundSecurityTest.java	Native Config Server를 임의 포트로 실행합니다. 익명 설정 조회는 403 FORBIDDEN, /actuator/health는 200 OK를 반환하는지 검증합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant ConfigServerSecurityConfiguration
  participant ConfigServer
  Client->>ConfigServerSecurityConfiguration: 설정 조회 요청
  ConfigServerSecurityConfiguration->>ConfigServer: 요청 거부
  ConfigServer-->>Client: 403 FORBIDDEN
  Client->>ConfigServerSecurityConfiguration: /actuator/health 요청
  ConfigServerSecurityConfiguration->>ConfigServer: 요청 허용
  ConfigServer-->>Client: 200 OK

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	[#193]의 참조 전용 fail-closed 범위는 구현했지만, 인증된 읽기 경로와 권한 범위 등 핵심 프로덕션 요구사항은 충족하지 않습니다.	프로덕션 지원을 주장하기 전에 배포 소유 서비스 인증, 범위 권한, 수명주기, TLS, 감사, 문서화 및 관련 검증을 추가하십시오.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 Config Server 읽기 요청을 기본적으로 fail-closed 처리하는 주요 변경을 정확하고 간결하게 설명합니다.
Out of Scope Changes check	✅ Passed	의존성 추가, 보안 설정, 통합 테스트는 PR 목표와 직접 관련되며 식별된 범위 외 변경은 없습니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/config-server-reference-deny-622e5e6

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.