Hardening SpringBoot's embedded Tomcat

user_804063 0
Viewed 2027

New to Tomcat and SpringBoot

I need to make sure the embedded Tomcat in SpringBoot is hardened to a certain level. I'm using this CIS doc (you'll have to dl the pdf) as a checklist on what we may want to do. However, the doc is geared toward a "normally installed" Tomcat. For example, I'm directed to update a file(s) found in $CATALINA_HOME.

Does SpringBoot offer a way to fully control/access it's embedded Tomcat? If not, is it possible and reasonable to configure Tomcat externally from SpringBoot then override the default SpringBoot Tomcat with my own? I'm open to other solutions too.

spring-boot tomcat
1 Answers

If you have to follow that guide to the letter, the easiest way is going to be packaging the spring boot app as a WAR and deploying it in a regular Tomcat server. This guide explains how to package an app as a war.

Tomcat is a pretty complicated piece of software when you start opening it up. You can write java code that can access Tomcat's configuration and set the config settings yourself. In addition, tomcat is broken up into a number of components, and some of those files you need to modify may be for a component that is not part of spring boot's embedded tomcat.

You can harden spring boot apps, but the job will be easier if you follow the guide.

user_23920870
Related