Kingdom: Security Features

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Spring Boot Misconfiguration: DevTools Enabled

Java/JSP

Abstract

The Spring Boot application is configured in developer mode.

Explanation

The Spring Boot application has DevTools enabled. DevTools include an additional set of tools which can make the application development experience a little more pleasant, but DevTools are not recommended to use on applications in a production environment. As stated in the official Spring Boot documentation: "Enabling spring-boot-devtools on a remote application is a security risk. You should never enable support on a production deployment."

References

[1] Spring Boot Reference Guide Spring

[2] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[3] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[4] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[5] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[6] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[7] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[8] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[9] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 2.2.6

[10] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 2.2.6

[11] Standards Mapping - Web Application Security Consortium Version 2.00 Application Misconfiguration (WASC-15)

desc.config.java.spring_boot_misconfiguration_devtools_enabled