Article
In Java application security, the focus often falls on code-level vulnerabilities while configuration weaknesses remain a prevalent attack vector. Configuration Hardening is the process of securing an application's settings, dependencies, and runtime environment to minimize the attack surface. For Java applications, this involves systematically addressing security gaps in frameworks, servers, dependencies, and JVM settings to create a robust, defense-in-depth security posture.
What is Java Configuration Hardening?
Configuration hardening involves securing every configurable aspect of your Java application stack:
- JVM Security Settings: Memory, execution, and security manager configurations
- Framework Security: Spring Security, Jakarta EE, and microframework settings
- Server Configuration: Tomcat, Jetty, Undertow, and application server security
- Dependency Management: Secure dependency versions and vulnerability management
- Runtime Environment: Container, OS, and cloud platform security settings
JVM Security Hardening
1. Secure JVM Launch Parameters
Configure JVM for security-first operation:
# Secure JVM launch configuration java \ # Memory and execution settings -Xmx1024m -Xms512m \ -XX:MaxMetaspaceSize=256m \ -XX:ReservedCodeCacheSize=128m \ # Security manager and policy (if needed) -Djava.security.manager \ -Djava.security.policy==/app/conf/security.policy \ # Cryptographic strength configuration -Djava.security.properties=/app/conf/java.security \ -Djdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA \ -Djdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & usage TLSServer \ # RMI and serialization security -Dsun.rmi.dgc.server.gcInterval=3600000 \ -Dsun.rmi.dgc.client.gcInterval=3600000 \ -Djava.rmi.server.hostname=localhost \ # Logging and debugging security -Djava.awt.headless=true \ -Dlog4j2.formatMsgNoLookups=true \ # Application-specific settings -Dfile.encoding=UTF-8 \ -Duser.timezone=UTC \ -jar application.jar
2. Java Security Policy File
Create a restrictive security policy:
// security.policy
grant {
// Basic permissions for all code
permission java.util.PropertyPermission "user.timezone", "read";
permission java.util.PropertyPermission "file.encoding", "read";
permission java.util.PropertyPermission "java.io.tmpdir", "read";
// Application-specific permissions
permission java.io.FilePermission "/app/logs/-", "read,write";
permission java.net.SocketPermission "database.company.com:5432", "connect";
permission java.net.SocketPermission "redis.company.com:6379", "connect";
// Restrict dangerous permissions
permission java.lang.RuntimePermission "setFactory", "";
permission java.lang.RuntimePermission "setIO", "";
permission java.lang.Reflect.ReflectPermission "suppressAccessChecks", "";
// Deny critical permissions
permission java.io.FilePermission "<<ALL FILES>>", "read,write,execute,delete", deny;
permission java.net.SocketPermission "*:0-1023", "connect,accept,listen", deny;
permission java.lang.RuntimePermission "exitVM", "", deny;
};
Spring Framework Hardening
1. Spring Security Configuration
Implement comprehensive security controls:
@Configuration
@EnableWebSecurity
public class SecurityHardeningConfig {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
return http
// Disable dangerous features
.csrf(csrf -> csrf
.ignoringRequestMatchers("/api/public/**")
)
.headers(headers -> headers
.contentSecurityPolicy(csp -> csp
.policyDirectives("default-src 'self'; script-src 'self' 'unsafe-inline'"))
.httpStrictTransportSecurity(hsts -> hsts
.includeSubDomains(true)
.maxAgeInSeconds(31536000))
.frameOptions(frame -> frame
.deny())
.xssProtection(xss -> xss
.headerValue(XXssConfig.HeaderValue.ENABLED_MODE_BLOCK))
)
// Session management
.sessionManagement(session -> session
.sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
.sessionFixation(sf -> sf
.migrateSession())
.maximumSessions(1)
)
// Authorization
.authorizeHttpRequests(authz -> authz
.requestMatchers("/actuator/**").hasRole("ADMIN")
.requestMatchers("/api/admin/**").hasRole("ADMIN")
.requestMatchers("/api/user/**").hasRole("USER")
.requestMatchers("/public/**").permitAll()
.anyRequest().authenticated()
)
// Authentication
.formLogin(form -> form
.loginPage("/login")
.failureHandler(authenticationFailureHandler())
)
.logout(logout -> logout
.deleteCookies("JSESSIONID")
.invalidateHttpSession(true)
)
.build();
}
@Bean
public AuthenticationFailureHandler authenticationFailureHandler() {
return new CustomAuthenticationFailureHandler();
}
}
2. Spring Boot Application Properties Hardening
Secure application configuration:
# application-security.properties
# Server security
server.servlet.session.timeout=1800
server.servlet.session.cookie.http-only=true
server.servlet.session.cookie.secure=true
server.servlet.session.cookie.same-site=strict
server.port=8443
server.ssl.enabled=true
server.ssl.key-store=classpath:keystore.p12
server.ssl.key-store-password=${KEYSTORE_PASSWORD}
server.ssl.key-store-type=PKCS12
server.ssl.key-alias=tomcat
# Spring security
spring.security.oauth2.client.registration.provider.require-https=true
spring.security.filter.order=0
# Database security
spring.datasource.hikari.connection-timeout=30000
spring.datasource.hikari.maximum-pool-size=20
spring.datasource.hikari.validation-timeout=5000
spring.datasource.hikari.leak-detection-threshold=60000
# Actuator security
management.endpoints.web.exposure.include=health,info,metrics
management.endpoint.health.show-details=when_authorized
management.endpoints.web.base-path=/internal/actuator
management.server.port=9090
# Logging security
logging.pattern.console=%d{yyyy-MM-dd HH:mm:ss} - %logger{36} - %msg%n
logging.level.com.company.sensitive=OFF
# Jackson security
spring.jackson.default-property-inclusion=non_null
spring.jackson.deserialization.fail-on-unknown-properties=true
# File upload security
spring.servlet.multipart.max-file-size=10MB
spring.servlet.multipart.max-request-size=10MB
Tomcat Server Hardening
1. Embedded Tomcat Configuration
Harden embedded Tomcat in Spring Boot:
@Configuration
public class TomcatHardeningConfig {
@Bean
public TomcatServletWebServerFactory servletContainer() {
TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory();
tomcat.addConnectorCustomizers(connector -> {
// HTTP to HTTPS redirect
connector.setRedirectPort(8443);
connector.setScheme("https");
connector.setSecure(true);
// Connection hardening
connector.setAttribute("maxPostSize", 10485760); // 10MB
connector.setAttribute("maxSavePostSize", 4096);
connector.setAttribute("allowTrace", false);
});
// Add security valve
tomcat.addContextValves(securityValve());
// Error page configuration
tomcat.addErrorPages(new ErrorPage(HttpStatus.NOT_FOUND, "/error/404"));
tomcat.addErrorPages(new ErrorPage(HttpStatus.INTERNAL_SERVER_ERROR, "/error/500"));
return tomcat;
}
private Valve securityValve() {
return new RemoteAddrValve() {{
setAllow("127.0.0.1,::1,10.0.0.0/8");
setDenyStatus(404);
}};
}
}
2. server.xml Hardening (External Tomcat)
<!-- server.xml --> <Server port="8005" shutdown="SHUTDOWN"> <Listener className="org.apache.catalina.security.SecurityListener" /> <Service name="Catalina"> <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" minSpareThreads="25" maxHttpHeaderSize="8192" enableLookups="false" disableUploadTimeout="true" acceptCount="100" maxPostSize="10485760" maxSavePostSize="4096" allowTrace="false" server="Unknown" xpoweredBy="false"> <SSLHostConfig certificateVerification="false" protocols="TLSv1.2,TLSv1.3" ciphers="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,..."> </SSLHostConfig> </Connector> <Engine name="Catalina" defaultHost="localhost"> <Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="false"> <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="127\.0\.0\.1,::1,10\.\d+\.\d+\.\d+" /> <Valve className="org.apache.catalina.valves.ErrorReportValve" showReport="false" showServerInfo="false" /> </Host> </Engine> </Service> </Server>
Dependency Security Hardening
1. Maven Security Configuration
Secure dependency management:
<!-- pom.xml -->
<project>
<properties>
<!-- Enforce secure dependency versions -->
<log4j2.version>2.17.1</log4j2.version>
<jackson.version>2.13.4.2</jackson.version>
<spring-boot.version>2.7.8</spring-boot.version>
<!-- Security plugin versions -->
<owasp-dependency-check.version>7.4.4</owasp-dependency-check.version>
<spotbugs.version>4.7.3</spotbugs.version>
</properties>
<dependencyManagement>
<dependencies>
<!-- BOM imports for vulnerability management -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-dependencies</artifactId>
<version>${spring-boot.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<build>
<plugins>
<!-- OWASP Dependency Check -->
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
<version>${owasp-dependency-check.version}</version>
<executions>
<execution>
<goals>
<goal>check</goal>
</goals>
</execution>
</executions>
<configuration>
<failBuildOnAnyVulnerability>true</failBuildOnAnyVulnerability>
<suppressionFile>dependency-check-suppressions.xml</suppressionFile>
</configuration>
</plugin>
<!-- SpotBugs Security -->
<plugin>
<groupId>com.github.spotbugs</groupId>
<artifactId>spotbugs-maven-plugin</artifactId>
<version>${spotbugs.version}</version>
<configuration>
<effort>Max</effort>
<threshold>Low</threshold>
<includeFilterFile>spotbugs-security-include.xml</includeFilterFile>
</configuration>
</plugin>
</plugins>
</build>
</project>
2. Dependency Exclusion Policy
<!-- Ban vulnerable dependencies --> <plugin> <groupId>org.apache.maven.plugins</groupId> <artifactId>maven-enforcer-plugin</artifactId> <version>3.1.0</version> <executions> <execution> <id>ban-vulnerable-dependencies</id> <goals> <goal>enforce</goal> </goals> <configuration> <rules> <bannedDependencies> <excludes> <exclude>log4j:log4j:(,1.2.17]</exclude> <exclude>commons-collections:commons-collections:(,3.2.2]</exclude> <exclude>com.fasterxml.jackson.core:jackson-databind:[2.0.0,2.12.6.1)</exclude> </excludes> </bannedDependencies> <requireJavaVersion> <version>[17,18)</version> </requireJavaVersion> </rules> </configuration> </execution> </executions> </plugin>
Logging Security Hardening
1. Secure Logback Configuration
<!-- logback-spring.xml -->
<configuration>
<!-- Disable sensitive data logging -->
<conversionRule conversionWord="maskedMsg" converterClass="com.company.security.MaskingPatternLayout" />
<appender name="SECURE_FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
<file>logs/application.log</file>
<rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
<fileNamePattern>logs/application.%d{yyyy-MM-dd}.%i.log.gz</fileNamePattern>
<maxHistory>30</maxHistory>
<totalSizeCap>3GB</totalSizeCap>
</rollingPolicy>
<encoder>
<pattern>%d{yyyy-MM-dd HH:mm:ss} [%thread] %-5level %logger{36} - %maskedMsg%n</pattern>
</encoder>
</appender>
<!-- Prevent Log4Shell-type vulnerabilities -->
<logger name="org.apache.logging.log4j" level="WARN"/>
<!-- Sensitive package logging -->
<logger name="com.company.security" level="WARN"/>
<logger name="com.company.user" level="INFO"/>
<root level="INFO">
<appender-ref ref="SECURE_FILE" />
</root>
</configuration>
2. Log Masking Implementation
@Component
public class MaskingPatternLayout extends MessageConverter {
private static final List<Pattern> SENSITIVE_PATTERNS = Arrays.asList(
Pattern.compile("(\"password\"\\s*:\\s*\")([^\"]+)(\")", Pattern.CASE_INSENSITIVE),
Pattern.compile("(password=)([^&]+)", Pattern.CASE_INSENSITIVE),
Pattern.compile("(\\b\\d{16}\\b)"), // Credit card numbers
Pattern.compile("(\\b[\\w.%-]+@[\\w.-]+\\.[A-Z]{2,4}\\b)", Pattern.CASE_INSENSITIVE) // Email
);
@Override
public String convert(ILoggingEvent event) {
String message = event.getFormattedMessage();
return maskSensitiveData(message);
}
private String maskSensitiveData(String message) {
String masked = message;
for (Pattern pattern : SENSITIVE_PATTERNS) {
masked = pattern.matcher(masked).replaceAll("$1***$3");
}
return masked;
}
}
Container Security Hardening
1. Dockerfile Security
# Use minimal base image FROM eclipse-temurin:17-jre-alpine # Add security scanning USER root RUN apk add --no-cache clamav && freshclam # Create non-root user RUN addgroup -S appgroup && adduser -S appuser -G appgroup # Security configuration COPY security.policy /app/conf/security.policy COPY java.security /app/conf/java.security # Copy application COPY target/application.jar /app/application.jar COPY entrypoint.sh /app/entrypoint.sh # Set secure permissions RUN chown -R appuser:appgroup /app && \ chmod -R 750 /app && \ chmod 400 /app/conf/*.policy && \ chmod 500 /app/entrypoint.sh # Security labels LABEL security.scan.enabled="true" \ security.policy.version="1.0" \ maintainer="[email protected]" # Switch to non-root user USER appuser # Secure entrypoint ENTRYPOINT ["/app/entrypoint.sh"] # Health check HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \ CMD curl -f http://localhost:8080/actuator/health || exit 1
2. Secure Entrypoint Script
#!/bin/sh # entrypoint.sh set -e # Validate environment variables if [ -z "$KEYSTORE_PASSWORD" ]; then echo "KEYSTORE_PASSWORD environment variable is required" exit 1 fi # Set secure umask umask 0027 # Run application with security settings exec java \ -Djava.security.manager \ -Djava.security.policy==/app/conf/security.policy \ -Djava.security.properties==/app/conf/java.security \ -Djdk.tls.disabledAlgorithms="SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA" \ -Dlog4j2.formatMsgNoLookups=true \ -jar /app/application.jar
Runtime Security Monitoring
1. Security Event Monitoring
@Component
public class SecurityEventMonitor {
private static final Logger securityLogger = LoggerFactory.getLogger("SECURITY");
@EventListener
public void handleAuthenticationEvent(AbstractAuthenticationEvent event) {
if (event instanceof AuthenticationSuccessEvent) {
securityLogger.info("Authentication success: {}",
event.getAuthentication().getName());
} else if (event instanceof AuthenticationFailureBadCredentialsEvent) {
securityLogger.warn("Authentication failure: {}",
((AuthenticationFailureBadCredentialsEvent) event).getException().getMessage());
}
}
@EventListener
public void handleAuthorizationEvent(AuthorizationEvent event) {
if (!event.isGranted()) {
securityLogger.warn("Authorization denied: {} for {}",
event.getAuthentication().getName(),
event.getSource());
}
}
}
2. Configuration Validation
@Component
public class SecurityConfigurationValidator {
@EventListener
public void validateConfiguration(ApplicationReadyEvent event) {
checkTlsConfiguration();
checkPasswordStrength();
checkSessionSecurity();
}
private void checkTlsConfiguration() {
String disabledAlgorithms = Security.getProperty("jdk.tls.disabledAlgorithms");
if (!disabledAlgorithms.contains("TLSv1") || !disabledAlgorithms.contains("TLSv1.1")) {
throw new SecurityConfigurationException("Insecure TLS protocols are enabled");
}
}
private void checkPasswordStrength() {
String password = environment.getProperty("spring.datasource.password");
if (password != null && password.length() < 12) {
throw new SecurityConfigurationException("Database password is too weak");
}
}
}
Best Practices for Java Configuration Hardening
- Principle of Least Privilege: Run applications with minimal required permissions
- Defense in Depth: Implement multiple layers of security controls
- Secure Defaults: Configure security settings explicitly rather than relying on defaults
- Continuous Validation: Regularly audit and validate security configurations
- Secret Management: Never store secrets in configuration files; use secure secret management
- Automated Security Testing: Integrate security checks into CI/CD pipelines
- Regular Updates: Keep dependencies and frameworks updated with security patches
Security Configuration Checklist
- [ ] JVM security manager enabled
- [ ] TLS 1.0/1.1 disabled
- [ ] Secure cryptographic algorithms configured
- [ ] Non-root user for application execution
- [ ] Session timeout configured
- [ ] CSRF protection enabled
- [ ] Security headers configured
- [ ] Dependency vulnerability scanning implemented
- [ ] Secure logging configured
- [ ] Error messages sanitized
- [ ] File upload restrictions configured
Conclusion
Java configuration hardening is a critical aspect of application security that addresses vulnerabilities beyond code-level issues. By systematically securing JVM settings, framework configurations, server setups, and runtime environments, organizations can significantly reduce their attack surface and build resilient applications.
The comprehensive approach to configuration hardening—covering everything from JVM security policies to container runtime settings—ensures that Java applications are protected against common configuration-based attacks. In today's threat landscape, where attackers increasingly target configuration weaknesses, implementing robust hardening practices is not just a security best practice but a business imperative for any organization running Java applications in production.
Advanced Java Supply Chain Security, Kubernetes Hardening & Runtime Threat Detection
Sigstore Rekor in Java – https://macronepal.com/blog/sigstore-rekor-in-java/
Explains integrating Sigstore Rekor into Java systems to create a transparent, tamper-proof log of software signatures and metadata for verifying supply chain integrity.
Securing Java Applications with Chainguard Wolfi – https://macronepal.com/blog/securing-java-applications-with-chainguard-wolfi-a-comprehensive-guide/
Explains using Chainguard Wolfi minimal container images to reduce vulnerabilities and secure Java applications with hardened, lightweight runtime environments.
Cosign Image Signing in Java Complete Guide – https://macronepal.com/blog/cosign-image-signing-in-java-complete-guide/
Explains how to digitally sign container images using Cosign in Java-based workflows to ensure authenticity and prevent unauthorized modifications.
Secure Supply Chain Enforcement Kyverno Image Verification for Java Containers – https://macronepal.com/blog/secure-supply-chain-enforcement-kyverno-image-verification-for-java-containers/
Explains enforcing Kubernetes policies with Kyverno to verify container image signatures and ensure only trusted Java container images are deployed.
Pod Security Admission in Java Securing Kubernetes Deployments for JVM Applications – https://macronepal.com/blog/pod-security-admission-in-java-securing-kubernetes-deployments-for-jvm-applications/
Explains Kubernetes Pod Security Admission policies that enforce security rules like restricted privileges and safe configurations for Java workloads.
Securing Java Applications at Runtime Kubernetes Security Context – https://macronepal.com/blog/securing-java-applications-at-runtime-a-guide-to-kubernetes-security-context/
Explains how Kubernetes security contexts control runtime permissions, user IDs, and access rights for Java containers to improve isolation.
Process Anomaly Detection in Java Behavioral Monitoring – https://macronepal.com/blog/process-anomaly-detection-in-java-comprehensive-behavioral-monitoring-2/
Explains detecting abnormal runtime behavior in Java applications to identify potential security threats using process monitoring techniques.
Achieving Security Excellence CIS Benchmark Compliance for Java Applications – https://macronepal.com/blog/achieving-security-excellence-implementing-cis-benchmark-compliance-for-java-applications/
Explains applying CIS security benchmarks to Java environments to standardize hardening and improve overall system security posture.
Process Anomaly Detection in Java Behavioral Monitoring – https://macronepal.com/blog/process-anomaly-detection-in-java-comprehensive-behavioral-monitoring/
Explains behavioral monitoring of Java processes to detect anomalies and improve runtime security through continuous observation and analysis.