How to Disable Security in Spring Cloud Config: A Step‑by‑Step Guide

Why You Might Want to Disable Security in Spring Cloud Config

Spring Cloud Config is often deployed in development or internal testing environments where quick access to configuration data is more valuable than strict security. Disabling security can reduce friction for local developers, CI pipelines, or automated testing tools. However, it also opens your configuration repository to anyone who can reach the server, so it should only be done in trusted networks or with additional safeguards.

Prerequisites and Risks

Before turning off security, ensure:

• Your network is isolated (e.g., behind a corporate firewall or using VPN).
• No sensitive data (API keys, passwords) is stored in plain text in the config repository.
• All clients that consume the config server are also secured or run in trusted environments.

Disabling security exposes the server to potential unauthorized reads and writes, which could compromise downstream services.

Method 1: Using Spring Security Configuration

If you have Spring Security on the classpath, you can override the default configuration to permit all requests:

Step 1 – Add a Security Configuration Class

Create a class that extends WebSecurityConfigurerAdapter (or uses the newer SecurityFilterChain bean in Spring Security 5.7+). For example:

import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.web.SecurityFilterChain;

@Configuration public class ConfigServerSecurityConfig { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.authorizeHttpRequests(authz -> authz.anyRequest().permitAll()); http.csrf().disable(); return http.build(); } }

With this bean in the classpath, Spring Cloud Config will no longer enforce authentication.

Step 2 – Ensure No Other Security Beans Exist

Remove or exclude any other security auto‑configuration classes that might re‑enable authentication.

Method 2: Using application.yml Properties

Spring Cloud Config provides a property to disable security entirely. Add the following to application.yml or application.properties in the Config Server:

spring.security.enabled: false

Or, if you prefer the newer property name:

spring.cloud.config.server.security.enabled: false

After restarting the server, authentication will be disabled.

Method 3: Running in Docker Without Security

If you are using the official Spring Cloud Config Docker image, you can pass the property as an environment variable:

docker run -p 8888:8888 -e SPRING_SECURITY_ENABLED=false springcloudconfig/config-server:latest

This is convenient for local dev or CI pipelines.

Verifying Security Is Disabled

To confirm, make a simple HTTP GET request to the config server without credentials:

curl http://localhost:8888/your-app/default

You should receive a JSON payload of configuration values. If you receive a 401 Unauthorized, security is still active.

Re‑Enabling Security When Needed

To restore security, remove the custom configuration class or set the property back to true. Then configure a user store (e.g., in-memory, JDBC, LDAP) and provide the necessary credentials to clients.

Best Practices for a Secure Development Workflow

Even in development, consider:

• Using application-dev.yml that contains only non‑secret values.
• Encrypting sensitive properties with Spring Cloud Vault or Jasypt.
• Running the config server inside a Docker network that only local services can reach.

Common Pitfalls and Troubleshooting

Problem: After disabling security, clients still fail to fetch config.

Cause: Clients are still configured to use basic authentication or a token. Update their configuration to remove the authentication details.

Problem: Security is re‑enabled after a restart.

Cause: A newer dependency pulls in Spring Security auto‑configuration. Explicitly exclude it in your pom.xml or build.gradle:

<dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-config-server</artifactId> <exclusions> <exclusion> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </exclusion> </exclusions> </dependency>

Conclusion

Disabling security in Spring Cloud Config is straightforward but should be done with caution. By following the steps above, you can quickly unlock configuration access for trusted environments while maintaining the option to re‑enable authentication when your deployment expands.