In March 2021, I observed troubling behavior in multiple applications I supported that are built using Spring Boot: they would occasionally stop responding. Eventually, I tracked down the root cause to a DoS (Denial of Service) vulnerability in Spring Security OAuth 2.0: a simple shell script could take down any affected web application. Respecting the … Continue reading Identifying, Reporting, and Fixing CVE-2021-22119: DoS Vulnerability in Spring Security OAuth 2.0
Keycloak is an open source Identity and Access Management (IAM) solution that’s easy to run in Docker using a Configuration as Code (CAC) strategy enabling a workflow where a git source control repository can be cloned by a developer who can run one non-interactive script that starts Keycloak and gets it into a consistent state … Continue reading Users and Client Secrets in Keycloak Realm Exports
Cypress is a great testing framework for “anything that runs in a browser” allowing for clean, maintainable end to end tests. However, these tests can difficult and annoying to for developers to run, especially those who aren’t front end specialists. The following covers getting existing Cypress tests integrated and easily running within the Gradle-based build … Continue reading Cypress Testing Integrated with Gradle and Spring Boot
JavaMelody is a web based monitoring tool frequently run in production environments, providing insights including CPU usage, hot spots in code, database connection pool utilization, and more. I’m always on the lookout for ways to improve security, so when a security scan pointed out that the JavaMelody web interface didn’t have a Content Security Policy … Continue reading Contributing Improved Security to JavaMelody with Content Security Policy
While running Lighthouse CI on GitLab CI, I came across a problem: Lighthouse CI wants information about the current git commit, but it couldn’t get all of that information. In that case, Lighthouse CI falls back to running the git command; however, in my docker images, I don’t have git installed nor did I want to do so. So, I set out to fix this shortcoming in both Lighthouse and GitLab by adding the necessary environment variable to GitLab CI and having Lighthouse use it. The result is that I submitted a PR to Lighthouse that was merged and included in Lighthouse CI 0.7.1 and an MR to GitLab that was merged and included in GitLab 13.11. Now users (including my future self) will have a smooth, Just Works™ experience with these two tools.
I discovered a bug in how Java handles file paths on Windows that has existed for 22 years. I reported the bug, JDK-8262277, then I submitted a pull request fixing the bug which got accepted. I also submitted pull requests to Spring (which were accepted for version 5.3.5) working around the bug so users of … Continue reading Fixing a Bug in Java
Organizations already automate running builds, executing tests, and performing deployments to free developers from tedium and improve reliability. The next step is to use automation to improve projects. Tools (bots) can submit pull requests that fix typos, optimize images, and more. I’ve had a great positive experience using a bot to perform the tedious task … Continue reading The How and Why Automating Dependency Updates
Java is supposed to be “write once, run anywhere” but in practice, there are always platform differences that can and do result in bugs. For that reason, and because in general it’s a good idea to test as much as possible, it’s nice to run tests (even for Java applications) on multiple platforms. As evidence … Continue reading Testing a Java application on Windows without Windows
java-httpclient-webclient-spring-boot-starter is a library that I created to provide a quick and easy way to use Java 11’s HttpClient as Spring’s WebClient’s client HTTP connector. If you’re using Spring Boot 2.3 or later, it’s worth checking out.