spring-cloud / spring-cloud/spring-cloud-config
Config Server is giving 200 response for non-existing repos
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 2k
- Forks
- 1.3k
- Avg merge
- 2d 59m
- Merged PRs (30d)
- 16
Description
We have a config server setup using git backend which is working fine. However config server is giving 200 response for any arbitrary url instead of 404 Not found. This is causing issues with our security team when they scan our application. For example when we query
configserver url/application/owa_util.listprint(any junk) here we are getting following resposne
{
"name" : "",
"profiles" : [ "owa_util.listprint" ],
"label" : null,
"version" : "55ebd770c77b8aab100bbb5fb92624f9e74de4b7",
"state" : null,
"propertySources" : [ ]
}
I have gone through the source code and searched in spring-configuration-metadata.json but could not find a property to disable it. Hence filing it as bug. Apologies in advance if it is not a bug and there is a property to disable it.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the arbitrary repository request against the config server and trace the relevant server endpoint through the source. Review spring-configuration-metadata.json for any existing setting, then identify the request handling and response behavior; done means a nonexistent repository or profile returns 404 rather than an empty 200 response.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git, java, spring, spring-boot
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100