SQL injection was described publicly in 1998. It has been in the OWASP Top Ten since the OWASP Top Ten existed. The fix is well understood, cheap, and built into every database driver in common use.
But but but…. it’s still breaching companies today, 20+ years later
This isn’t a hard vulnerability to understand or an expensive one to fix. The question worth asking isn’t “what is SQL injection”. It’s “why does a solved problem keep shipping to prod”.
Every team solves secrets the same way, in the same order. First they’re in the repo in plaintext, because it’s day one and there’s one API key (but I hope that by now you know better!). Then someone notices, and they move to environment variables set by hand on the server. Then there are four servers and nobody knows which one has the current value. Then it’s a shared password manager, and deploys involve copy-pasting out of it.
Kubernetes health probes have just become first class citizens in Spring Boot! Just before the release of Spring Boot 2.3, this article appeared on the Spring blog. These are awesome news because now you can leverage the framework and remove all that custom logic for liveness and readiness checks you have written in the past. In this post, let’s see how you can setup this feature in your application.
For this tutorial, create a simple spring boot web application that fetches some products. We will create a Product domain entity:
Often times, you will run into obscure errors that require you to take a peek under the JVM hood, which in itself can be a daunting task. In this tutorial, we will take a look on how to troubleshoot a running application in a Kubernetes cluster with VisualVM as well as how to inspect Heap Dumps and how to pass them from the container to our machine.
For this example, we have a Hello Spring Boot Application (the code can be found here) that saves a timestamp of each request in memory (in order to provide us some interesting data for us to analyze later on). We will be working hands on with VisualVM so make sure to download it and start it up, it is very straightforward and here is the link. One could also use JConsole for such a task but let’s leave that for some other time.
Why would you want to auto-generate MySQL tables on startup with Spring Data? A lot of times, I will run into a project and see this “smart” way to automate schema and table creation where there is either a sidecar that executes a bash script or even worse, have it in the Dockerfile. As tempting as that hack is, it is totally unnecessary as we have everything we need to do that with out of the box. This is very useful setup as you want your applications to be self sufficient and don’t have to worry about making changes at two places (application and the database).
There will be times when debugging on your local machine just won’t do it due to configs, environments, etc… In that case, wouldn’t it be great you can actually remote debug your Spring Boot app running in your Kubernetes cluster? In this tutorial, we’ll take a look at a pretty straightforward way in debugging Spring applications on Kubernetes. There are certain times when you want to do this, as you might have an integrated K8s setup, with ConfigMaps, Secrets and other services.