Skip to content

Require a secret for stop requests on the admin port - #3087

Open
rzo1 wants to merge 1 commit into
mainfrom
admin-daemon-stop-secret
Open

rzo1 wants to merge 1 commit into
mainfrom
admin-daemon-stop-secret

Conversation

@rzo1

@rzo1 rzo1 commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

The standalone OpenEJB admin daemon (port 4200) stopped the whole server on a single unauthenticated byte. Stop requests now need a per-start random secret, written owner-only to conf/admin-shutdown.secret, or a fixed one via openejb.admin.shutdown.secret; openejb stop, RemoteServer (tomee-maven-plugin with useOpenEJB) and RemoteTestServer send it automatically. Setting openejb.admin.shutdown.secret.required=false restores the old behaviour, which should go into the release notes. TomEE distributions do not run the admin service and are not affected.

Any local process could stop the standalone server with a single byte.
The in-tree stop clients now send the secret the server writes.
@rzo1 rzo1 self-assigned this Oct 9, 2026
@rzo1
rzo1 requested a review from jungm October 9, 2026 09:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant