[JuliusHenke]

Summary

Admin (actuator) access is now configured only via TORMAP_ADMIN_PASSWORD, and HTTP Basic is scoped to the actuator.

• SecurityConfig: drop the TORMAP_ADMIN_PASSWORD_BCRYPT env var and the BCrypt-hash passthrough (isBcrypt). TORMAP_ADMIN_PASSWORD is always treated as plaintext and BCrypt-hashed in memory at startup.
• Logs a warning if TORMAP_ADMIN_PASSWORD_BCRYPT is still set, so a stale deployment does not silently lose admin access, and if the admin password is shorter than 16 characters.
• SecurityConfig: split the single filter chain in two:
  • actuator chain (securityMatcher("/actuator/**")): role ADMIN via HTTP Basic, CSRF (double-submit cookie) on unsafe methods, no CORS. GET endpoints remain viewable in a browser, which prompts for the credentials.
  • public chain: explicit allow list, everything else denied, CORS for the frontend, CSRF disabled (no authentication, sessions or cookies).
  • shared: stateless sessions and security headers.
• Paths outside the allow list now answer 403 instead of 401.
• SecurityRulesTest/SecurityConfigTest: updated for the two chains, plus tests that public paths ignore Authorization: Basic headers and that the actuator sends a Basic WWW-Authenticate challenge.
• AGENTS.md: replace the blanket csrf.disable ban with "keep CSRF protection on the actuator chain".
• backend/README.md: remove the BCrypt variable and htpasswd instructions; document the 16-character minimum, browser access to the actuator and restricting /actuator at the reverse proxy.
• THREAT_MODEL.md: update the secrets asset, the HTTP Basic boundary and the SecurityConfig control.

Deployment notes

• If you set TORMAP_ADMIN_PASSWORD_BCRYPT, replace it with TORMAP_ADMIN_PASSWORD set to the plaintext password (from your secret manager). The old variable is ignored and only produces a warning.
• If TORMAP_ADMIN_PASSWORD currently contains a BCrypt hash ($2a$/$2b$/$2y$), it was previously used as a hash. It is now treated as the literal password, so set it to the plaintext password instead.
• Use an admin password of at least 16 characters.
• Monitoring that expects 401 for unknown paths now gets 403. /actuator/** still answers 401 without credentials.

Testing

Could not build locally in this environment (only JDK 21 available vs. required 25, no Docker for Testcontainers, Maven Central rate-limited). Relying on CI (backend-test.yml).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y3c91UZ2YrQCJkppXzg6CZ

[JuliusHenke]

code/snyk (JuliusHenke) errored with "Code test limit reached". That's the Snyk org's Snyk Code test quota running out, not a finding in this diff, so there's nothing to fix in code here. Re-running it needs the quota to reset or a maintainer to retrigger it in Snyk; I can't do either from here. security/snyk passed. The backend CI is still running.

---

Generated by Claude Code

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}