title: Best practice for deploying spring boot application on Amazon
body: <p>I've devloped a chat bot application using the Facebook <a href="https://developers.facebook.com/docs/messenger-platform" rel="nofollow">Messenger platform</a>.
  I used <a href="http://spring.io/guides/gs/actuator-service/" rel="nofollow">Spring Boot</a> with embedded Tomcat for the web platform.
  The application should run on Amazon aws, open to the WWW, and to be used as a webhook for recieving callbacks from Messenger over https.</p>
  
  <p>I need an advice how to secure the application, so it won't be hacked or flooded with requests that are not coming from Facebook.</p>
  
  <p>I thought to make the application require secured (ssl) connection, but using the "security.require_ssl=true" in application.properties didn't do the work. Perhaps I don't know what is the meaning of this and how to configure it propertly.
  Is there a best practice how to block requests which are not https requests? Or a way to block requests which are coming outside Messenger in the application level?</p>
  
  <p>Thank you very much!</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>In the meantime, I blocked requests from other IPs in application layer using the handler interceptor:</p>
  
  <pre><code>@Configuration
  public class MyWebApplicationInitializer implements WebApplicationInitializer, WebMvcConfigurer{
  
  
      @Override
      public void addInterceptors(InterceptorRegistry registry) {
          registry.addInterceptor(new HandlerInterceptor() {
  
              @Override
              public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
                      throws Exception {
                  if (! (request.getRemoteAddr().equals("173.252.88.66") || request.getRemoteAddr().equals("127.0.0.1")|| request.getRemoteAddr().equals("0:0:0:0:0:0:0:1"))){
                      logger.warn("Request is not coming from authorized remote address: " + request.getRemoteAddr()+". Rejecting");
                      response.getWriter().write("Unauthorized Address");
                      response.setStatus(401);
                      return false;
                  } else {
                      return true;
                  }
              }
  
  }
  </code></pre>