diff --git a/layout-server/pom.xml b/layout-server/pom.xml
index 9ae3cf8e5..c4d32d48b 100644
--- a/layout-server/pom.xml
+++ b/layout-server/pom.xml
@@ -39,6 +39,10 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-data-jpa</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
         <dependency>
             <groupId>com.h2database</groupId>
             <artifactId>h2</artifactId>
diff --git a/layout-server/src/main/java/org/finos/vuu/layoutserver/CorsConfig.java b/layout-server/src/main/java/org/finos/vuu/layoutserver/config/CorsConfig.java
similarity index 94%
rename from layout-server/src/main/java/org/finos/vuu/layoutserver/CorsConfig.java
rename to layout-server/src/main/java/org/finos/vuu/layoutserver/config/CorsConfig.java
index 5637db23f..547dd4054 100644
--- a/layout-server/src/main/java/org/finos/vuu/layoutserver/CorsConfig.java
+++ b/layout-server/src/main/java/org/finos/vuu/layoutserver/config/CorsConfig.java
@@ -1,4 +1,4 @@
-package org.finos.vuu.layoutserver;
+package org.finos.vuu.layoutserver.config;
 
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.servlet.config.annotation.CorsRegistry;
diff --git a/layout-server/src/main/java/org/finos/vuu/layoutserver/config/SecurityConfig.java b/layout-server/src/main/java/org/finos/vuu/layoutserver/config/SecurityConfig.java
new file mode 100644
index 000000000..8c27e53cf
--- /dev/null
+++ b/layout-server/src/main/java/org/finos/vuu/layoutserver/config/SecurityConfig.java
@@ -0,0 +1,19 @@
+package org.finos.vuu.layoutserver.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.web.SecurityFilterChain;
+
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        http.requiresChannel().anyRequest().requiresSecure();
+        return http.build();
+    }
+
+}