See Main Servlet on how to protect this servlet.
spring.remoting.servlet.hosts.allowed=127.0.0.1,SERVER_IP spring.remoting.servlet.https.required=false