mirror of
https://github.com/hedgedoc/hedgedoc.git
synced 2024-09-19 23:48:57 -04:00
config: Add a flag to control the /metrics and /status endpoints
It can be a security concern in some environments to expose system capabilities even though they don't expose any PII. Add some flags (defaulted `true` to maintain existing behaviour) to control whether the /metrics and /status (and anything in the StatusRouter) are exposed. Signed-off-by: Stéphane Maniaci <stephane.maniaci@beta.gouv.fr>
This commit is contained in:
Stéphane Maniaci
Philip Molares
parent
e5a8a3b041
commit
d10ead4c6c
5 changed files with 48 additions and 21 deletions
18
app.js
18
app.js
|
|
@ -75,8 +75,10 @@ app.use(morgan('combined', {
|
|||
}))
|
||||
|
||||
// Register prometheus metrics endpoint
|
||||
app.use(apiMetrics())
|
||||
metrics.setupCustomPrometheusMetrics()
|
||||
if (config.observability.exposeMetrics) {
|
||||
app.use(apiMetrics())
|
||||
metrics.setupCustomPrometheusMetrics()
|
||||
}
|
||||
|
||||
// socket io
|
||||
const io = require('socket.io')(server, { cookie: false })
|
||||
|
|
@ -226,7 +228,17 @@ app.locals.enableGitHubGist = config.isGitHubEnable
|
|||
app.locals.enableGitlabSnippets = config.isGitlabSnippetsEnable
|
||||
|
||||
app.use(require('./lib/web/baseRouter'))
|
||||
app.use(require('./lib/web/statusRouter'))
|
||||
|
||||
if (config.observability.exposeStatus) {
|
||||
app.use(require('./lib/web/statusRouter'))
|
||||
} else {
|
||||
// the `/status` route is used by the hedgedoc container's
|
||||
// healtcheck route so keep the endpoint alive
|
||||
app.get('/status', function (req, res, next) {
|
||||
res.sendStatus(200)
|
||||
})
|
||||
}
|
||||
|
||||
app.use(require('./lib/web/auth'))
|
||||
app.use(require('./lib/web/historyRouter'))
|
||||
app.use(require('./lib/web/userRouter'))
|
||||
|
|
|
|||
|
|
@ -76,24 +76,28 @@ these are rarely used for various reasons.
|
|||
|
||||
## Web security aspects
|
||||
|
||||
| config file | environment | **default** and example value | description |
|
||||
| ----------------------------- | ------------------------------ | ------------------------------------------------------------------------------------------| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `hsts` | | `{"enable": true, "maxAgeSeconds": 31536000, "includeSubdomains": true, "preload": true}` | [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) options to use with HTTPS (default is the example value, max age is a year) |
|
||||
| | `CMD_HSTS_ENABLE` | **`true`** or `false` | set to enable [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) if HTTPS is also enabled (default is ` true`) |
|
||||
| | `CMD_HSTS_INCLUDE_SUBDOMAINS` | **`true`** or `false` | set to include subdomains in HSTS (default is `true`) |
|
||||
| | `CMD_HSTS_MAX_AGE` | **`31536000`**, `60 * 60 * 24 * 365` | max duration in seconds to tell clients to keep HSTS status (default is a year) |
|
||||
| | `CMD_HSTS_PRELOAD` | **`true`** or `false` | whether to allow preloading of the site's HSTS status (e.g. into browsers) |
|
||||
| `csp` | | `{"enable": true, "addDefaults": true}` | Nested object to configure the Content Security Policy |
|
||||
| `csp.enable` | `CMD_CSP_ENABLE` | **`true`** or `false` | Whether to apply a `Content-Security-Policy` header to responses. We don't recommend disabling this option, as it significantly reduces the security of the application. |
|
||||
| `csp.addDefaults` | | **`true`** or `false` | Disable to not include the default CSP. Be careful, this will break the application if the correct directives are not set manually. |
|
||||
| `csp.directives` | | **no default**, `{"scriptSrc": "trustworthy-scripts.example.com"}` | Custom CSP directives. These are passed to Helmet - see [their documentation](https://helmetjs.github.io/docs/csp/) for more information on the format. |
|
||||
| `csp.addDisqus` | `CMD_CSP_ADD_DISQUS` | **`false`** or `true` | Enable to allow users to add Disqus comments to their notes or presentations. We don't recommend enabling this option, as it increases the attack surface of XSS attacks. |
|
||||
| `csp.addGoogleAnalytics` | `CMD_CSP_ADD_GOOGLE_ANALYTICS` | **`false`** or `true` | Enable to allow users to add Google Analytics to their notes. We don't recommend enabling this option, as it increases the attack surface of XSS attacks. |
|
||||
| `csp.upgradeInsecureRequests` | | **`auto`** or `true` or `false` | By default (`auto`), insecure (HTTP) requests are upgraded to HTTPS via CSP if `useSSL` is on. To change this behaviour, set to either `true` or `false`. |
|
||||
| `csp.reportUri` | `CMD_CSP_REPORTURI` | **`undefined`**, `https://<someid>.report-uri.com/r/d/csp/enforce` | Allows to add a URL for CSP reports in case of violations. |
|
||||
| `csp.allowFraming` | `CMD_CSP_ALLOW_FRAMING` | **`true`** or `false` | Disable to disallow embedding of the instance via iframe. We **strongly recommend disabling** this option, as it increases the attack surface of XSS attacks. |
|
||||
| `csp.allowPDFEmbed` | `CMD_CSP_ALLOW_PDF_EMBED` | **`true`** or `false` | Disable to disallow embedding PDFs. We recommend disabling this option, as it increases the attack surface of XSS attacks. |
|
||||
| `cookiePolicy` | `CMD_COOKIE_POLICY` | **`lax`**, `strict` or `none` | Set a SameSite policy whether cookies are send from cross-origin. Be careful: setting a SameSite value of none without https breaks the editor. |
|
||||
| config file | environment | **default** and example value | description |
|
||||
|-------------------------------|------------------------------------|-------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `hsts` | | `{"enable": true, "maxAgeSeconds": 31536000, "includeSubdomains": true, "preload": true}` | [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) options to use with HTTPS (default is the example value, max age is a year) |
|
||||
| | `CMD_HSTS_ENABLE` | **`true`** or `false` | set to enable [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) if HTTPS is also enabled (default is ` true`) |
|
||||
| | `CMD_HSTS_INCLUDE_SUBDOMAINS` | **`true`** or `false` | set to include subdomains in HSTS (default is `true`) |
|
||||
| | `CMD_HSTS_MAX_AGE` | **`31536000`**, `60 * 60 * 24 * 365` | max duration in seconds to tell clients to keep HSTS status (default is a year) |
|
||||
| | `CMD_HSTS_PRELOAD` | **`true`** or `false` | whether to allow preloading of the site's HSTS status (e.g. into browsers) |
|
||||
| `csp` | | `{"enable": true, "addDefaults": true}` | Nested object to configure the Content Security Policy |
|
||||
| `csp.enable` | `CMD_CSP_ENABLE` | **`true`** or `false` | Whether to apply a `Content-Security-Policy` header to responses. We don't recommend disabling this option, as it significantly reduces the security of the application. |
|
||||
| `csp.addDefaults` | | **`true`** or `false` | Disable to not include the default CSP. Be careful, this will break the application if the correct directives are not set manually. |
|
||||
| `csp.directives` | | **no default**, `{"scriptSrc": "trustworthy-scripts.example.com"}` | Custom CSP directives. These are passed to Helmet - see [their documentation](https://helmetjs.github.io/docs/csp/) for more information on the format. |
|
||||
| `csp.addDisqus` | `CMD_CSP_ADD_DISQUS` | **`false`** or `true` | Enable to allow users to add Disqus comments to their notes or presentations. We don't recommend enabling this option, as it increases the attack surface of XSS attacks. |
|
||||
| `csp.addGoogleAnalytics` | `CMD_CSP_ADD_GOOGLE_ANALYTICS` | **`false`** or `true` | Enable to allow users to add Google Analytics to their notes. We don't recommend enabling this option, as it increases the attack surface of XSS attacks. |
|
||||
| `csp.upgradeInsecureRequests` | | **`auto`** or `true` or `false` | By default (`auto`), insecure (HTTP) requests are upgraded to HTTPS via CSP if `useSSL` is on. To change this behaviour, set to either `true` or `false`. |
|
||||
| `csp.reportUri` | `CMD_CSP_REPORTURI` | **`undefined`**, `https://<someid>.report-uri.com/r/d/csp/enforce` | Allows to add a URL for CSP reports in case of violations. |
|
||||
| `csp.allowFraming` | `CMD_CSP_ALLOW_FRAMING` | **`true`** or `false` | Disable to disallow embedding of the instance via iframe. We **strongly recommend disabling** this option, as it increases the attack surface of XSS attacks. |
|
||||
| `csp.allowPDFEmbed` | `CMD_CSP_ALLOW_PDF_EMBED` | **`true`** or `false` | Disable to disallow embedding PDFs. We recommend disabling this option, as it increases the attack surface of XSS attacks. |
|
||||
| `cookiePolicy` | `CMD_COOKIE_POLICY` | **`lax`**, `strict` or `none` | Set a SameSite policy whether cookies are send from cross-origin. Be careful: setting a SameSite value of none without https breaks the editor. |
|
||||
| `observability.exposeMetrics | `CMD_OBSERVABILITY_EXPOSE_METRICS` | **true** or `false` | Controls whether the /metrics endpoint is exposed. |
|
||||
| `observability.exposeStatus | `CMD_OBSERVABILITY_EXPOSE_STATUS` | **true** or `false` | Controls whether the /status routes are exposed. Note that /status will still return 200 for healthcheck purposes, but no data will be exposed. |
|
||||
|
|
||||
|
||||
|
||||
## Privacy and External Requests
|
||||
|
||||
|
|
|
|||
|
|
@ -29,6 +29,10 @@ module.exports = {
|
|||
allowFraming: true,
|
||||
allowPDFEmbed: true
|
||||
},
|
||||
observability: {
|
||||
exposeMetrics: true,
|
||||
exposeStatus: true
|
||||
},
|
||||
cookiePolicy: 'lax',
|
||||
protocolUseSSL: false,
|
||||
allowAnonymous: true,
|
||||
|
|
|
|||
|
|
@ -18,6 +18,10 @@ module.exports = {
|
|||
includeSubdomains: toBooleanConfig(process.env.CMD_HSTS_INCLUDE_SUBDOMAINS),
|
||||
preload: toBooleanConfig(process.env.CMD_HSTS_PRELOAD)
|
||||
},
|
||||
observability: {
|
||||
exposeMetrics: toBooleanConfig(process.env.CMD_OBSERVABILITY_EXPOSE_METRICS),
|
||||
exposeStatus: toBooleanConfig(process.env.CMD_OBSERVABILITY_EXPOSE_STATUS)
|
||||
},
|
||||
csp: {
|
||||
enable: toBooleanConfig(process.env.CMD_CSP_ENABLE),
|
||||
reportURI: process.env.CMD_CSP_REPORTURI,
|
||||
|
|
|
|||
|
|
@ -2,6 +2,9 @@
|
|||
|
||||
## UNRELEASED
|
||||
|
||||
### Enhancements
|
||||
- Allow disabling the /metrics and /status endpoints
|
||||
|
||||
### Bugfixes
|
||||
- Fix note titles with special characters producing invalid file names in user export zip file
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue