Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add some security options for the GUI to provide separation of duties and address insecure login #102

Closed
dhixon opened this issue May 16, 2019 · 1 comment
Closed

Add some security options for the GUI to provide separation of duties and address insecure login #102

dhixon opened this issue May 16, 2019 · 1 comment
Assignees
@phax
Labels
enhancement security
Milestone
v5.2

Comments

@dhixon
Copy link

dhixon commented May 16, 2019

From a security perspective, provide a clean separation of duties between the public SMP API and the GUI by running them on different ports (or at least the option of running them on different ports). The public SMP API webapp/port should only serve GET requests for the SMP API. No writeable API's and no way to login to the GUI.

I know that there are ways to use redirects for /secure to another URL that could be configured for HTTPS (though not the login page that runs in /public), but from a security perspective, I would prefer as much separation as possible between the external facing read-only elements and the internal facing read-write elements.
@phax phax self-assigned this May 16, 2019
phax added a commit that referenced this issue May 17, 2019
@phax
Add the possibility to remove the login UI from /public; #102
e2dd3dd
@phax phax added this to the v5.2 milestone May 17, 2019
@phax
Copy link
Owner

phax commented May 17, 2019

New configuration option webapp.public.login.enabled in v5.2.0 to turn it off

@phax phax closed this as completed May 17, 2019
phax added a commit that referenced this issue May 28, 2019
@phax
Add the possibility to remove the login UI from /public; #102
4be565a 
# Conflicts:
#	peppol-smp-server-webapp/src/main/java/com/helger/peppol/smpserver/ui/ajax/CAjax.java
#	peppol-smp-server-webapp/src/main/java/com/helger/peppol/smpserver/ui/pub/SMPRendererPublic.java
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@phax phax

Labels
enhancement security
Projects
None yet
Milestone
v5.2
Development

No branches or pull requests
2 participants
@phax @dhixon