Skip to content

Commit 382f15d

Browse files
JoergSiebahnJoergSiebahn
committed
docs(security): describe security hardening implementation
1 parent 0a7e96a commit 382f15d

File tree

3 files changed

+82
-15
lines changed

3 files changed

+82
-15
lines changed

‎docs/index.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,12 @@ specifications promoted by the SDA SE.
55

66
## Features
77

8-
| **Starter** | **Description** |
9-
|-------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
10-
| [sda-commons-starter-web](web/index.md) | Provides the required features for an SDA-compliant microservice including OIDC authentication, OPA authorization, health checks, OpenTracing and Prometheus metrics. |
11-
| [sda-commons-starter-mongodb](mongodb/index.md) | Provides default configuration based on the `org.springframework.boot:spring-boot-starter-data-mongodb` |
12-
| [sda-commons-starter-kafka](kafka/index.md) | Provides default producer und consumer configuration based on `org.springframework.kafka:spring-kafka` |
13-
| [sda-commons-starter-s3](s3/index.md) | Provides features for dealing with the Amazon S3 file storage |
8+
| **Starter** | **Description** |
9+
|-------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
10+
| [sda-commons-starter-web](web/index.md) | Provides the required features for an SDA-compliant microservice including OIDC authentication, OPA authorization, health checks, OpenTelemetry, Prometheus metrics and [hardening the service](security/index.md). |
11+
| [sda-commons-starter-mongodb](mongodb/index.md) | Provides default configuration based on the `org.springframework.boot:spring-boot-starter-data-mongodb` |
12+
| [sda-commons-starter-kafka](kafka/index.md) | Provides default producer und consumer configuration based on `org.springframework.kafka:spring-kafka` |
13+
| [sda-commons-starter-s3](s3/index.md) | Provides features for dealing with the Amazon S3 file storage |
1414

1515
The provided documentation aims to provide SDA-specific information.
1616
All other information are referenced in the Spring and [Spring Boot documentation](https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#documentation).

‎docs/security/index.md

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# Security Hardening
2+
3+
sda-spring-boot-commons changes some default configuration for security reasons.
4+
This document provides a brief overview about the addressed risks.
5+
6+
## Risk: Accessing critical resources from untrusted environments
7+
8+
To avoid exposing internal resources, Spring Boot Actuator is configured to listen on a separate
9+
port.
10+
Health, metrics and other sensitive information can't be exposed to the internet by accident, e.g.
11+
by missing to exclude the actuator path.
12+
13+
Custom critical resources can be exposed at the management port by implementing
14+
`org.springframework.boot.actuate.endpoint.web.annotation.RestControllerEndpoint` or
15+
`org.springframework.boot.actuate.endpoint.web.annotation.ControllerEndpoint`.
16+
Note that there is an [open discussion](https://github.com/spring-projects/spring-boot/issues/31768)
17+
about these annotations.
18+
As long as they are not deprecated, it is suggested to use them because the use is most similar to
19+
controllers used in regular REST APIs.
20+
21+
## Risk: Root start
22+
23+
If the service is started with extended privileges as the root user, an attacker can more easily
24+
attack the operating system after taking over from the container.
25+
26+
The default configuration is capable to run as no root, listening to ports 8080 and 8081.
27+
Deployment checks must ensure, that the container is not configured with a root user.
28+
29+
## Risk: Exploitation of HTTP methods
30+
31+
The HTTP method `TRACE` is disabled by default to mitigate [Cross Site Tracing](https://owasp.org/www-community/attacks/Cross_Site_Tracing).
32+
33+
## Risk: Loss of source IP address
34+
35+
We expect, the services built with sda-spring-boot-commons are deployed behind a proxy, e.g. an
36+
Ingress in Kubernetes.
37+
38+
This library is configured by default to consider `X-Forwarded-*` headers to identify the original
39+
caller.
40+
41+
## Risk: Detection of confidential components
42+
43+
Knowing the components used in a software makes it easier to look for and exploit specific CVEs.
44+
45+
Custom error handlers and other configurations are used to avoid identifiable default output from
46+
the framework and its components.
47+
48+
## Risk: Lack of visibility
49+
50+
If there is no visibility, there is no response to an abusive action and attackers can explore risks
51+
undisturbed.
52+
53+
Logs are written to standard out by default to comply with Kubernetes environments.
54+
Prometheus metrics are exposed as expected by SDA environments.
55+
56+
## Risk: Buffer Overflow
57+
58+
The size of request and response headers is limited to 8KiB.
59+
60+
## Header
61+
62+
By configuring the default headers, the following risks are addressed:
63+
64+
- Cross-Site Scripting
65+
- Content interpretation by the browser
66+
- Content loading in Flash and PDFs
67+
- Clickjacking
68+
- Sharing visited URLs with third parties
69+
- Abuse from Cross-Origin Resource Sharing

‎docs/web/index.md

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,7 @@ Features:
1111
- [Jackson Object Mapping](#jackson)
1212
- [Monitoring](#monitoring)
1313
- [Tracing](#tracing)
14-
- [Health Checks](#health-checks)
15-
- [Testing](#testing)
14+
- [Health Checks](#health-checks--actuator)
1615
- [Logging](#logging)
1716

1817
Based on:
@@ -41,6 +40,7 @@ Based on:
4140
| `oidc.client.id` _string_ | The client ID for the registration. | `` | `exampleClient` | `OPA_CLIENT_ID` |
4241
| `oid.client.secret` _string_ | The Client secret of the registration. | `` | `s3cret` | `OIDC_CLIENT_SECRET` |
4342
| `oidc.client.issuer.uri` _string_ | URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization Server Metadata endpoint defined by RFC 8414. | `` | `https://keycloak.sdadev.sda-se.io/auth/realms/exampleRealm` | `OIDC_CLIENT_ISSUER_URI` |
43+
| `cors.allowed-origin-patterns` _string_ | Comma separated list of URL patterns for which CORS requests are allowed. | _none allowed_ | `https://*.all-subdomains.com, https://static-domain.com` | `CORS_ALLOWEDORIGINPATTERNS` |
4444

4545
For further information have a look at the [Spring Boot documentation](https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#documentation).
4646

@@ -111,9 +111,10 @@ public class MyConstraints extends AbstractConstraints {
111111
```java
112112
@RestController
113113
public class AuthTestApp {
114-
115-
@Autowired private MyConstraints myConstraints;
116-
...
114+
@Autowired
115+
private MyConstraints myConstraints;
116+
// ...
117+
}
117118
```
118119

119120
### Testing
@@ -176,7 +177,7 @@ allow {
176177
# set some example constraints
177178
constraint1 := true # always true
178179
constraint2 := [ "v2.1", "v2.2" ] # always an array of "v2.1" and "v2.2"
179-
constraint3[token.payload.sub]. # always a set that contains the 'sub' claim from the token
180+
constraint3[token.payload.sub] # always a set that contains the 'sub' claim from the token
180181
# or is empty if no token is present
181182
182183
```
@@ -543,6 +544,3 @@ The Spring Boot default is enabled.
543544
* `classpath:org/sdase/commons/spring/logging/logback-json.xml` for Json Logging
544545
* Example: `classpath:org/sdase/commons/spring/logging/logback-json.xml`
545546
* Default: `org/springframework/boot/logging/logback/defaults.xml`
546-
547-
548-
## Testing

0 commit comments

Comments
 (0)