From 488e5f8a0a0b7baad06aa6f8345a2a7f2ac36c57 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Maniaci?= Date: Wed, 1 Feb 2023 11:07:22 +0100 Subject: [PATCH] Revert "config: Add a flag to control the /metrics and /status endpoints" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit d10ead4c6c5398595c5e05a4d61b2c0cede6cbf8. Signed-off-by: Stéphane Maniaci --- app.js | 18 +++------------- docs/content/configuration.md | 40 ++++++++++++++++------------------- lib/config/default.js | 4 ---- lib/config/environment.js | 4 ---- public/docs/release-notes.md | 3 --- 5 files changed, 21 insertions(+), 48 deletions(-) diff --git a/app.js b/app.js index 9a36a0941..34a107ae1 100644 --- a/app.js +++ b/app.js @@ -75,10 +75,8 @@ app.use(morgan('combined', { })) // Register prometheus metrics endpoint -if (config.observability.exposeMetrics) { - app.use(apiMetrics()) - metrics.setupCustomPrometheusMetrics() -} +app.use(apiMetrics()) +metrics.setupCustomPrometheusMetrics() // socket io const io = require('socket.io')(server, { cookie: false }) @@ -228,17 +226,7 @@ app.locals.enableGitHubGist = config.isGitHubEnable app.locals.enableGitlabSnippets = config.isGitlabSnippetsEnable app.use(require('./lib/web/baseRouter')) - -if (config.observability.exposeStatus) { - app.use(require('./lib/web/statusRouter')) -} else { - // the `/status` route is used by the hedgedoc container's - // healtcheck route so keep the endpoint alive - app.get('/status', function (req, res, next) { - res.sendStatus(200) - }) -} - +app.use(require('./lib/web/statusRouter')) app.use(require('./lib/web/auth')) app.use(require('./lib/web/historyRouter')) app.use(require('./lib/web/userRouter')) diff --git a/docs/content/configuration.md b/docs/content/configuration.md index 927c19700..cbec325ca 100644 --- a/docs/content/configuration.md +++ b/docs/content/configuration.md @@ -76,28 +76,24 @@ these are rarely used for various reasons. ## Web security aspects -| config file | environment | **default** and example value | description | -|-------------------------------|------------------------------------|-------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `hsts` | | `{"enable": true, "maxAgeSeconds": 31536000, "includeSubdomains": true, "preload": true}` | [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) options to use with HTTPS (default is the example value, max age is a year) | -| | `CMD_HSTS_ENABLE` | **`true`** or `false` | set to enable [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) if HTTPS is also enabled (default is ` true`) | -| | `CMD_HSTS_INCLUDE_SUBDOMAINS` | **`true`** or `false` | set to include subdomains in HSTS (default is `true`) | -| | `CMD_HSTS_MAX_AGE` | **`31536000`**, `60 * 60 * 24 * 365` | max duration in seconds to tell clients to keep HSTS status (default is a year) | -| | `CMD_HSTS_PRELOAD` | **`true`** or `false` | whether to allow preloading of the site's HSTS status (e.g. into browsers) | -| `csp` | | `{"enable": true, "addDefaults": true}` | Nested object to configure the Content Security Policy | -| `csp.enable` | `CMD_CSP_ENABLE` | **`true`** or `false` | Whether to apply a `Content-Security-Policy` header to responses. We don't recommend disabling this option, as it significantly reduces the security of the application. | -| `csp.addDefaults` | | **`true`** or `false` | Disable to not include the default CSP. Be careful, this will break the application if the correct directives are not set manually. | -| `csp.directives` | | **no default**, `{"scriptSrc": "trustworthy-scripts.example.com"}` | Custom CSP directives. These are passed to Helmet - see [their documentation](https://helmetjs.github.io/docs/csp/) for more information on the format. | -| `csp.addDisqus` | `CMD_CSP_ADD_DISQUS` | **`false`** or `true` | Enable to allow users to add Disqus comments to their notes or presentations. We don't recommend enabling this option, as it increases the attack surface of XSS attacks. | -| `csp.addGoogleAnalytics` | `CMD_CSP_ADD_GOOGLE_ANALYTICS` | **`false`** or `true` | Enable to allow users to add Google Analytics to their notes. We don't recommend enabling this option, as it increases the attack surface of XSS attacks. | -| `csp.upgradeInsecureRequests` | | **`auto`** or `true` or `false` | By default (`auto`), insecure (HTTP) requests are upgraded to HTTPS via CSP if `useSSL` is on. To change this behaviour, set to either `true` or `false`. | -| `csp.reportUri` | `CMD_CSP_REPORTURI` | **`undefined`**, `https://.report-uri.com/r/d/csp/enforce` | Allows to add a URL for CSP reports in case of violations. | -| `csp.allowFraming` | `CMD_CSP_ALLOW_FRAMING` | **`true`** or `false` | Disable to disallow embedding of the instance via iframe. We **strongly recommend disabling** this option, as it increases the attack surface of XSS attacks. | -| `csp.allowPDFEmbed` | `CMD_CSP_ALLOW_PDF_EMBED` | **`true`** or `false` | Disable to disallow embedding PDFs. We recommend disabling this option, as it increases the attack surface of XSS attacks. | -| `cookiePolicy` | `CMD_COOKIE_POLICY` | **`lax`**, `strict` or `none` | Set a SameSite policy whether cookies are send from cross-origin. Be careful: setting a SameSite value of none without https breaks the editor. | -| `observability.exposeMetrics | `CMD_OBSERVABILITY_EXPOSE_METRICS` | **true** or `false` | Controls whether the /metrics endpoint is exposed. | -| `observability.exposeStatus | `CMD_OBSERVABILITY_EXPOSE_STATUS` | **true** or `false` | Controls whether the /status routes are exposed. Note that /status will still return 200 for healthcheck purposes, but no data will be exposed. | -| - +| config file | environment | **default** and example value | description | +| ----------------------------- | ------------------------------ | ------------------------------------------------------------------------------------------| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `hsts` | | `{"enable": true, "maxAgeSeconds": 31536000, "includeSubdomains": true, "preload": true}` | [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) options to use with HTTPS (default is the example value, max age is a year) | +| | `CMD_HSTS_ENABLE` | **`true`** or `false` | set to enable [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) if HTTPS is also enabled (default is ` true`) | +| | `CMD_HSTS_INCLUDE_SUBDOMAINS` | **`true`** or `false` | set to include subdomains in HSTS (default is `true`) | +| | `CMD_HSTS_MAX_AGE` | **`31536000`**, `60 * 60 * 24 * 365` | max duration in seconds to tell clients to keep HSTS status (default is a year) | +| | `CMD_HSTS_PRELOAD` | **`true`** or `false` | whether to allow preloading of the site's HSTS status (e.g. into browsers) | +| `csp` | | `{"enable": true, "addDefaults": true}` | Nested object to configure the Content Security Policy | +| `csp.enable` | `CMD_CSP_ENABLE` | **`true`** or `false` | Whether to apply a `Content-Security-Policy` header to responses. We don't recommend disabling this option, as it significantly reduces the security of the application. | +| `csp.addDefaults` | | **`true`** or `false` | Disable to not include the default CSP. Be careful, this will break the application if the correct directives are not set manually. | +| `csp.directives` | | **no default**, `{"scriptSrc": "trustworthy-scripts.example.com"}` | Custom CSP directives. These are passed to Helmet - see [their documentation](https://helmetjs.github.io/docs/csp/) for more information on the format. | +| `csp.addDisqus` | `CMD_CSP_ADD_DISQUS` | **`false`** or `true` | Enable to allow users to add Disqus comments to their notes or presentations. We don't recommend enabling this option, as it increases the attack surface of XSS attacks. | +| `csp.addGoogleAnalytics` | `CMD_CSP_ADD_GOOGLE_ANALYTICS` | **`false`** or `true` | Enable to allow users to add Google Analytics to their notes. We don't recommend enabling this option, as it increases the attack surface of XSS attacks. | +| `csp.upgradeInsecureRequests` | | **`auto`** or `true` or `false` | By default (`auto`), insecure (HTTP) requests are upgraded to HTTPS via CSP if `useSSL` is on. To change this behaviour, set to either `true` or `false`. | +| `csp.reportUri` | `CMD_CSP_REPORTURI` | **`undefined`**, `https://.report-uri.com/r/d/csp/enforce` | Allows to add a URL for CSP reports in case of violations. | +| `csp.allowFraming` | `CMD_CSP_ALLOW_FRAMING` | **`true`** or `false` | Disable to disallow embedding of the instance via iframe. We **strongly recommend disabling** this option, as it increases the attack surface of XSS attacks. | +| `csp.allowPDFEmbed` | `CMD_CSP_ALLOW_PDF_EMBED` | **`true`** or `false` | Disable to disallow embedding PDFs. We recommend disabling this option, as it increases the attack surface of XSS attacks. | +| `cookiePolicy` | `CMD_COOKIE_POLICY` | **`lax`**, `strict` or `none` | Set a SameSite policy whether cookies are send from cross-origin. Be careful: setting a SameSite value of none without https breaks the editor. | ## Privacy and External Requests diff --git a/lib/config/default.js b/lib/config/default.js index e2b7b2c63..88cc63069 100644 --- a/lib/config/default.js +++ b/lib/config/default.js @@ -29,10 +29,6 @@ module.exports = { allowFraming: true, allowPDFEmbed: true }, - observability: { - exposeMetrics: true, - exposeStatus: true - }, cookiePolicy: 'lax', protocolUseSSL: false, allowAnonymous: true, diff --git a/lib/config/environment.js b/lib/config/environment.js index cfa1f6d69..65d647369 100644 --- a/lib/config/environment.js +++ b/lib/config/environment.js @@ -18,10 +18,6 @@ module.exports = { includeSubdomains: toBooleanConfig(process.env.CMD_HSTS_INCLUDE_SUBDOMAINS), preload: toBooleanConfig(process.env.CMD_HSTS_PRELOAD) }, - observability: { - exposeMetrics: toBooleanConfig(process.env.CMD_OBSERVABILITY_EXPOSE_METRICS), - exposeStatus: toBooleanConfig(process.env.CMD_OBSERVABILITY_EXPOSE_STATUS) - }, csp: { enable: toBooleanConfig(process.env.CMD_CSP_ENABLE), reportURI: process.env.CMD_CSP_REPORTURI, diff --git a/public/docs/release-notes.md b/public/docs/release-notes.md index 9e152e138..50e3ad6c8 100644 --- a/public/docs/release-notes.md +++ b/public/docs/release-notes.md @@ -2,9 +2,6 @@ ## UNRELEASED -### Enhancements -- Allow disabling the /metrics and /status endpoints - ### Bugfixes - Fix note titles with special characters producing invalid file names in user export zip file