58 lines
2.0 KiB
Markdown
58 lines
2.0 KiB
Markdown
# Security
|
||
|
||
## Protection against cookie theft
|
||
|
||
Authelia uses two mechanism to protect against cookie theft:
|
||
1. session attribute `httpOnly` set to true make client-side code unable to
|
||
read the cookie.
|
||
2. session attribute `secure` ensure the cookie will never be sent over an
|
||
unsecure HTTP connections.
|
||
|
||
## Protection against multi-domain cookie attacks
|
||
|
||
Since Authelia uses multi-domain cookies to perform single sign-on, an
|
||
attacker who poisonned a user's DNS cache can easily retrieve the user's
|
||
cookies by making the user send a request to one of the attacker's IPs.
|
||
|
||
To mitigate this risk, it's advisable to only use HTTPS connections with valid
|
||
certificates and enforce it with HTTP Strict Transport Security ([HSTS]) so
|
||
that the attacker must also require the certificate to retrieve the cookies.
|
||
|
||
Note that using [HSTS] has consequences. That's why you should read the blog
|
||
post nginx has written on [HSTS].
|
||
|
||
## More protections measures with Nginx
|
||
|
||
You can also apply the following headers to your nginx configuration for
|
||
improving security. Please read the documentation of those headers before
|
||
applying them blindly.
|
||
|
||
```
|
||
# We don't want any credentials / TOTP secret key / QR code to be cached by
|
||
# the client
|
||
add_header Cache-Control "no-store";
|
||
add_header Pragma "no-cache";
|
||
|
||
# Clickjacking / XSS protection
|
||
|
||
# We don't want Authelia's login page to be rendered within a <frame>,
|
||
# <iframe> or <object> from an external website.
|
||
add_header X-Frame-Options "SAMEORIGIN";
|
||
|
||
# Block pages from loading when they detect reflected XSS attacks.
|
||
add_header X-XSS-Protection "1; mode=block";
|
||
```
|
||
|
||
## Helmet
|
||
|
||
To improve even more the security, [Helmet] has been added to **Authelia**.
|
||
|
||
## Contributing
|
||
|
||
If you find possible vulnerabilities or threats, do not hesitate to contribute
|
||
either by writing a test case demonstrating the possible attack and if
|
||
possible some solutions to prevent it or submit a PR.
|
||
|
||
[HSTS]: https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/
|
||
[Helmet]: https://helmetjs.github.io/
|