Server Configuration

Session Duration

config.yml

server: sessionTimeout: 5400

CODE

SSL

Typical Setups use a separate reverse proxy as SSL Endpoint instead of the integrated SSL functionality. See Deployment overview.

Generate a key:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365

openssl pkcs12 -export -in cert.pem -inkey key.pem -out keystore.p12 -name jetty -caname root

Make sure the keyAlias matches exactly - it is case sensitive.

To check the keystore, you may run

keytool(.exe) -list -v -keystore path\to\conf\keystore.p12

config.yml

server:
    port: 8443
    ssl:
        keyStore: /certificates/keystore.p12
        keyStorePassword: secret
		keyAlias: jetty

CODE

Restricting Host Headers

It is possible to configure exactly which host headers the HTTP requests are allowed to have. If we don't configure this, the servers accepts all hosts.

The server checks the values of 'X-Forwarded-Host' and 'Host' header, where the header 'X-Forwarded-Host' takes priority. If no configured headers match the HTTP header value the servers responds with HTTP status 400. This also happens if the HTTP headers are missing.

To configure simply add the property 'hostHeaderAllowlist' to the config.yml, followed by a comma separated list of accepted domains.

config.yml

hostHeaderAllowlist: mydomain1.com:8080, mydomain3.net

CODE

The domains must be configured to the value that is sent to the server, which may differ from the URL in the browser.

CSRF Prevention

By default, the server is configured so that CSRF attacks are prevented by requiring a unique token to be send for form requests. The REST API requires the content type to be application/json. If needed, both security mechanism can be disabled via the config.yml using the following configuration.

disableCheckCSRF:
    contentTypeCheck: true
    tokenCheck: true

CODE

Unblocking Users and Password Reset

In case you need to reset a password for a user on startup, add the following to config.yml. The new_password must comply with the configured password rules. The respective user will also be unblocked and enabled.

unblock:
    password: new_password
    username: existing_user

CODE

Cross-Origin Resource Sharing (CORS) Allowlist

This adds a allowlist for the 'Origin' HTTP header in requests where the HTTP request's 'URL' and 'Origin' do not match.

This protects against CSWSH ( https://christian-schneider.net/CrossSiteWebSocketHijacking.html) attack and it should be set.

config.yml

grails:
    cors:
       allowedOrigins:
       - http://www.allowedorigin1.com
       - http://www.allowedorigin2.com

CODE