Repository navigation
Conversation
…efaults Context: - FlexMeasures#1008 (first released in v0.20.0) made the HTTPS redirect opt-in through FLEXMEASURES_FORCE_HTTPS, and FlexMeasures#1564 (v0.27.0) turned two-factor authentication off by default, but the docs still described both as always on. - The pages also described bcrypt password hashes, sha256_crypt tokens with a 2011 epoch, and SECURITY_TOKEN_MAX_AGE as an environment variable, while Flask-Security hashes with Argon2, itsdangerous signs the tokens with Unix timestamps, and that setting is only read from the config file. - The Docker examples passed SECURITY_TOTP_SECRETS as unquoted JSON with a space, which the shell splits into two arguments, and it is not needed while 2FA is off. Change: - security_auth: HTTPS is set up by the host, FLEXMEASURES_FORCE_HTTPS adds the redirect, 2FA is supported and off by default, and the password and token details match the code. - configuration: a label for FLEXMEASURES_FORCE_HTTPS, when it redirects, the Flask-SSLify settings that apply, and that it is read from the config file only. - docker, installation: production mode needs no TLS; development mode is for your own computer; drop SECURITY_TOTP_SECRETS from the default commands; an example of a setting environment variables cannot set that is one; http:// for localhost links. - api/introduction: http://localhost:5000/api for a local server. Signed-off-by: Serhii <jshmitz@me.com>
Context: - Hosts read these pages to secure an installation, so the correction belongs in the changelog. Change: - Add it under Infrastructure / Support in v1.2.0, with a placeholder for the PR number. Signed-off-by: Serhii <jshmitz@me.com>
Context: - The changelog entry was written before the pull request existed. Change: - Link it to PR FlexMeasures#2842. Signed-off-by: Serhii <jshmitz@me.com>
Documentation build overview
7 files changed ·
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Some security and hosting pages still describe defaults that changed: #1008 (v0.20.0) made the HTTPS redirect opt-in through
FLEXMEASURES_FORCE_HTTPS, and #1564 (v0.27.0) turned two-factor authentication off by default. A host reading these pages could assume both are on.concepts/security_auth.rsthttp://https://only withFLEXMEASURES_FORCE_HTTPS = True(app.py:149, defaultFalseinconfig_defaults.py:226); setting up TLS is up to the host (the Docker image runs gunicorn on plain0.0.0.0:5000)concepts/security_auth.rstSECURITY_TWO_FACTORisFalseby default (config_defaults.py:81)concepts/security_auth.rstconfig_defaults.py:309)concepts/security_auth.rstsha256_cryptand store seconds since 2011;SECURITY_TOKEN_MAX_AGEis an environment variableURLSafeTimedSerializer, which stores Unix timestamps;SECURITY_TOKEN_MAX_AGEis not read from the environment (config_utils.py:251-262)host/docker.rstSECURITY_TOTP_SECRETSis one of three minimal variablesGET /loginover plain http with 200 and no redirect (checked with the Flask test client); TOTP secrets are only loaded when 2FA is on (app.py:141-142)host/docker.rst,host/installation.rst--env SECURITY_TOTP_SECRETS={"1": "blabla"}in the default commandsblabla}lands where Docker expects the imagehost/docker.rstconfig_utils.py:256);FLEXMEASURES_FORCE_HTTPScannot, so that is the example nowhost/installation.rst,api/introduction.rsthttps://localhost:5000/...for a local setuphttp://, as a local setup has no TLSconfiguration.rst, add a label toFLEXMEASURES_FORCE_HTTPSand say when it redirects (not in debug mode, not withX-Forwarded-Proto: https), that Flask-SSLify's own settings such asSSLIFY_SKIPSapply, and that it is read from the config file only.documentation/changelog.rstLook & Feel
Documentation only.
How to test
sphinx-build -M html documentation <out> -W --keep-going -n: locally, the build reports the same 791 warnings as onmain(all of them unresolved Python cross-references, such aspy:class), and none from the changed pages.Further Improvements
None.
Related Items
None.
Sign-off