From 6bdb5a7e579aa82ed2dd600c0ce3adf67e2c620c Mon Sep 17 00:00:00 2001 From: Aad Versteden Date: Sun, 10 Oct 2021 19:37:10 +0200 Subject: [PATCH 1/6] Add x-frame-options when hosting frontend pages We don't want these pages to be contained in a frame. The x-frame-options servers that use. --- config/frontend/add-x-frame-options-header.conf | 3 +++ docker-compose.yml | 2 ++ 2 files changed, 5 insertions(+) create mode 100644 config/frontend/add-x-frame-options-header.conf diff --git a/config/frontend/add-x-frame-options-header.conf b/config/frontend/add-x-frame-options-header.conf new file mode 100644 index 0000000..7f4234b --- /dev/null +++ b/config/frontend/add-x-frame-options-header.conf @@ -0,0 +1,3 @@ +location / { + add_header X-Frame-Options "DENY"; +} \ No newline at end of file diff --git a/docker-compose.yml b/docker-compose.yml index 1d70be0..a513537 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -137,6 +137,8 @@ services: image: lblod/frontend-contact-hub:1.1.0 labels: - "logging=true" + volumes: + - ./config/frontend/add-x-frame-options-header.conf:/config/add-x-frame-options.conf environment: EMBER_OAUTH_API_REDIRECT_URL: "https://organisaties.abb.lblod.info/authorization/callback" EMBER_OAUTH_API_KEY: "677af572-2e2f-4e61-ad38-036723bb314c" From 00aa5dec5abca0cb524749debbe6eecb7525c01a Mon Sep 17 00:00:00 2001 From: Nordine Bittich Date: Mon, 11 Oct 2021 13:05:26 +0200 Subject: [PATCH 2/6] remove proxy config for working with acm/idm locally --- config/proxy-https/proxy_ssl.conf | 22 ---------------------- 1 file changed, 22 deletions(-) delete mode 100644 config/proxy-https/proxy_ssl.conf diff --git a/config/proxy-https/proxy_ssl.conf b/config/proxy-https/proxy_ssl.conf deleted file mode 100644 index 777f360..0000000 --- a/config/proxy-https/proxy_ssl.conf +++ /dev/null @@ -1,22 +0,0 @@ - -server { - listen *:443; - server_name organisaties.abb.lblod.info; - ssl on; - ssl_certificate /etc/nginx/conf.d/cert.pem; - ssl_certificate_key /etc/nginx/conf.d/key.pem; - - location / { - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header Host $host; - proxy_set_header X-Forwarded-For $remote_addr; - proxy_pass http://identifier; - client_max_body_size 3072m; - } - - location ~ /authorization/callback(.*) { - rewrite ^ /torii/redirect.html permanent; - } -} \ No newline at end of file From 1c25a0192c14eca9d24dcbf870e5cfc5a3337056 Mon Sep 17 00:00:00 2001 From: Sam Van Campenhout Date: Wed, 13 Oct 2021 16:01:52 +0200 Subject: [PATCH 3/6] Add the `always` param to the X-Frame-Options header This ensures that the header is added to all responses regardless of response code. More information: http://nginx.org/en/docs/http/ngx_http_headers_module.html --- config/frontend/add-x-frame-options-header.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/frontend/add-x-frame-options-header.conf b/config/frontend/add-x-frame-options-header.conf index 7f4234b..a7509f6 100644 --- a/config/frontend/add-x-frame-options-header.conf +++ b/config/frontend/add-x-frame-options-header.conf @@ -1,3 +1,3 @@ location / { - add_header X-Frame-Options "DENY"; + add_header X-Frame-Options "DENY" always; } \ No newline at end of file From cd37d596c1857f8cdcf7c11c4f78a08b957ea32e Mon Sep 17 00:00:00 2001 From: Sam Van Campenhout Date: Mon, 18 Oct 2021 10:17:10 +0200 Subject: [PATCH 4/6] Enable the uri-info service again (#57) This allows us to retrieve the rdf type and uuid of a resource uri. --- config/dispatcher/dispatcher.ex | 4 ++++ docker-compose.dev.yml | 2 ++ docker-compose.yml | 8 ++++++++ 3 files changed, 14 insertions(+) diff --git a/config/dispatcher/dispatcher.ex b/config/dispatcher/dispatcher.ex index 2f1b220..7544274 100644 --- a/config/dispatcher/dispatcher.ex +++ b/config/dispatcher/dispatcher.ex @@ -243,6 +243,10 @@ defmodule Dispatcher do forward conn, path, "http://privacy/person-information-requests" end + get "/uri-info/*path", %{ layer: :api_services, accept: %{ json: true } } do + forward conn, path, "http://uri-info/" + end + ############################################################### # frontend layer diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml index 6a71303..173bfbe 100644 --- a/docker-compose.dev.yml +++ b/docker-compose.dev.yml @@ -35,3 +35,5 @@ services: restart: "no" frontend: restart: "no" + uri-info: + restart: "no" diff --git a/docker-compose.yml b/docker-compose.yml index a513537..fc7e499 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -146,3 +146,11 @@ services: EMBER_OAUTH_API_LOGOUT_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/logout" EMBER_OAUTH_API_SCOPE: "openid vo profile abb_organisatieportaal" restart: always + uri-info: + image: redpencil/mu-uri-info-service:0.2.1 + labels: + - "logging=true" + restart: always + logging: *default-logging + links: + - db:database \ No newline at end of file From 253b9f2e4280ead53ff718b62c6926bcf7c7dc4a Mon Sep 17 00:00:00 2001 From: Aad Versteden Date: Tue, 19 Oct 2021 10:53:04 +0200 Subject: [PATCH 5/6] Consistent logging statements (#45) These logging statements are more consistent than what was there before. They're all there, except for app-http-logger logging for the triplestore. Logging happens on both source as well as on the target. Because the triplestore is a sink, we don't have to have http for it per se. --- docker-compose.yml | 40 ++++++++++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 12 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index fc7e499..99830a6 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -32,8 +32,6 @@ services: volumes: - ./data/db:/data - ./config/db/virtuoso.ini:/data/virtuoso.ini - labels: - - "logging=true" restart: always logging: *default-logging db: @@ -47,6 +45,10 @@ services: ERROR_ON_UNWRITTEN_DATA: "true" volumes: - ./config/authorization:/config + labels: + - "logging=true" + restart: always + logging: *default-logging migrations: image: semtech/mu-migrations-service:0.7.0 links: @@ -84,11 +86,18 @@ services: SERVER_PORT: "80" LOGGING_LEVEL: "INFO" SPARQL_ENDPOINT: "http://db:8890/sparql" + labels: + - "logging=true" restart: always + logging: *default-logging deltanotifier: image: semtech/mu-delta-notifier:0.1.0 volumes: - ./config/delta:/config + labels: + - "logging=true" + restart: always + logging: *default-logging sink: image: nginx:1.15.2 volumes: @@ -99,19 +108,17 @@ services: logging: *default-logging login: image: lblod/acmidm-login-service:0.9.2-organisatie_portaal - links: - - db:database environment: MU_APPLICATION_AUTH_DISCOVERY_URL: "https://authenticatie-ti.vlaanderen.be/op" MU_APPLICATION_AUTH_CLIENT_ID: "677af572-2e2f-4e61-ad38-036723bb314c" MU_APPLICATION_AUTH_REDIRECT_URI: "https://organisaties.abb.lblod.info/authorization/callback" MU_APPLICATION_AUTH_CLIENT_SECRET: "" + links: + - db:database labels: - "logging=true" restart: always logging: *default-logging - links: - - db:database privacy: image: lblod/privacy-centric-service:0.0.1 environment: @@ -120,8 +127,16 @@ services: LOGGING_LEVEL: "INFO" DEFAULT_GRAPH: "http://mu.semte.ch/graphs/contacthub/141d9d6b-54af-4d17-b313-8d1c30bc3f5b/ChAdmin" SESSION_GRAPH: "http://mu.semte.ch/graphs/sessions" + labels: + - "logging=true" + restart: always + logging: *default-logging adressenregister: image: lblod/adressenregister-fuzzy-search-service:0.5.0 + labels: + - "logging=true" + restart: always + logging: *default-logging web: image: nginx:1.21.3 volumes: @@ -135,8 +150,6 @@ services: logging: *default-logging frontend: image: lblod/frontend-contact-hub:1.1.0 - labels: - - "logging=true" volumes: - ./config/frontend/add-x-frame-options-header.conf:/config/add-x-frame-options.conf environment: @@ -145,12 +158,15 @@ services: EMBER_OAUTH_API_BASE_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/auth" EMBER_OAUTH_API_LOGOUT_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/logout" EMBER_OAUTH_API_SCOPE: "openid vo profile abb_organisatieportaal" - restart: always - uri-info: - image: redpencil/mu-uri-info-service:0.2.1 labels: - "logging=true" restart: always logging: *default-logging + uri-info: + image: redpencil/mu-uri-info-service:0.2.1 links: - - db:database \ No newline at end of file + - db:database + labels: + - "logging=true" + restart: always + logging: *default-logging From 5c9bd8e6e8252f5096566bdae3d3e3fe88f3a982 Mon Sep 17 00:00:00 2001 From: Aad Versteden Date: Wed, 20 Oct 2021 13:22:21 +0200 Subject: [PATCH 6/6] Set secure cookie option Cookies should have the secure attribute. Defaulting that in this PR. --- docker-compose.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index a513537..ee8f385 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -9,9 +9,10 @@ x-logging: services: identifier: - image: semtech/mu-identifier:1.8.1 + image: semtech/mu-identifier:1.9.1 environment: DEFAULT_MU_AUTH_ALLOWED_GROUPS_HEADER: "[{\"variables\":[],\"name\":\"public\"}]" + SESSION_COOKIE_SECURE: "on" labels: - "logging=true" restart: always