pad.pub0.org

Author SHA1 Message Date

Author	SHA1	Message	Date
John McLear	fa3e4b146a	settings: document the possibility of using Unix sockets We have been supporting Unix sockets by ages, because express.listen() (http://expressjs.com/en/4x/api.html#app.listen_path_callback) re-exposes net.server.listen() (https://nodejs.org/api/net.html#net_server_listen), which in turn supports Unix sockets. The only remaining thing to do was documenting it. Fixes #3312	2020-03-30 03:36:55 +02:00
muxator	a817acbbcc	security: when served over https, set the "secure" flag for "express_sid" and "language" cookie The mechanism used for determining if the application is being served over SSL is wrapped by the "express-session" library for "express_sid", and manual for the "language" cookie, but it's very similar in both cases. The "secure" flag is set if one of these is true: 1. we are directly serving Etherpad over SSL using the native nodejs functionality, via the "ssl" options in settings.json 2. Etherpad is being served in plaintext by nodejs, but we are using a reverse proxy for terminating the SSL for us; In this case, the user has to be instructed to properly set trustProxy: true in settings.json, and the information wheter the application is over SSL or not will be extracted from the X-Forwarded-Proto HTTP header. Please note that this will not be compatible with applications being served over http and https at the same time. The change on webaccess.js amends `009b61b338`, which did not work when the SSL termination was performed by a reverse proxy. Reference for automatic "express_sid" configuration: https://github.com/expressjs/session/blob/v1.17.0/README.md#cookiesecure Closes #3561.	2019-12-07 04:36:01 +01:00
muxator	30fd53f1fd	docker: move docker/settings.json to /settings.json.docker	2019-11-08 23:50:50 +01:00

John McLear

settings: document the possibility of using Unix sockets

We have been supporting Unix sockets by ages, because express.listen()
(http://expressjs.com/en/4x/api.html#app.listen_path_callback) re-exposes
net.server.listen() (https://nodejs.org/api/net.html#net_server_listen), which
in turn supports Unix sockets.

The only remaining thing to do was documenting it.

Fixes #3312

2020-03-30 03:36:55 +02:00

muxator

a817acbbcc

security: when served over https, set the "secure" flag for "express_sid" and "language" cookie

The mechanism used for determining if the application is being served over SSL
is wrapped by the "express-session" library for "express_sid", and manual for
the "language" cookie, but it's very similar in both cases.

The "secure" flag is set if one of these is true:

1. we are directly serving Etherpad over SSL using the native nodejs
   functionality, via the "ssl" options in settings.json

2. Etherpad is being served in plaintext by nodejs, but we are using a reverse
   proxy for terminating the SSL for us;
   In this case, the user has to be instructed to properly set trustProxy: true
   in settings.json, and the information wheter the application is over SSL or
   not will be extracted from the X-Forwarded-Proto HTTP header.

Please note that this will not be compatible with applications being served over
http and https at the same time.

The change on webaccess.js amends 009b61b338, which did not work when the SSL
termination was performed by a reverse proxy.

Reference for automatic "express_sid" configuration:
https://github.com/expressjs/session/blob/v1.17.0/README.md#cookiesecure

Closes #3561.

2019-12-07 04:36:01 +01:00

muxator 30fd53f1fd docker: move docker/settings.json to /settings.json.docker 2019-11-08 23:50:50 +01:00

3 Commits (3872690715a4c3355f169295c11eebaf97f7efd6)