Remove potentialy insecure Nginx configuration from Kratos "Deploy to production" guide #4347
BZ1234567890
started this conversation in
Ideas
Replies: 1 comment
-
|
Thank you! That should definitely be solved better - would you mind opening a PR how it should be, please? :) |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Deploy to production guide for Kratos includes instructions for setting up Nginx configuration (relevant section is Install and configure Nginx). These instructions contain the following piece of configuration, which exposes admin APIs to the public without any restrictions:
I don't see a point of exposing
/identitiesadmin route to the public, and I recommend that this piece of code is removed from the deployment guide, unless there is a well documented reason why this should be in the Nginx configuration and how to properly secure admin APIs.Beta Was this translation helpful? Give feedback.
All reactions