Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature]: SSL/TLS support #28

Open
thomasleplus opened this issue May 7, 2024 · 0 comments
Open

[Feature]: SSL/TLS support #28

thomasleplus opened this issue May 7, 2024 · 0 comments
Assignees
Labels
enhancement New feature or request

Comments

@thomasleplus
Copy link
Member

Feature description

Implement TLS and enable it by default, then the session cookie could be set with the flags `SameSite=Strict`

Pros:
1. Some Identity Providers might refuse to redirect to non-TLS URLs.
2. Although "real" security is not really a concern for this debugging tool, it is always better to follow best practices whenever possible and using TLS does not impact the debugging since the network traffic remains visible in the clear in the browser's developer tools and in the debugger's console log.
3. Implementing TLS would probably future-proof the debugger since it might become mandatory at some point.

Cons:
1. Need to have add a TLS certificate. Since security is not a requirement for the debugger, it would be OK to use a self-signed certificate. But if it is baked in the `docker build`, it could expire at some point. Even if it is generated dynamically during build, if there is no new release in a while it could expire given that nowadays certificates are not accepted by some browsers if they are valid more than 13 months (397 days) and some vendors are talking about reducing that limit even further. A better alternative probably is to generate the certificate on startup so that the certificate validity starts at that time. It would be nice to be able to configure the certificate validity period (in days) and to document how users can provide their own certificate.
2. If someone is legitimately sniffing the network traffic "on the wire", TLS will make this more difficult. The private key can be exported from the container to decrypt the traffic but this is cumbersome. Using a proxy instead like Burp Suite would be easier. It should be tested and documented.

Anything else?

No response

@thomasleplus thomasleplus added the enhancement New feature or request label May 7, 2024
@thomasleplus thomasleplus self-assigned this May 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

When branches are created from issues, their pull requests are automatically linked.

1 participant