You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Implement TLS and enable it by default, then the session cookie could be set with the flags `SameSite=Strict`
Pros:
1. Some Identity Providers might refuse to redirect to non-TLS URLs.
2. Although "real" security is not really a concern for this debugging tool, it is always better to follow best practices whenever possible and using TLS does not impact the debugging since the network traffic remains visible in the clear in the browser's developer tools and in the debugger's console log.
3. Implementing TLS would probably future-proof the debugger since it might become mandatory at some point.
Cons:
1. Need to have add a TLS certificate. Since security is not a requirement for the debugger, it would be OK to use a self-signed certificate. But if it is baked in the `docker build`, it could expire at some point. Even if it is generated dynamically during build, if there is no new release in a while it could expire given that nowadays certificates are not accepted by some browsers if they are valid more than 13 months (397 days) and some vendors are talking about reducing that limit even further. A better alternative probably is to generate the certificate on startup so that the certificate validity starts at that time. It would be nice to be able to configure the certificate validity period (in days) and to document how users can provide their own certificate.
2. If someone is legitimately sniffing the network traffic "on the wire", TLS will make this more difficult. The private key can be exported from the container to decrypt the traffic but this is cumbersome. Using a proxy instead like Burp Suite would be easier. It should be tested and documented.
Anything else?
No response
The text was updated successfully, but these errors were encountered:
Feature description
Anything else?
No response
The text was updated successfully, but these errors were encountered: