From 488e5f8a0a0b7baad06aa6f8345a2a7f2ac36c57 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Maniaci?= <stephane.maniaci@beta.gouv.fr>
Date: Wed, 1 Feb 2023 11:07:22 +0100
Subject: [PATCH] Revert "config: Add a flag to control the /metrics and
/status endpoints"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This reverts commit d10ead4c6c5398595c5e05a4d61b2c0cede6cbf8.
Signed-off-by: Stéphane Maniaci <stephane.maniaci@beta.gouv.fr>
---
app.js | 18 +++-------------
docs/content/configuration.md | 40 ++++++++++++++++-------------------
lib/config/default.js | 4 ----
lib/config/environment.js | 4 ----
public/docs/release-notes.md | 3 ---
5 files changed, 21 insertions(+), 48 deletions(-)
diff --git a/app.js b/app.js
index 9a36a0941..34a107ae1 100644
--- a/app.js
+++ b/app.js
@@ -75,10 +75,8 @@ app.use(morgan('combined', {
}))
// Register prometheus metrics endpoint
-if (config.observability.exposeMetrics) {
- app.use(apiMetrics())
- metrics.setupCustomPrometheusMetrics()
-}
+app.use(apiMetrics())
+metrics.setupCustomPrometheusMetrics()
// socket io
const io = require('socket.io')(server, { cookie: false })
@@ -228,17 +226,7 @@ app.locals.enableGitHubGist = config.isGitHubEnable
app.locals.enableGitlabSnippets = config.isGitlabSnippetsEnable
app.use(require('./lib/web/baseRouter'))
-
-if (config.observability.exposeStatus) {
- app.use(require('./lib/web/statusRouter'))
-} else {
- // the `/status` route is used by the hedgedoc container's
- // healtcheck route so keep the endpoint alive
- app.get('/status', function (req, res, next) {
- res.sendStatus(200)
- })
-}
-
+app.use(require('./lib/web/statusRouter'))
app.use(require('./lib/web/auth'))
app.use(require('./lib/web/historyRouter'))
app.use(require('./lib/web/userRouter'))
diff --git a/docs/content/configuration.md b/docs/content/configuration.md
index 927c19700..cbec325ca 100644
--- a/docs/content/configuration.md
+++ b/docs/content/configuration.md
@@ -76,28 +76,24 @@ these are rarely used for various reasons.
## Web security aspects
-| config file | environment | **default** and example value | description |
-|-------------------------------|------------------------------------|-------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `hsts` | | `{"enable": true, "maxAgeSeconds": 31536000, "includeSubdomains": true, "preload": true}` | [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) options to use with HTTPS (default is the example value, max age is a year) |
-| | `CMD_HSTS_ENABLE` | **`true`** or `false` | set to enable [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) if HTTPS is also enabled (default is ` true`) |
-| | `CMD_HSTS_INCLUDE_SUBDOMAINS` | **`true`** or `false` | set to include subdomains in HSTS (default is `true`) |
-| | `CMD_HSTS_MAX_AGE` | **`31536000`**, `60 * 60 * 24 * 365` | max duration in seconds to tell clients to keep HSTS status (default is a year) |
-| | `CMD_HSTS_PRELOAD` | **`true`** or `false` | whether to allow preloading of the site's HSTS status (e.g. into browsers) |
-| `csp` | | `{"enable": true, "addDefaults": true}` | Nested object to configure the Content Security Policy |
-| `csp.enable` | `CMD_CSP_ENABLE` | **`true`** or `false` | Whether to apply a `Content-Security-Policy` header to responses. We don't recommend disabling this option, as it significantly reduces the security of the application. |
-| `csp.addDefaults` | | **`true`** or `false` | Disable to not include the default CSP. Be careful, this will break the application if the correct directives are not set manually. |
-| `csp.directives` | | **no default**, `{"scriptSrc": "trustworthy-scripts.example.com"}` | Custom CSP directives. These are passed to Helmet - see [their documentation](https://helmetjs.github.io/docs/csp/) for more information on the format. |
-| `csp.addDisqus` | `CMD_CSP_ADD_DISQUS` | **`false`** or `true` | Enable to allow users to add Disqus comments to their notes or presentations. We don't recommend enabling this option, as it increases the attack surface of XSS attacks. |
-| `csp.addGoogleAnalytics` | `CMD_CSP_ADD_GOOGLE_ANALYTICS` | **`false`** or `true` | Enable to allow users to add Google Analytics to their notes. We don't recommend enabling this option, as it increases the attack surface of XSS attacks. |
-| `csp.upgradeInsecureRequests` | | **`auto`** or `true` or `false` | By default (`auto`), insecure (HTTP) requests are upgraded to HTTPS via CSP if `useSSL` is on. To change this behaviour, set to either `true` or `false`. |
-| `csp.reportUri` | `CMD_CSP_REPORTURI` | **`undefined`**, `https://<someid>.report-uri.com/r/d/csp/enforce` | Allows to add a URL for CSP reports in case of violations. |
-| `csp.allowFraming` | `CMD_CSP_ALLOW_FRAMING` | **`true`** or `false` | Disable to disallow embedding of the instance via iframe. We **strongly recommend disabling** this option, as it increases the attack surface of XSS attacks. |
-| `csp.allowPDFEmbed` | `CMD_CSP_ALLOW_PDF_EMBED` | **`true`** or `false` | Disable to disallow embedding PDFs. We recommend disabling this option, as it increases the attack surface of XSS attacks. |
-| `cookiePolicy` | `CMD_COOKIE_POLICY` | **`lax`**, `strict` or `none` | Set a SameSite policy whether cookies are send from cross-origin. Be careful: setting a SameSite value of none without https breaks the editor. |
-| `observability.exposeMetrics | `CMD_OBSERVABILITY_EXPOSE_METRICS` | **true** or `false` | Controls whether the /metrics endpoint is exposed. |
-| `observability.exposeStatus | `CMD_OBSERVABILITY_EXPOSE_STATUS` | **true** or `false` | Controls whether the /status routes are exposed. Note that /status will still return 200 for healthcheck purposes, but no data will be exposed. |
-|
-
+| config file | environment | **default** and example value | description |
+| ----------------------------- | ------------------------------ | ------------------------------------------------------------------------------------------| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `hsts` | | `{"enable": true, "maxAgeSeconds": 31536000, "includeSubdomains": true, "preload": true}` | [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) options to use with HTTPS (default is the example value, max age is a year) |
+| | `CMD_HSTS_ENABLE` | **`true`** or `false` | set to enable [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) if HTTPS is also enabled (default is ` true`) |
+| | `CMD_HSTS_INCLUDE_SUBDOMAINS` | **`true`** or `false` | set to include subdomains in HSTS (default is `true`) |
+| | `CMD_HSTS_MAX_AGE` | **`31536000`**, `60 * 60 * 24 * 365` | max duration in seconds to tell clients to keep HSTS status (default is a year) |
+| | `CMD_HSTS_PRELOAD` | **`true`** or `false` | whether to allow preloading of the site's HSTS status (e.g. into browsers) |
+| `csp` | | `{"enable": true, "addDefaults": true}` | Nested object to configure the Content Security Policy |
+| `csp.enable` | `CMD_CSP_ENABLE` | **`true`** or `false` | Whether to apply a `Content-Security-Policy` header to responses. We don't recommend disabling this option, as it significantly reduces the security of the application. |
+| `csp.addDefaults` | | **`true`** or `false` | Disable to not include the default CSP. Be careful, this will break the application if the correct directives are not set manually. |
+| `csp.directives` | | **no default**, `{"scriptSrc": "trustworthy-scripts.example.com"}` | Custom CSP directives. These are passed to Helmet - see [their documentation](https://helmetjs.github.io/docs/csp/) for more information on the format. |
+| `csp.addDisqus` | `CMD_CSP_ADD_DISQUS` | **`false`** or `true` | Enable to allow users to add Disqus comments to their notes or presentations. We don't recommend enabling this option, as it increases the attack surface of XSS attacks. |
+| `csp.addGoogleAnalytics` | `CMD_CSP_ADD_GOOGLE_ANALYTICS` | **`false`** or `true` | Enable to allow users to add Google Analytics to their notes. We don't recommend enabling this option, as it increases the attack surface of XSS attacks. |
+| `csp.upgradeInsecureRequests` | | **`auto`** or `true` or `false` | By default (`auto`), insecure (HTTP) requests are upgraded to HTTPS via CSP if `useSSL` is on. To change this behaviour, set to either `true` or `false`. |
+| `csp.reportUri` | `CMD_CSP_REPORTURI` | **`undefined`**, `https://<someid>.report-uri.com/r/d/csp/enforce` | Allows to add a URL for CSP reports in case of violations. |
+| `csp.allowFraming` | `CMD_CSP_ALLOW_FRAMING` | **`true`** or `false` | Disable to disallow embedding of the instance via iframe. We **strongly recommend disabling** this option, as it increases the attack surface of XSS attacks. |
+| `csp.allowPDFEmbed` | `CMD_CSP_ALLOW_PDF_EMBED` | **`true`** or `false` | Disable to disallow embedding PDFs. We recommend disabling this option, as it increases the attack surface of XSS attacks. |
+| `cookiePolicy` | `CMD_COOKIE_POLICY` | **`lax`**, `strict` or `none` | Set a SameSite policy whether cookies are send from cross-origin. Be careful: setting a SameSite value of none without https breaks the editor. |
## Privacy and External Requests
diff --git a/lib/config/default.js b/lib/config/default.js
index e2b7b2c63..88cc63069 100644
--- a/lib/config/default.js
+++ b/lib/config/default.js
@@ -29,10 +29,6 @@ module.exports = {
allowFraming: true,
allowPDFEmbed: true
},
- observability: {
- exposeMetrics: true,
- exposeStatus: true
- },
cookiePolicy: 'lax',
protocolUseSSL: false,
allowAnonymous: true,
diff --git a/lib/config/environment.js b/lib/config/environment.js
index cfa1f6d69..65d647369 100644
--- a/lib/config/environment.js
+++ b/lib/config/environment.js
@@ -18,10 +18,6 @@ module.exports = {
includeSubdomains: toBooleanConfig(process.env.CMD_HSTS_INCLUDE_SUBDOMAINS),
preload: toBooleanConfig(process.env.CMD_HSTS_PRELOAD)
},
- observability: {
- exposeMetrics: toBooleanConfig(process.env.CMD_OBSERVABILITY_EXPOSE_METRICS),
- exposeStatus: toBooleanConfig(process.env.CMD_OBSERVABILITY_EXPOSE_STATUS)
- },
csp: {
enable: toBooleanConfig(process.env.CMD_CSP_ENABLE),
reportURI: process.env.CMD_CSP_REPORTURI,
diff --git a/public/docs/release-notes.md b/public/docs/release-notes.md
index 9e152e138..50e3ad6c8 100644
--- a/public/docs/release-notes.md
+++ b/public/docs/release-notes.md
@@ -2,9 +2,6 @@
## UNRELEASED
-### Enhancements
-- Allow disabling the /metrics and /status endpoints
-
### Bugfixes
- Fix note titles with special characters producing invalid file names in user export zip file