Serge Huber created UNOMI-972:
---------------------------------
Summary: Harden default credentials, public profile binding, and
privileged REST endpoints
Key: UNOMI-972
URL: https://issues.apache.org/jira/browse/UNOMI-972
Project: Apache Unomi
Issue Type: Improvement
Components: unomi(-core)
Affects Versions: unomi-3.1.0
Reporter: Serge Huber
Assignee: Serge Huber
Fix For: unomi-3.1.0
h2. Summary
Defense-in-depth hardening for Unomi 3.1 around credentials, public context
profile binding, and privileged extension REST endpoints.
h2. Goals
# Do not ship a known default root/health password. Require
{{UNOMI_ROOT_PASSWORD}} and {{UNOMI_HEALTHCHECK_PASSWORD}} at startup (setenv /
Docker entrypoint / compose). Document the change.
# For public callers of context/eventcollector: treat the profile cookie as the
only profile bearer; ignore body {{profileId}}. Refuse session-driven profile
switches without a matching cookie. Default profile cookie HttpOnly to {{true}}.
# Restrict Groovy Actions and Router import/export REST endpoints to the system
{{ADMINISTRATOR}} role (not tenant administrator).
# For {{MergeProfilesOnPropertyAction}} and {{UpdatePropertiesAction}}: refuse
cross-profile merge/update and {{systemProperties}} writes unless the caller is
a trusted identity (system admin or tenant admin).
h2. Acceptance
* Unit tests for password config, profile binding, role annotations, actions
* Integration tests covering public vs private key behavior
* Docs updated (getting started, configuration, docker README)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
