Feature #22613: Update install scripts/docs to enable external access to HTTP services in containers - Arvados

Actions

Copy link

Feature #22613

open

Update install scripts/docs to enable external access to HTTP services in containers

Added by Tom Clegg 20 days ago. Updated 7 days ago.

Status:

New

Priority:

Normal

Assigned To:

Category:

Deployment

Target version:

Future

Story points:

Description

Wildcard DNS, wildcard TLS certificates, Nginx configuration, config entry with wildcard ExternalURL similar to Services.WebDAV.

To mitigate DNS rebinding attacks, controller routing code -- and any auto-generated/example Nginx configs -- should check that the requested URL matches the configured ExternalURL. Currently, controller routing code accepts {container-uuid}-{port}{anything}, which (assuming no protection from downstream proxies) is a DNS rebinding hazard.

Related issues 1 (1 open — 0 closed)