[Dashboard] Security
- 主要言語
- TypeScript
- スター
- 8
- フォーク
- 0
- PR マージ指標
- 30日以内にマージされた PR はありません
説明
The dashboard needs to be secure. The following endpoints need to be verified that they are hardened:
- [ ] `GET /api/pipelines` and `GET /api/pipelines/:pid` must only expose relevant information.
- [ ] `GET /api/pipelines/:pid/config` and `POST /api/pipelines/:pid/config` must only be accessible to assignees.
- [ ] `GET /api/runs/:pid/:rid/log` and `GET /api/runs/:pid/:rid/archived` are accessible only if the pipeline is public or the requester is assigned.
- [ ] `POST /trigger/:token` needs to be widely accessible.
Furthermore, CORS and cookie include needs to be set:
- [ ] When running in production, only allow same origin for `mode` and `cookies` in `fetch`.
- [ ] Otherwise, allow cross origin requests.
Lastly:
- [x] An instance of the dashboard should be tested against SSLLabs and receive an A+.
コントリビューションガイド
このリポジトリのコントリビューションガイドは索引されていません
評価
この issue はまだ評価されていません。