You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@activemq.apache.org by Colm O hEigeartaigh <co...@apache.org> on 2020/03/24 16:46:37 UTC
[DISCUSS] - Disable REST API for AMQ 5.16.0
Hi all,
I wanted to start a discussion on whether it might be a good idea to
disable the REST API for the AMQ 5.16.0 distribution.
It makes me a bit uneasy that this is enabled by default. It is secured
using the same basic auth approach as the web console. The problem here is
that the API (correctly) lacks XSRF protection. However if the admin user
browsed to /api and the browser then saves the creds, then it would be
trivial to implement a XSRF style attack on the API. Instead, it's better
to secure a REST API with a token.
As it's a feature that's probably not widely used, it would be better to
disable it by default IMO.
Thoughts?
Colm.
Re: [DISCUSS] - Disable REST API for AMQ 5.16.0
Posted by Colm O hEigeartaigh <co...@apache.org>.
Even better would be to just disable "<import resource="jetty.xml"/>" in
activemq.xml by default. Anyone who wants the web console etc can enable it
if they want it.
Colm.
On Tue, Mar 24, 2020 at 5:28 PM Colm O hEigeartaigh <co...@apache.org>
wrote:
> Hi JB,
>
>
> You mean the admin REST API right ? Not the rest/http transport connector ?
>>
>
> Yes, what we ship in "webapps/api".
>
> Colm.
>
>
>
>>
>> Regards
>> JB
>>
>> > Le 24 mars 2020 à 17:46, Colm O hEigeartaigh <co...@apache.org> a
>> écrit :
>> >
>> > Hi all,
>> >
>> > I wanted to start a discussion on whether it might be a good idea to
>> > disable the REST API for the AMQ 5.16.0 distribution.
>> >
>> > It makes me a bit uneasy that this is enabled by default. It is secured
>> > using the same basic auth approach as the web console. The problem here
>> is
>> > that the API (correctly) lacks XSRF protection. However if the admin
>> user
>> > browsed to /api and the browser then saves the creds, then it would be
>> > trivial to implement a XSRF style attack on the API. Instead, it's
>> better
>> > to secure a REST API with a token.
>> >
>> > As it's a feature that's probably not widely used, it would be better to
>> > disable it by default IMO.
>> >
>> > Thoughts?
>> >
>> > Colm.
>>
>>
Re: [DISCUSS] - Disable REST API for AMQ 5.16.0
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi JB,
You mean the admin REST API right ? Not the rest/http transport connector ?
>
Yes, what we ship in "webapps/api".
Colm.
>
> Regards
> JB
>
> > Le 24 mars 2020 à 17:46, Colm O hEigeartaigh <co...@apache.org> a
> écrit :
> >
> > Hi all,
> >
> > I wanted to start a discussion on whether it might be a good idea to
> > disable the REST API for the AMQ 5.16.0 distribution.
> >
> > It makes me a bit uneasy that this is enabled by default. It is secured
> > using the same basic auth approach as the web console. The problem here
> is
> > that the API (correctly) lacks XSRF protection. However if the admin user
> > browsed to /api and the browser then saves the creds, then it would be
> > trivial to implement a XSRF style attack on the API. Instead, it's better
> > to secure a REST API with a token.
> >
> > As it's a feature that's probably not widely used, it would be better to
> > disable it by default IMO.
> >
> > Thoughts?
> >
> > Colm.
>
>
Re: [DISCUSS] - Disable REST API for AMQ 5.16.0
Posted by Jean-Baptiste Onofre <jb...@nanthrax.net>.
Hi,
You mean the admin REST API right ? Not the rest/http transport connector ?
Regards
JB
> Le 24 mars 2020 à 17:46, Colm O hEigeartaigh <co...@apache.org> a écrit :
>
> Hi all,
>
> I wanted to start a discussion on whether it might be a good idea to
> disable the REST API for the AMQ 5.16.0 distribution.
>
> It makes me a bit uneasy that this is enabled by default. It is secured
> using the same basic auth approach as the web console. The problem here is
> that the API (correctly) lacks XSRF protection. However if the admin user
> browsed to /api and the browser then saves the creds, then it would be
> trivial to implement a XSRF style attack on the API. Instead, it's better
> to secure a REST API with a token.
>
> As it's a feature that's probably not widely used, it would be better to
> disable it by default IMO.
>
> Thoughts?
>
> Colm.