Atlassian uses cookies to improve your browsing experience, perform analytics and research, and conduct advertising. Accept all cookies to indicate that you agree to our use of cookies on your device. Atlassian cookies and tracking notice, (opens new window)
@John Coburn trying to get this lined up for next sprint
@John Coburn to discuss with another developer (Maccabee) who is familiar with CSPs.
John had the chance to look on it but only via metatag need to try out or examine http header configuration at the server side
Some things happen in stripes modularity too which might have impact too
@John Coburn is making progress - has done some testing locally, but wants to exercise it in a more realistic env.
@John Coburn provided update on CSP effort.
Experimenting with express to provide CSP (for local dev purposes). Production systems wouldn't use this, it would be formalized by the hosting provider.
This allows for local testing and experiments.
Today:
Deferred to discuss this when John is around
1 min
Disable tenant checking to support multi tenant requests (MODAT-143).
@Julian Ladisch will discuss his concerns with Olamide, etc. and we can discuss here again if/when needed.
There's a need to allow for the user to easily switch between tenant contexts
Maybe making this opt-in is a reasonable approach
the restriction would remain unchanged by default, but you could relax this constraint by making an explicit configuration change
@Julian Ladisch met with Thunderjet/Olamide
mod-consortia/ui-consortia have been submitted for TC review
This will probably be raised as part of those reviews
Added a comment to the https://folio-org.atlassian.net/browse/TCR-26: Security team disagree with breaking the tenant seperation on okapi token level. We would like to encourage an alternative solution on saml or openid techniques which would be less invasive to the current approach.
TC would like to split off the security/token concerns from the module acceptance, will be discussed next Wednesday TC's meeting
@Craig McNally to raise this with the TC again and get the ball rolling on discussing the larger topic (e.g. via a subgroup? RFC? something else?)
Will involve Axel and Julian to a subgroup
The TC approved mod-consortia, but also wanted to discuss the concerns raised about tenant isolation and relaxing tenant checks in certain circumstances. The TC plans to discuss on Monday 6/5 11:00 AM ET. → Julian and Axel to join the meeting
PO Charlotte Whitt requested: "While we need to be careful about spending our available developer time wisely, it would be helpful if you could indicate whether this work is a must fix now, or something we can fix when/if we decide to build the FOLIO Harvester module."
What advice does the security team give? Fix now or postpone to 2024?
Topic Backlog
Retiring issues which have been open for a long time w/o progress
All
Discussed gathering a report for the TC to review/approve. Need to work out details/logistics.
Query so far:
labels = Security AND created < '-52w' AND status != closed AND status != completed AND status != Cancelled
Bot Detection/Control
All
Not a huge problem due to needing to authenticate first, and the user has the required permissions to get the information sought after.
If using AWS, WAF bot control may provide some protection w/ little effort - @Skott Klebe to investigate.
@Craig McNally to check in with Skott on this
Time slot
All
Do we need a better time slot for the security team meeting to allow more members to join?
Logging & Personal Data
Craig/Team
A developer recently reached to me asking if the security team or TC has guidance or rules in place for logging of personal data. Some guidelines are documented on the wiki, but I'm wondering if it's worth making some clarifications and creating a draft decision record for the TC to formally endorse
Is this even in our purview? Should we seek input from the Privacy SIG? Should I raise this with the TC first?
Next steps:
For now, put this on hold. See how the Draft DR approach works for the periodic dependency updates (see above). If that goes smoothly, we'll take this on next. Otherwise we'll consider other approaches.