doc: security section on readme
Massimo Melina committed
Apr 13, 2023 at 11:04 UTC
c9b999c4a567d9ef7d6c425b34da16524b4b866c
1 file changed
+15
README.md
+15
@@ -139,6 +139,21 @@ an *env* called `HFS_CONFIG`. Any relative path provided is relative to the *cwd
139
140
[Check details about config file format](https://github.com/rejetto/hfs/blob/main/config.md).
141
142
+## Security
143
+
144
+While this project focuses on ease of use, we care about security.
145
+- HTTPS support
146
+- Passwords are not saved, and user password is safe even logging in without https thanks to [SRP](https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol)
147
+- Automated tests ran on every release, including libraries audit
148
+- No default admin password
149
+
150
+Some actions you can take for improved security:
151
+- use https, better if using a proper certificate, even free with [Letsencrypt](https://letsencrypt.org/).
152
+- have a domain (ddns is ok too), start vhosting plugin, configure your domain, enable "Block requests that are not using any of the domains above"
153
+- install/start rejetto/antidos plugin. Tweak configuration if necessary.
154
+- start antibrute plugin (it's started by default)
155
+- disable "unprotected admin on localhost"
156
+
157
## Reverse proxy
158
159
HFS can work behind a reverse proxy. Configuration depends on what software you use, but this is an example using nginx