Many services use regular HTTP behind nginx and exozyme users may be able to view that traffic

a commented

2021-12-23 17:32:37 +00:00

Owner

I think this is a pretty big security issue, but I'm not exactly sure if exozyme users are able to view the HTTP traffic. More investigation is definitely needed.

a added the

labels 2021-12-23 17:32:37 +00:00

a added this to the (deleted) project 2021-12-23 17:32:37 +00:00

a added a new dependency 2022-01-04 22:53:50 +00:00

#87 Replace TCP sockets for our services with Unix sockets

a commented

2022-01-05 00:02:52 +00:00

Author

Owner

We're currently using Unix sockets for many services but our permissions are pretty weak.

a commented

2022-01-05 17:55:54 +00:00

Author

Owner

I improved our Unix socket permissions which is being tracked in issue #87.

a commented

2022-01-05 19:40:44 +00:00

Author

Owner

It should be safe: https://stackoverflow.com/questions/522012/can-traffic-on-loopback-be-packet-sniffed#522046 https://security.stackexchange.com/questions/57230/encrypt-and-authenticate-localhost-traffic

a removed a dependency 2022-01-05 22:15:47 +00:00

#87 Replace TCP sockets for our services with Unix sockets

a closed this issue

2022-01-05 22:15:55 +00:00

a added the

wontfix

label 2022-01-11 14:18:03 +00:00

Many services use regular HTTP behind nginx and exozyme users may be able to view that traffic #82