summaryrefslogtreecommitdiff
path: root/doc/security
diff options
context:
space:
mode:
authorBrett Walker <bwalker@gitlab.com>2019-02-20 17:51:55 -0600
committerBrett Walker <bwalker@gitlab.com>2019-08-23 23:44:53 -0500
commitad05e488636ebe05b4985dbf3c7d912fd8d56f49 (patch)
tree427b631b34fa8ed7511f3ed789185cd82a1a6da9 /doc/security
parent892e4c0da818006159cc26bc79f1fa48b76c9b3f (diff)
downloadgitlab-ce-ad05e488636ebe05b4985dbf3c7d912fd8d56f49.tar.gz
Add support for using a Camo proxy server
User images and videos will get proxied through the Camo server in order to keep malicious sites from collecting the IP address of users.
Diffstat (limited to 'doc/security')
-rw-r--r--doc/security/README.md1
-rw-r--r--doc/security/asset_proxy.md28
2 files changed, 29 insertions, 0 deletions
diff --git a/doc/security/README.md b/doc/security/README.md
index 5d498ac7602..fa34f07060e 100644
--- a/doc/security/README.md
+++ b/doc/security/README.md
@@ -17,3 +17,4 @@ type: index
- [Enforce Two-factor authentication](two_factor_authentication.md)
- [Send email confirmation on sign-up](user_email_confirmation.md)
- [Security of running jobs](https://docs.gitlab.com/runner/security/)
+- [Proxying images](asset_proxy.md)
diff --git a/doc/security/asset_proxy.md b/doc/security/asset_proxy.md
new file mode 100644
index 00000000000..f25910d3db7
--- /dev/null
+++ b/doc/security/asset_proxy.md
@@ -0,0 +1,28 @@
+A possible security concern when managing a public facing GitLab instance is
+the ability to steal a users IP address by referencing images in issues, comments, etc.
+
+For example, adding `![Example image](http://example.com/example.png)` to
+an issue description will cause the image to be loaded from the external
+server in order to be displayed. However this also allows the external server
+to log the IP address of the user.
+
+One way to mitigate this is by proxying any external images to a server you
+control. GitLab handles this by allowing you to run the "Camo" server
+[cactus/go-camo](https://github.com/cactus/go-camo#how-it-works).
+The image request is sent to the Camo server, which then makes the request for
+the original image. This way an attacker only ever seems the IP address
+of your Camo server.
+
+Once you have your Camo server up and running, you can configure GitLab to
+proxy image requests to it. The following settings are supported:
+
+| Attribute | Description |
+| ------------------------ | ----------- |
+| `asset_proxy_enabled` | (**If enabled, requires:** `asset_proxy_url`) Enable proxying of assets. |
+| `asset_proxy_secret_key` | Shared secret with the asset proxy server. |
+| `asset_proxy_url` | URL of the asset proxy server. |
+| `asset_proxy_whitelist` | Assets that match these domain(s) will NOT be proxied. Wildcards allowed. Your GitLab installation URL is automatically whitelisted. |
+
+These can be set via the [Application setting API](../api/settings.md)
+
+Note that a GitLab restart is required to apply any changes.