diff options
| author | GitLab Bot <gitlab-bot@gitlab.com> | 2021-02-10 23:16:10 +0000 |
|---|---|---|
| committer | GitLab Bot <gitlab-bot@gitlab.com> | 2021-02-10 23:16:38 +0000 |
| commit | 21585f82e753689cc46f59c02d8e207756d794bf (patch) | |
| tree | 493d73c46d111ef3805760aa4092aaf67af43182 /doc/user | |
| parent | 08a8aa66ef41708976c27734587fc06e489a134f (diff) | |
| download | gitlab-ce-21585f82e753689cc46f59c02d8e207756d794bf.tar.gz | |
Add latest changes from gitlab-org/security/gitlab@13-8-stable-ee
Diffstat (limited to 'doc/user')
| -rw-r--r-- | doc/user/project/integrations/prometheus.md | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/doc/user/project/integrations/prometheus.md b/doc/user/project/integrations/prometheus.md index 959c4cc623b..1507cea348a 100644 --- a/doc/user/project/integrations/prometheus.md +++ b/doc/user/project/integrations/prometheus.md @@ -182,6 +182,8 @@ service account can be found at Google's documentation for Prometheus OAuth Client secured with Google IAP. 1. (Optional) In **Google IAP Service Account JSON**, provide the contents of the Service Account credentials file that is authorized to access the Prometheus resource. + The JSON key `token_credential_uri` is discarded to prevent + [Server-side Request Forgery (SSRF)](https://www.hackerone.com/blog-How-To-Server-Side-Request-Forgery-SSRF). 1. Click **Save changes**.  |