summaryrefslogtreecommitdiff
path: root/doc
diff options
context:
space:
mode:
authorGitLab Bot <gitlab-bot@gitlab.com>2021-02-10 23:16:10 +0000
committerGitLab Bot <gitlab-bot@gitlab.com>2021-02-10 23:16:38 +0000
commit21585f82e753689cc46f59c02d8e207756d794bf (patch)
tree493d73c46d111ef3805760aa4092aaf67af43182 /doc
parent08a8aa66ef41708976c27734587fc06e489a134f (diff)
downloadgitlab-ce-21585f82e753689cc46f59c02d8e207756d794bf.tar.gz
Add latest changes from gitlab-org/security/gitlab@13-8-stable-ee
Diffstat (limited to 'doc')
-rw-r--r--doc/user/project/integrations/prometheus.md2
1 files changed, 2 insertions, 0 deletions
diff --git a/doc/user/project/integrations/prometheus.md b/doc/user/project/integrations/prometheus.md
index 959c4cc623b..1507cea348a 100644
--- a/doc/user/project/integrations/prometheus.md
+++ b/doc/user/project/integrations/prometheus.md
@@ -182,6 +182,8 @@ service account can be found at Google's documentation for
Prometheus OAuth Client secured with Google IAP.
1. (Optional) In **Google IAP Service Account JSON**, provide the contents of the
Service Account credentials file that is authorized to access the Prometheus resource.
+ The JSON key `token_credential_uri` is discarded to prevent
+ [Server-side Request Forgery (SSRF)](https://www.hackerone.com/blog-How-To-Server-Side-Request-Forgery-SSRF).
1. Click **Save changes**.
![Configure Prometheus Service](img/prometheus_manual_configuration_v13_2.png)