| description |
|---|
These configuration settings and recommendations are critical to the security of your production environment |
The default settings created during APIM installation can be useful for testing your new instance. However, some may not be suitable for a production environment, where security is more of a consideration. This guide highlights the APIM settings that require special attention when migrating to a production environment.
The following high-level checklist links to the details of how and why you would enforce each list item.
{% hint style="info" %} The objective is not to apply all of the recommendations, but to ensure that all configurations have been made with caution. {% endhint %}
Security checklist
- Internal APIs
- Deployment
- Review the exposition of the console and developer portal to the outside world
- Ensure the console and developer portal rest APIs are accessible through HTTPS
- Authentication
- Configure authentication using an identity provider
- Enable authentication to access the Developer Portal
- Remove all the default users
- Remove the admin user or enforce the admin user password
- Disable user self-registration for bot console and portal
- Disable auto-validation of self-registered users (if self-registration is enabled)
- Change the user session signing secret and validity duration
- Disable default application creation
- Set the registration link validity to 1 day
- Change the user reference secret
- Brute-force and browser protection
- Configure brute force protection (ReCaptcha or Fail2ban)
- Enable CSRF protection
- Configure CORS for Console and Portal REST APIs
- Configuration settings
- Change the property encryption secret
- Enable documentation page sanitizer
- Disable Webhook notifier or configure an authorized list of URLs
- APIM safe practices
{% hint style="warning" %} Configuring APIM
APIM includes many other configuration options and every environment is unique. However you configure new settings (via the gravitee.yml file, APIM Console, or environment and system variables) it is important to understand that one configuration type can override another. Configure APIM Gateway gives a good overview of this topic.
{% endhint %}