Francesco Chicchiriccò created SYNCOPE-1996:
-----------------------------------------------
Summary: Security production mode
Key: SYNCOPE-1996
URL: https://issues.apache.org/jira/browse/SYNCOPE-1996
Project: Syncope
Issue Type: Improvement
Components: core
Reporter: Francesco Chicchiriccò
Assignee: Francesco Chicchiriccò
Fix For: 4.0.8, 4.1.3, 5.0.0
A few operations, including:
* AES key truncate / padding
* JWK key padding
* default admin and anonymous credentials check
were originally introduced to support the initial setup and configuration
phases.
The same features, however, when considered in a production context, might lead
to unwanted disclosures in case the provided suggestions are not thoroughly
followed.
It makes sense, then, to introduce a new configuration property for Core which
explicitly indicates when the system is operating in production mode.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
