[
https://issues.apache.org/jira/browse/SYNCOPE-1996?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Francesco Chicchiriccò resolved SYNCOPE-1996.
---------------------------------------------
Resolution: Fixed
> Security production mode
> ------------------------
>
> Key: SYNCOPE-1996
> URL: https://issues.apache.org/jira/browse/SYNCOPE-1996
> Project: Syncope
> Issue Type: Improvement
> Components: core
> Reporter: Francesco Chicchiriccò
> Assignee: Francesco Chicchiriccò
> Priority: Major
> Labels: security
> Fix For: 4.0.8, 4.1.3, 5.0.0
>
>
> A few operations, including:
> * AES key truncate / padding
> * JWK key padding
> * default admin and anonymous credentials check
> were originally introduced to support the initial setup and configuration
> phases.
> The same features, however, when considered in a production context, might
> lead to unwanted disclosures in case the provided suggestions are not
> thoroughly followed.
> It makes sense, then, to introduce a new configuration property for Core
> which explicitly indicates when the system is operating in production mode.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
