HTTP security - Revision history

Michaelh2 at 06:01, 13 April 2021

2021-04-13T06:01:04Z

← Older revision		Revision as of 06:01, 13 April 2021
Line 6:		Line 6:

	It is recommended to use secure cookies only when serving over [https://en.wikipedia.org/wiki/Transport_Layer_Security SSL]. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on.		It is recommended to use secure cookies only when serving over [https://en.wikipedia.org/wiki/Transport_Layer_Security SSL]. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on.

			==cURL blocked hosts list==

			This allows you to block Moodle's cURL implementation from accessing the specified hosts, wherever it is used to fetch content (such as by the URL downloader in the file picker). Generally it is recommended that as a minimum this is configured to prevent access to any internal network resources. The following is an example list of hosts which can be configured, which prevents access to various versions of "localhost", as well as an address commonly used by AWS and some other cloud providers to provide meta data about the server instance (169.254.169.254):

			<code php>
			127.0.0.1
			192.168.0.0/16
			10.0.0.0/8
			172.16.0.0/12
			0.0.0.0
			localhost
			169.254.169.254
			0000::1
			</code>

			In future, some logical default values such as those above will be configured automatically for new Moodle sites. See MDL-56873 for more details.

			'''Note:''' In addition to configuring this at the application level via this setting, it is also recommended that sufficient firewall/network security measures are in place, including restricting access to internal network endpoints to those users/services that require them.

			==cURL allowed ports list==

			This allows you to restrict Moodle's cURL implementation to only access the specified list of port numbers, wherever it is used to fetch content (such as by the URL downloader in the file picker). Generally it is recommended that this is configured to only allow standard web ports, as follows:

			<code php>
			80
			443
			</code>

			In future, some logical default values such as those above will be configured automatically for new Moodle sites. See MDL-56873 for more details.

			'''Note:''' In addition to configuring this at the application level via this setting, it is also recommended that sufficient firewall/network security measures are in place, including restricting access to open ports on the internal network to those users/services that require them.

	==See also==		==See also==

Marycooch: MDL-42834

2017-11-10T15:52:22Z

MDL-42834

← Older revision		Revision as of 15:52, 10 November 2017
Line 1:		Line 1:
	{{Security}}		{{Security}}
	In Moodle 3.4 onwards, the setting 'Use HTTPS for logins' (loginhttps) has been removed ~~and instead there~~ is a [[HTTPS conversion tool]] for converting embedded content to HTTPS.		*In Moodle 3.4 onwards, the setting 'Use HTTPS for logins' (loginhttps) has been removed.
			* There is a [[HTTPS conversion tool]] for converting embedded content to HTTPS.

	==Secure cookies only==		==Secure cookies only==

Tsala: spacing

2017-11-09T16:28:08Z

spacing

← Older revision		Revision as of 16:28, 9 November 2017
Line 1:		Line 1:
	{{Security}}		{{Security}}

	In Moodle 3.4 onwards, the setting 'Use HTTPS for logins' (loginhttps) has been removed and instead there is a [[HTTPS conversion tool]] for converting embedded content to HTTPS.		In Moodle 3.4 onwards, the setting 'Use HTTPS for logins' (loginhttps) has been removed and instead there is a [[HTTPS conversion tool]] for converting embedded content to HTTPS.

Tsala: loginhttps setting removed (MDL-42834)

2017-11-09T16:27:44Z

loginhttps setting removed (MDL-42834)

← Older revision		Revision as of 16:27, 9 November 2017
Line 1:		Line 1:
	{{Security}}		{{Security}}
	~~[https://en.wikipedia.org/wiki/HTTPS HTTPS] for logins can be enabled by an administrator in ''Settings > Site administration > Security > HTTP security''.~~

	~~==HTTPS for logins (deprecated - don't use)==~~		In Moodle 3.4 onwards, the setting 'Use HTTPS for logins' (loginhttps) has been removed and instead there is a [[HTTPS conversion tool]] for converting embedded content to HTTPS.
	~~[https://en~~.~~wikipedia.org/wiki/HTTPS HTTPS] encrypts the user's login data~~, ~~so it's difficult to sniff out a user's username and password on~~ the ~~network. You will need to enable HTTPS on your server before you turn on this~~ setting~~, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.~~

	~~It is not recommended that you use this setting as it~~'~~s not secure despite using~~ HTTPS for logins~~. Instead, please look at~~ [[~~Transitioning to~~ HTTPS]] ~~completely~~

	~~You are also unable~~ to ~~use the SSL proxy setting at the same time~~

	==Secure cookies only==		==Secure cookies only==
Line 16:		Line 10:

	* MDL-55662 for removing the secure cookies only setting		* MDL-55662 for removing the secure cookies only setting

	~~Forum discussions:~~
	*[http://moodle.org/mod/forum/discuss.php?d=79110 Locked out]
	*[https://moodle.org/mod/forum/discuss.php?d=339129 Secure Cookies]

	[[Category:Site administration]]		[[Category:Site administration]]

Johnok: Deprecate loginhttps

2017-09-06T03:18:37Z

Deprecate loginhttps

← Older revision		Revision as of 03:18, 6 September 2017
Line 2:		Line 2:
	[https://en.wikipedia.org/wiki/HTTPS HTTPS] for logins can be enabled by an administrator in ''Settings > Site administration > Security > HTTP security''.		[https://en.wikipedia.org/wiki/HTTPS HTTPS] for logins can be enabled by an administrator in ''Settings > Site administration > Security > HTTP security''.

	==~~Use~~ HTTPS for logins==		==HTTPS for logins (deprecated - don't use)==
	[https://en.wikipedia.org/wiki/HTTPS HTTPS] encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.		[https://en.wikipedia.org/wiki/HTTPS HTTPS] encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.

	It is not recommended that you use this setting as it's not secure despite using HTTPS for logins.		It is not recommended that you use this setting as it's not secure despite using HTTPS for logins. Instead, please look at [[Transitioning to HTTPS]] completely

	You are also unable to use the SSL proxy setting at the same time		You are also unable to use the SSL proxy setting at the same time

Germanvaleroelizondo: Added wikipedia link to [https://en.wikipedia.org/wiki/HTTPS HTTPS]

2017-08-04T14:07:27Z

Added wikipedia link to [https://en.wikipedia.org/wiki/HTTPS HTTPS]

← Older revision		Revision as of 14:07, 4 August 2017
Line 1:		Line 1:
	{{Security}}		{{Security}}
	HTTPS for logins can be enabled by an administrator in ''Settings > Site administration > Security > HTTP security''.		[https://en.wikipedia.org/wiki/HTTPS HTTPS] for logins can be enabled by an administrator in ''Settings > Site administration > Security > HTTP security''.

	==Use HTTPS for logins==		==Use HTTPS for logins==
	HTTPS encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.		[https://en.wikipedia.org/wiki/HTTPS HTTPS] encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.

	It is not recommended that you use this setting as it's not secure despite using HTTPS for logins.		It is not recommended that you use this setting as it's not secure despite using HTTPS for logins.
Line 11:		Line 11:
	==Secure cookies only==		==Secure cookies only==

	It is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on.		It is recommended to use secure cookies only when serving over [https://en.wikipedia.org/wiki/Transport_Layer_Security SSL]. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on.

	==See also==		==See also==

Tsala: page update

2017-08-04T10:25:02Z

page update

← Older revision		Revision as of 10:25, 4 August 2017
Line 11:		Line 11:
	==Secure cookies only==		==Secure cookies only==

	It is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on. ~~(It is likely that the setting will be removed in 3.2 onwards - see MDL-55662.)~~		It is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on.

	==See also==		==See also==

			* MDL-55662 for removing the secure cookies only setting

	Forum discussions:		Forum discussions:

Johnok: Recommend against loginhttps

2017-07-12T07:36:12Z

Recommend against loginhttps

← Older revision		Revision as of 07:36, 12 July 2017
Line 4:		Line 4:
	==Use HTTPS for logins==		==Use HTTPS for logins==
	HTTPS encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.		HTTPS encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.

			It is not recommended that you use this setting as it's not secure despite using HTTPS for logins.

			You are also unable to use the SSL proxy setting at the same time

	==Secure cookies only==		==Secure cookies only==

Tsala: rewording

2016-09-07T14:54:12Z

rewording

← Older revision		Revision as of 14:54, 7 September 2016
Line 7:		Line 7:
	==Secure cookies only==		==Secure cookies only==

	~~In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on i.e. it~~ is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. (It is likely that the setting will be removed in 3.2 onwards - see MDL-55662.)		It is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on. (It is likely that the setting will be removed in 3.2 onwards - see MDL-55662.)

	==See also==		==See also==

Tsala: Secure cookies only - MDL-55273

2016-09-07T14:47:09Z

Secure cookies only - MDL-55273

← Older revision		Revision as of 14:47, 7 September 2016
Line 4:		Line 4:
	==Use HTTPS for logins==		==Use HTTPS for logins==
	HTTPS encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.		HTTPS encrypts the user's login data, so it's difficult to sniff out a user's username and password on the network. You will need to enable HTTPS on your server before you turn on this setting, or else you will be locked out of your site. Every web server has a different method for enabling HTTPS, so you should check the documentation for your web server.

			==Secure cookies only==

			In Moodle 3.1.2 onwards, the 'Secure cookies only' default setting is on i.e. it is recommended to use secure cookies only when serving over SSL. When not serving over SSL, the setting is ignored. (It is likely that the setting will be removed in 3.2 onwards - see MDL-55662.)

	==See also==		==See also==