Security.json

Cautions¶

When changing parameters, please refer to "Confirmation When Changing Parameters".

Limitations¶

About Departments/Groups Set in IpRestrictionExcludeMembers¶

If you allow access to Pleasanter on a department/group basis, using the "Department Management Function" or "Group Management Function" to delete or disable the relevant department/group, or to delete the users belonging to it, will result in the users no longer being able to access Pleasanter. Suppose a user with important administrative privileges, such as a tenant manager, is no longer able to access Pleasanter. In that case, it may be necessary to change the IP address of the device they are using or reconfigure "Security.json". Please be careful when deleting/disabling departments/groups set in IpRestrictionExcludeMembers, or deleting users belonging to them.

*If you are not restricting access by IP address using AllowIpAddresses, there is no need to consider the above restrictions.

Setting Values¶

The setting values of this parameter file are as follows.

AllowIpAddresses/IpRestrictionExcludeMembers combination¶

Please set AllowIpAddresses/IpRestrictionExcludeMembers using any combination of 1. to 3. below.

1. AllowIpAddresses：null / IpRestrictionExcludeMembers：null

   Content	Target access
   Connections to allow access	Access from any IP address
   Connections that restrict access	None

2. AllowIpAddresses: Set IP address / IpRestrictionExcludeMembers: null

   Content	Target access
   Connections to allow access	Access from the IP address set in AllowIpAddresses
   Connections that restrict access	Access from IP addresses other than those set in AllowIpAddresses

3. AllowIpAddresses: Set IP addresses / IpRestrictionExcludeMembers: Set user ID/department ID/group ID according to the "Example of IpRestrictionExcludeMembers settings" described later.

   Content	Target access
   Connections that allow access	(1) Access from IP addresses set in AllowIpAddresses (2) Access from IP addresses other than those set in AllowIpAddresses, and access by users permitted in the format of "Example of IpRestrictionExcludeMembers settings" described below
   Connections that restrict access	Access from IP addresses other than those set in AllowIpAddresses, and access by users other than those permitted in the format of "Example of IpRestrictionExcludeMembers settings" described below

IpRestrictionExcludeMembers configuration example¶

If you specify multiple IDs in IpRestrictionExcludeMembers separated by commas, such as ["User1","Dept1","Group1"], access will be allowed for users that match any of them.

Set Password Policies¶

Example of Regular Expression Set in Regex¶

Set SecondaryAuthentication¶

*1 It has been discontinued since Pleasanter 1.3.2.0 and Pleasanter .NET Framework version 0.51.2 and later versions. Please use Mode as an alternative parameter.

*2 For details on each authentication method, please refer to the following manuals.
Enable two-step authentication by email
Enable two-step authentication by TOTP (Time-based One-Time Password)

Set Mode¶

Set HttpStrictTransportSecurity¶

About HTTP Strict Transport Security (HSTS)¶

HTTP Strict Transport Security (HSTS) is an opt-in security enhancement specified by web apps using a response header. When a browser that supports HSTS receives this header:

• The browser stores a configuration for domains that cannot send communication over HTTP. The browser forces all communication to occur over HTTPS.
• The browser prevents users from using untrusted or invalid certificates. The browser disables prompts that allow users to temporarily trust such certificates.

For details, please refer to the document below.
HTTP Strict Transport Security Protocol (HSTS)|Microsoft Learn

Parameter List¶

Set SecureCacheControl¶

*If any of NoCache, NoStore, Private, and MustRevalidate is set to true, a Cache-Control header will be added to the response.

*Please refer to the following document for details of each parameter.
Cache-Control|MDN
Pragma|MDN

Set HealthCheck¶

Parameter List¶

*The database connection check is performed using the connection string set in UserConnectionString of Rds.json.

EnableDetailedResponse¶

entries¶

Reference Information¶

For details on the above parameters (properties), please refer to the official Microsoft documentation.
Routing in ASP.NET Core > Host matching in routes with RequireHost
HealthReport Class (Microsoft.Extensions.Diagnostics.HealthChecks)
HealthReportEntry Struct (Microsoft.Extensions.Diagnostics.HealthChecks)

Set ContentSecurityPolicy¶

Parameter List¶

*3 When set to true, if a policy violation is detected, a violation report will be output to the browser’s console log and the loading of the violating resource will be blocked.
*4 When set to true, if a policy violation is detected, a violation report will be output to the browser’s console log.
*5 If a report-uri is specified, a violation report will be sent.
*6 When setting Enabled to true, please first set ReportOnlyEnabled to true and confirm that there is no impact on the operation of Pleasanter before enabling it.

Values¶

For details about each parameter’s configuration values please refer to MDN Web Docs: Content Security Policy (CSP).
If you change the parameter values, please set ReportOnlyEnabled to true and confirm that there is no impact on the operation of Pleasanter.

Set CaptchaConfig¶

ForwardedHeaders¶

This parameter specifies the networks and IP addresses to trust as reverse proxies. It is used for the following two purposes, each of which has an independent effect.

1. Restricting the sources for trusted proxy authentication (see TrustedProxyParameters in Authentication.json)
   If this parameter is set, only requests whose source IP matches either KnownNetworks or KnownProxies are subject to automatic login.
   If both are empty, 1.5.7.0 and later do not perform automatic login by trusted proxy authentication. In 1.5.6.x and earlier, verification of the source IP is skipped (requests from all sources are subject to automatic login).
2. Suppressing warning logs from the Forwarded Headers Middleware
   In .NET 8 environments, when running Pleasanter in a clustering configuration, warning logs such as the following may be displayed.

pleasanter-1  | warn: Microsoft.AspNetCore.HttpOverrides.ForwardedHeadersMiddleware[1]
pleasanter-1  |       Unknown proxy: [::ffff:172.18.0.4]:45988

This occurs because the ASP.NET Core Forwarded Headers Middleware recognizes the IP address of the proxy that sent the request as untrusted. In a Docker environment, this warning may be displayed because the internal IP addresses used for communication between containers are assigned dynamically. Setting this parameter correctly suppresses this warning log.

Supported Versions¶

Related Information¶

• Confirmation When Changing Parameters
• User Management Function: Privileged User Settings
• Form
• User Management Function
• Enable the Health Check Function of Pleasanter
• Content Security Policy Function
• Trusted Reverse Proxy Authentication
• Authentication.json
• Enable two-step authentication by email
• Enable two-step authentication by TOTP (Time-based One-Time Password)
• ASP.NET Core Data Protection Configuration
• Data Protection key management and lifetimes in ASP.NET Core
• Key storage providers in ASP.NET Core
• HTTP Strict Transport Security Protocol (HSTS)|Microsoft Learn
• Cache-Control|MDN
• Pragma|MDN
• Rds.json
• Routing in ASP.NET Core > Host matching in routes with RequireHost
• HealthReport Class (Microsoft.Extensions.Diagnostics.HealthChecks)
• HealthReportEntry Struct (Microsoft.Extensions.Diagnostics.HealthChecks)
• MDN Web Docs: Content Security Policy (CSP)
• Register Credentials in System Environment Variables
• Service.json
• Store ASP.NET Core Data Protection Keys Externally