Security page — BookStack

Cited by

Facts read from this source

• Security mailing list Report an error

  “If you’d like to be notified of new potential security concerns you can sign-up to the BookStack security mailing list.”

• MFA user enabled Report an error

  “Any user can enable multi-factor authentication (MFA) on their account.”

• MFA mechanisms Report an error

  “BookStack currently supports the following mechanisms: TOTP (Time-based One-Time Passwords)”

• MFA backup codes Report an error

  “These are a list of 16 one-time-use codes.”

• MFA forced by role Report an error

  “Where required, MFA can be forced upon users via their roles.”

• MFA storage encrypted Report an error

  “Secrets and values for these options are stored encrypted within the database.”

• Images public by default Report an error

  “By default, images are stored in a way which is publicly accessible which ensures performance while using BookStack.”

• Secure image uploads option Report an error

  “Enabling this will add a 16 character random string to the name of image files to prevent easy guessing of URLs.”

• Attachments auth protected by default Report an error

  “By default, unlike images, these are stored behind the application authentication layer so access depends on permissions you have set up at a role level and page level.”

• Attachment s3 storage Report an error

  “If you are using Amazon S3 for file storage then access will depend on your S3 permission settings.”

• Password hashing Report an error

  “These are hashed using the standard Laravel hashing methods which use the Bcrypt hashing algorithm.”

• Content filtering Report an error

  “By default, BookStack filters a range of potentially dangerous elements from user content on render.”

• Robots control Report an error

  “The rules found in the /robots.txt file are automatically controlled via the “Allow public viewing?” setting.”

• Secure cookies Report an error

  “If you have set a https APP_URL option in your .env this will enabled automatically but it can also be forced on by setting SESSION_SECURE_COOKIE=true in your .env file.”

• Iframe embedding restricted by default Report an error

  “By default BookStack will only allow itself to be embedded within iframes on the same domain as you’re hosting on.”

• Iframe embed samesite note Report an error

  “when this option is used, all cookies will served with SameSite=None”

• Iframe sources default Report an error

  “ALLOWED_IFRAME_SOURCES="https://*.draw.io https://*.youtube.com https://*.youtube-nocookie.com https://*.vimeo.com"”

• Failed login logging Report an error

  “An option is available to log failed login events to a log file which is useful to identify users having trouble logging in, track malicious login attempts or to use with tools such as Fail2Ban.”

• Failed login scope Report an error

  “This works with login attempts using the default email & password login mechanism or attempts via LDAP login. Failed attempts are not logged for “one-click” social or SAML2 options.”

• Untrusted server fetching Report an error

  “This is disabled by default but can be enabled if desired. This is required for using WKHTMLtoPDF as your PDF export renderer.”

• Ssr allow list Report an error

  “In such scenarios, you can define a ALLOWED_SSR_HOSTS option in your .env file to limit the hosts that can be called for such typically trusted functionality”

• Csp header Report an error

  “BookStack serves responses with a CSP header to increase protection against malicious content.”

• Csp script nonce Report an error

  “The nonce value used is randomly generated upon each request.”

• Csp configurable style image sources Report an error

  “the ALLOWED_STYLE_SOURCES and ALLOWED_IMAGE_SOURCES options can be used.”

• Mysql ssl Report an error

  “you can enable this by defining the MYSQL_ATTR_SSL_CA option in your .env file”

• Trusted proxies Report an error

  “For these scenarios, an APP_PROXIES option in your .env file can be set to indicate trust of systems that proxy to the application.”

• App key purpose Report an error

  “This key is used for encryption in various parts of the application to encrypt values such as: Multi-factor authentication values Cookie & session data Temporarily cached authentication data”

• External content warning Report an error

  “In some scenarios you may use BookStack user-provided content externally (Accessed via the database or API). Such content is not guaranteed to be safe so keep security in mind when dealing with such content.”

• Vulnerability reporting Report an error

  “For reporting security vulnerabilities, please see the “Security” section of the project readme on Codeberg.”

• Default admin account Report an error

  “Ensure you change the password and email address for the initial admin@admin.com user.”

• Content filter deprecation Report an error

  “This option is now considered deprecated. Please use the APP_CONTENT_FILTERING option detailed above.”

Scores citing this record

• The Engineering Lead Permissions, SSO & administration
• The IT Administrator Permissions, SSO & administration
• The Operations Lead Help-center publishing & integrations
• The Operations Lead European sovereignty
• The Quality Manager Permissions, SSO & administration
• The Skeptic Editor, structure & search
• The Skeptic Permissions, SSO & administration