search

wso2 / docs-apim

Apache License 2.0
70 stars 397 forks source link

Config properties referenced on page but not included in config catalog #6559

Open ThijsFTW opened 1 year ago

ThijsFTW commented 1 year ago

Description: On the 'Security Guidelines for a Production Deployment' page in the section 'Configure strong HTTP(S) security' a configuration setting is mentioned that is not reflected in the 'API-M Config Catalog'.

Suggested Labels: API-M 4.10,Docs/API-Security

Affected Product Version: 4.1

Steps to reproduce: Follow Security Guidelines for a Production Deployment page.

This can be done by replacing the sslProtocol = "TLS" property with sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" under [transport.https.sslHostConfig .properties] in the deployment.toml file.

Try to lookup this [transport.https.sslHostConfig.properties] in the Config Catalog: https://apim.docs.wso2.com/en/latest/reference/config-catalog/. It is not mentioned there.

Related Issues:

[transport.https.sslHostConfig .properties]

Note the extra space between sslHostConfig en .properties.

In addition, configure strong ciphers for ThriftAuthenticationService, Tomcat transport, and PassThrough transport in the deployment.toml file

No link to docs page for ThriftAuthenticationService.

ThijsFTW commented 1 year ago

TLSv1.3 is also missing in the documentation text. TLSv1.3 is available since APIM 4.x according to: https://github.com/wso2/product-apim/issues/8590