Threats

Prevent the exploitation of security vulnerabilities by using up-to-date versions of the agent and third-party software.

Review and follow the Ping Identity security advisories. Follow similar lists from all of your vendors.

When browsers and web proxies cache pages that are accessed by a user, the cache can include sensitive information. Caching pages in browsers and web proxies increases risk of unwanted disclosure, especially in shared browsing environments.

Similarly, when web server responses are cached, sensitive information can be accessed by attackers. Caching web server responses is a common method to improve loading times and reduce server load.

To manage caching, set Custom Response Header Map so that HTTP responses generated by the agent include the Cache-Control HTTP header. This header tells browsers and web proxies whether they can be cached. For example, clients can set the following value clear existing cache responses, force the cache to revalidate with the server, and prevent new responses from being cached:

org.forgerock.agents.response.header.map[Cache-Control]=max-age=0, no-store

In your decision to set this property, consider the impact on the performance of customer applications. Setting this property can reduce performance because browser pages aren’t cached.

Learn more in HTTP caching.

The initial phase of an attack sequence is often reconnaissance. Limit the amount of information available to attackers during reconnaissance, as follows:

Configure the following properties to protect against cross-site scripting attacks:

The agent doesn’t have access to client side IP addresses at the TCP/IP level. Instead, it accesses client IP addresses from the address of the last proxy or client.

You can change the HTTP header used to identify the client IP address by setting the Client IP Address Header property. If you set this property, make sure you use a trusted header. For example, there are security and privacy concerns associated with using the X-Forwarded-For HTTP header. Learn more in the MDN Web Docs X-Forwarded-For.

Security issues can occur if the client IP address is spoofed, particularly if the spoofed IP address is included in a not-enforced rule. Learn more about IP spoofing in OWASP’s IP Spoofing via HTTP Headers.

To protect your deployment, you should only set the Not-Enforced Client IP List property if you have considered the risks of client IP address spoofing and mitigated for them. Typically, you would only specify IP addresses from a private network that you have control over.

By default, POST data is stored in the in-memory cache. Consider the following points if you configure POST Data Preservation in Files or Cache to store POST data in the file system:

Learn more in POST data preservation.

Use secure passwords for server administration.

You can find information on creating the agent password in Preinstallation tasks. The encrypted password is stored in the AgentPassword.properties file.

Misconfiguration can arise from bad or mistaken configuration decisions, and from poor change management. Depending on the configuration error, features can stop working in obvious or subtle ways, and potentially introduce security vulnerabilities.

For example, if a configuration change prevents the server from making HTTPS connections, many applications can no longer connect, and the problem is detected immediately. However, if a configuration change allows insecure TLS protocol versions or cipher suites for HTTPS connections, some applications negotiate insecure TLS but appear to continue to work properly.

To guard against bad configuration decisions, implement good change management:

Bad actors attempt to access protected resources using a number of different techniques that typically involve path traversal. For example, if a not-enforced rule exists that allows access to everything under /public, they will attempt to access protected resources using paths, such as /public/../private/secret.html, /public/;../private/secret.html or /public%2F%2e.%2fprivate/secret.html, where the path traversal attempt is disguised as a path parameter or by encoding characters within the URL.

Java Agent rejects incoming request URLs with an HTTP 400 in the following scenarios by default:

You can change this default behavior by configuring the URL handling properties. Learn more in URL handling.

Data theft can occur when access policies are too permissive and when the credentials to gain access are too easily cracked. It can also occur when the data isn’t protected, when administrative roles are too permissive, and when administrative credentials are poorly managed.

Threats can arise when plans fail to account for outside risks. To mitigate risk, develop appropriate answers to at least the following questions:

For critical services, test expected operation and disaster recovery operation.

To prevent memory exhaustion DOS attacks, configure Maximum Decompression Size to limit the maximum size to which a compressed JWT can be decompressed. This property reduces the risk of a decompressed JWT consuming too much available memory.

To prevent log overflow attacks, add a custom agent-logback.xml with a DuplicateMessageFilter. This filter detects duplicate messages, and after the specified number of repetitions, drops repeated messages. Learn more in Limiting repetitive log messages.