-
Notifications
You must be signed in to change notification settings - Fork 146
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[SDP-1032] Flip SDP's flag usage from
ENABLE_RECAPTCHA to `DISABLE_…
…RECAPTCHA` and add a Secure Operation Manual (#292) ### What Flip SDP's flag usage from `ENABLE_RECAPTCHA` to `DISABLE_RECAPTCHA`. Also, add a new section for Secure Operation Manual. ### Why To remain in sync with the change from stellar/stellar-disbursement-platform-backend#150
- Loading branch information
1 parent
7d364fa
commit 3725b67
Showing
5 changed files
with
52 additions
and
8 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,7 +5,7 @@ description: "Allows credentialed SDP users to log in to the SDP dashboard with | |
| sidebar_label: "Log In" | ||
| hide_title: true | ||
| hide_table_of_contents: true | ||
| api: {"responses":{"200":{"description":"OK","headers":{},"content":{"application/json":{"schema":{"type":"object","properties":{"token":{"type":"string"}},"example":{"token":"eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjp7ImlkIjoidXNlci1pZCIsImVtYWlsIjoiZW1haWxAZW1haWwuY29tIiwicm9sZXMiOlt7Im5hbWUiOiJTdXBlcnZpc29yIn1dfSwiZXhwIjoxNjc1OTYyOTQ3fQ.4Zj9yBXch-iuFYF-kc_EhHPxjpwp_egMOLbOv4bZKO1MFvcmEgZ5MlXH1_1fZfgUxaNBcMCdRM6MGSqKocwGnA"}},"examples":{"response":{"value":{"token":"eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjp7ImlkIjoidXNlci1pZCIsImVtYWlsIjoiZW1haWxAZW1haWwuY29tIiwicm9sZXMiOlt7Im5hbWUiOiJTdXBlcnZpc29yIn1dfSwiZXhwIjoxNjc1OTYyOTQ3fQ.4Zj9yBXch-iuFYF-kc_EhHPxjpwp_egMOLbOv4bZKO1MFvcmEgZ5MlXH1_1fZfgUxaNBcMCdRM6MGSqKocwGnA"}}}}}},"400":{"description":"Bad Request","headers":{},"content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"extras":{"type":"object","properties":{"status":{"type":"number"},"message":{"type":"string"}}}},"example":{"error":"Invalid credentials","extras":{"status":400,"message":"Invalid username or password"}}},"examples":{"response":{"value":{"error":"Invalid credentials","extras":{"status":400,"message":"Invalid username or password"}}}}}}}},"operationId":"Log In","description":"Allows credentialed SDP users to log in to the SDP dashboard with a password. Note: all passwords must be at least 8 characters long and a combination of uppercase letters, lowercase letters, numbers, and symbols.","tags":["Authentication"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string"},"password":{"type":"string"},"recaptcha_token":{"type":"string","description":"Token for reCAPTCHA validation. ReCAPTCHA token is only required when `ENABLE_RECAPTCHA` configuration is set to true."}},"required":["email","password"],"example":{"email":"[email protected]","password":"mysecret"}}}}},"method":"post","path":"/login","securitySchemes":{"BearerAuth":{"type":"apiKey","name":"Authorization","in":"header","description":"JWT used for authentication, signed with an ES256 private key."}},"jsonRequestBodyExample":{"email":"[email protected]","password":"mysecret"},"info":{"title":"Stellar Disbursement Platform API","version":"","description":"The Stellar Disbursement Platform (SDP) is a tool built for organizations to make bulk payments to a group of recipients over the Stellar network. You can read more about using the SDP [here](https://developers.stellar.org/docs/category/use-the-stellar-disbursement-platform)."},"postman":{"name":"Log In","description":{"content":"Allows credentialed SDP users to log in to the SDP dashboard with a password. Note: all passwords must be at least 8 characters long and a combination of uppercase letters, lowercase letters, numbers, and symbols.","type":"text/plain"},"url":{"path":["login"],"host":["{{baseUrl}}"],"query":[],"variable":[]},"header":[{"key":"Content-Type","value":"application/json"},{"key":"Accept","value":"application/json"}],"method":"POST","body":{"mode":"raw","raw":"\"\"","options":{"raw":{"language":"json"}}}}} | ||
| api: {"responses":{"200":{"description":"OK","headers":{},"content":{"application/json":{"schema":{"type":"object","properties":{"token":{"type":"string"}},"example":{"token":"eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjp7ImlkIjoidXNlci1pZCIsImVtYWlsIjoiZW1haWxAZW1haWwuY29tIiwicm9sZXMiOlt7Im5hbWUiOiJTdXBlcnZpc29yIn1dfSwiZXhwIjoxNjc1OTYyOTQ3fQ.4Zj9yBXch-iuFYF-kc_EhHPxjpwp_egMOLbOv4bZKO1MFvcmEgZ5MlXH1_1fZfgUxaNBcMCdRM6MGSqKocwGnA"}},"examples":{"response":{"value":{"token":"eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjp7ImlkIjoidXNlci1pZCIsImVtYWlsIjoiZW1haWxAZW1haWwuY29tIiwicm9sZXMiOlt7Im5hbWUiOiJTdXBlcnZpc29yIn1dfSwiZXhwIjoxNjc1OTYyOTQ3fQ.4Zj9yBXch-iuFYF-kc_EhHPxjpwp_egMOLbOv4bZKO1MFvcmEgZ5MlXH1_1fZfgUxaNBcMCdRM6MGSqKocwGnA"}}}}}},"400":{"description":"Bad Request","headers":{},"content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"extras":{"type":"object","properties":{"status":{"type":"number"},"message":{"type":"string"}}}},"example":{"error":"Invalid credentials","extras":{"status":400,"message":"Invalid username or password"}}},"examples":{"response":{"value":{"error":"Invalid credentials","extras":{"status":400,"message":"Invalid username or password"}}}}}}}},"operationId":"Log In","description":"Allows credentialed SDP users to log in to the SDP dashboard with a password. Note: all passwords must be at least 8 characters long and a combination of uppercase letters, lowercase letters, numbers, and symbols.","tags":["Authentication"],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string"},"password":{"type":"string"},"recaptcha_token":{"type":"string","description":"Token for reCAPTCHA validation. ReCAPTCHA token is required unless the `DISABLE_RECAPTCHA` configuration is set to true."}},"required":["email","password"],"example":{"email":"[email protected]","password":"mysecret"}}}}},"method":"post","path":"/login","securitySchemes":{"BearerAuth":{"type":"apiKey","name":"Authorization","in":"header","description":"JWT used for authentication, signed with an ES256 private key."}},"jsonRequestBodyExample":{"email":"[email protected]","password":"mysecret"},"info":{"title":"Stellar Disbursement Platform API","version":"","description":"The Stellar Disbursement Platform (SDP) is a tool built for organizations to make bulk payments to a group of recipients over the Stellar network. You can read more about using the SDP [here](https://developers.stellar.org/docs/category/use-the-stellar-disbursement-platform)."},"postman":{"name":"Log In","description":{"content":"Allows credentialed SDP users to log in to the SDP dashboard with a password. Note: all passwords must be at least 8 characters long and a combination of uppercase letters, lowercase letters, numbers, and symbols.","type":"text/plain"},"url":{"path":["login"],"host":["{{baseUrl}}"],"query":[],"variable":[]},"header":[{"key":"Content-Type","value":"application/json"},{"key":"Accept","value":"application/json"}],"method":"POST","body":{"mode":"raw","raw":"\"\"","options":{"raw":{"language":"json"}}}}} | ||
| sidebar_class_name: "post api-method" | ||
| info_path: api/stellar-disbursement-platform/resources/stellar-disbursement-platform-api | ||
| custom_edit_url: null | ||
|
|
@@ -30,7 +30,7 @@ import TabItem from "@theme/TabItem"; | |
|
|
||
| Allows credentialed SDP users to log in to the SDP dashboard with a password. Note: all passwords must be at least 8 characters long and a combination of uppercase letters, lowercase letters, numbers, and symbols. | ||
|
|
||
| <MimeTabs><TabItem label={"application/json"} value={"application/json-schema"}><details style={{}} data-collapsed={false} open={true}><summary style={{"textAlign":"left"}}><strong>Request Body</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"email"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string"}}></SchemaItem><SchemaItem collapsible={false} name={"password"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string"}}></SchemaItem><SchemaItem collapsible={false} name={"recaptcha_token"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Token for reCAPTCHA validation. ReCAPTCHA token is only required when `ENABLE_RECAPTCHA` configuration is set to true."}}></SchemaItem></ul></details></TabItem></MimeTabs><div><ApiTabs><TabItem label={"200"} value={"200"}><div> | ||
| <MimeTabs><TabItem label={"application/json"} value={"application/json-schema"}><details style={{}} data-collapsed={false} open={true}><summary style={{"textAlign":"left"}}><strong>Request Body</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"email"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string"}}></SchemaItem><SchemaItem collapsible={false} name={"password"} required={true} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string"}}></SchemaItem><SchemaItem collapsible={false} name={"recaptcha_token"} required={false} schemaName={"string"} qualifierMessage={undefined} schema={{"type":"string","description":"Token for reCAPTCHA validation. ReCAPTCHA token is required unless the `DISABLE_RECAPTCHA` configuration is set to true."}}></SchemaItem></ul></details></TabItem></MimeTabs><div><ApiTabs><TabItem label={"200"} value={"200"}><div> | ||
|
|
||
| OK | ||
|
|
||
|
|
||
44 changes: 44 additions & 0 deletions
44
docs/stellar-disbursement-platform/secure-operation-manual.mdx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| --- | ||
| title: Secure Operation Manual | ||
| sidebar_position: 41 | ||
| --- | ||
|
|
||
| This manual outlines the security measures implemented in the Stellar Disbursement Platform (SDP) to protect the integrity of the platform and its users. By adhering to these guidelines, you can ensure that your use of the SDP is as secure as possible. | ||
|
|
||
| Security is a critical aspect of the SDP. The measures outlined in this document are designed to mitigate risks and enhance the security of the platform. Users are strongly encouraged to follow these guidelines to protect their accounts and operations. | ||
|
|
||
| ### Implementation of reCAPTCHA | ||
|
|
||
| Google's reCAPTCHA has been integrated into the SDP to prevent automated attacks and ensure that interactions are performed by humans, not bots. | ||
|
|
||
| ReCAPTCHA is enabled by default and can be disabled in the development environment by setting the `DISABLE_RECAPTCHA` environment variable to `true`. | ||
|
|
||
| **Note:** Disabling reCAPTCHA is not supported for production environments due to security risks. | ||
|
|
||
| ### Enforcement of Multi-Factor Authentication | ||
|
|
||
| Multi-Factor Authentication (MFA) provides an additional layer of security to user accounts. It is enforced by default on the SDP and it relies on OTPs sent to the account's email. | ||
|
|
||
| MFA is enabled by default and can be disabled in the development environment by setting the `DISABLE_MFA` environment variable to `true`. | ||
|
|
||
| **Note:** Disabling MFA is not supported for production environments due to security risks. | ||
|
|
||
| ### Best Practices for Wallet Management | ||
|
|
||
| The SDP wallet should be used primarily as a hot wallet with a limited amount of funds to minimize potential losses. | ||
|
|
||
| #### Hot and Cold Wallets | ||
|
|
||
| - A hot wallet is connected to the internet and allows for quick transactions. | ||
| - A cold wallet is offline and used for storing funds securely. | ||
| - Learn more about these concepts at [Investopedia](https://www.investopedia.com/hot-wallet-vs-cold-wallet-7098461). | ||
|
|
||
| ### Distribution of Disbursement Responsibilities | ||
|
|
||
| To enhance security, disbursement responsibilities should be distributed among multiple financial controller users. | ||
|
|
||
| #### Recommended Configuration | ||
|
|
||
| 1. **Approval Flow**: Enable the approval flow on the organization page to require two users for the disbursement process. The owner can do that at _Profile > Organization > ... > Edit details > Approval flow > Confirm_. | ||
| 2. **Financial Controller Role**: Create two users with the _Financial Controller_ role on the organization page to enforce separation of duties. The owner can do hat at _Settings > Team Members_. | ||
| 3. **Owner Account Management**: Use the Owner account solely for user management and organization configuration. Avoid using the Owner account for financial controller tasks to minimize the exposure of that account. |
Oops, something went wrong.