Security

Use this section to find security guidance for Posit Connect administrators and security teams.

For related guidance elsewhere in the documentation, see Authentication, Access controls, Auditing, OAuth integrations security, SSL certificates, and Running with a proxy. Review any requirements or prerequisites noted on a topic page before following its guidance.

You can configure many security settings in Connect. Some are enabled by default. Others depend on your environment and your organization’s policies, so you enable them as your deployment requires.

Security topics

Choose a topic or section based on the control you need to manage:

• Start with Security recommendations, which groups controls by security topic.
• Package security covers approved package sources with Posit Package Manager.
• Sessions and sign-in covers session limits, web sudo, and sign-in controls.
  • How sessions work
  • Limit session lifetime
  • Require reauthentication for sensitive actions
  • Protect sign-in from brute-force and dictionary attacks
• HTTPS and TLS covers HTTPS settings, TLS versions, and proxy termination.
  • Require HTTPS permanently
  • Set the minimum TLS version
  • Terminate TLS at a proxy
• TLS cipher suites covers available suites and proxy configuration.
  • Default cipher suites
  • Triple Data Encryption Standard (3DES)
  • Rivest–Shamir–Adleman (RSA) key exchange
  • Working with legacy clients
  • Control cipher suites with a reverse proxy
  • NGINX
  • Apache HTTP Server
  • TLS 1.3
• HTTP headers covers response headers, Content Security Policy, and cross-site request forgery (CSRF).
  • Server header
  • Content type sniffing
  • Header sanitization
  • Custom headers
  • Content Security Policy
  • How Connect prevents CSRF
  • How Connect mitigates CSRF attacks
• Embedding and cross-origin access covers framing, cookies, redirects, and cross-origin resource sharing (CORS).
  • Control which sites can embed content
  • Authenticate embedded content
  • Set the SameSite cookie attribute
  • Enable CORS
  • Understand how CORS works
  • Configure CORS in Connect
  • Add CORS support in your application
• Network encryption covers database, filesystem, content process, and service mesh traffic.
  • Network security
  • Database connections
  • Network filesystems
  • Content process traffic
  • Service mesh
• Service tokens covers service token management.
• Encryption key covers the Connect encryption key and application environment variables.
• Connect server user covers the server user.