HTTPS and TLS

Posit Connect administrators can use this page to require HTTPS, set a minimum TLS version, and terminate TLS at a proxy. Before you enable HTTPS permanently, confirm that you can provide a valid TLS certificate. Cipher suite configuration is outside the scope of this page. For cipher suite details, see TLS cipher suites.

Require HTTPS permanently

If you can guarantee that users only ever access your server over HTTPS, consider enabling the HTTPS.Permanent setting. This setting improves server security by requiring encryption for future interactions between users and the server.

Note

Enabling this setting can prevent users from accessing your Connect instance if you later disable HTTPS or if your certificate expires. Use this setting only if you will permanently provide a valid TLS/SSL certificate on this server.

For more information on using SSL certificates with Connect, see SSL certificate configuration.

Behind the scenes, this makes two changes:

  1. This introduces HTTP Strict Transport Security (HSTS) by adding a Strict-Transport-Security HTTP header. Connect sets the header’s max-age to 30 days. You can override the default by setting HTTPS.StrictTransportSecurityMaxAge. HSTS ensures that your users’ browsers do not trust this service unless it has a trusted TLS certificate.
  2. Connect enforces the Secure flag on cookies that it sets. This prevents users’ browsers from sending Connect cookies to a server without an HTTPS-secured connection.

Set the minimum TLS version

You can constrain the TLS version used by HTTPS. This can help you meet the security policy for your organization.

The HTTPS.MinimumTLS setting specifies the minimum TLS version. Connect rejects clients that use a lower TLS version. The default minimum TLS version is TLS 1.0, which maintains compatibility with older clients. Configure this setting to 1.0, 1.1, 1.2, or 1.3.

We recommend that you check that the browsers and clients used within your organization are compatible with your minimum TLS version choice. The SSL Labs User Agent List enumerates the TLS capabilities for most popular browsers.

Use this HTTPS configuration to permit TLS versions 1.2 and above:

/etc/rstudio-connect/rstudio-connect.gcfg
[HTTPS]
Listen = :443
MinimumTLS = 1.2
Note

Some Windows builds of the RCurl package are not compatible with TLS 1.1 or TLS 1.2. Windows users should execute options(rsconnect.http = 'curl') to use the local curl binary, if installed, instead of the outdated RCurl package.

Note

Older versions of the RStudio IDE may use webviews that are not compatible with TLS 1.1 or TLS 1.2. In this case, pairing with Connect without TLS 1.0 opens a blank screen instead of a login window. Open the blue link from the pairing window in the browser, or install a newer version of Connect as a workaround.

We recommend using a secure proxy if you need finer control over HTTPS.

Terminate TLS at a proxy

To keep your TLS certificates out of the Connect process, configure a proxy to handle HTTPS requests. To accomplish this:

  • Set Server.Address to the proxy address, using the https scheme.

  • Set HTTP.ForceSecure to true, which sets the Secure flag on all cookies.

  • Set HTTP.NoWarning to true to suppress the warning regarding running Connect over an unsecured connection, because the connection between the client and the proxy is secured.

  • If necessary, enable the HTTPRedirect.Listen option to redirect proxied plain HTTP connections to HTTPS.

Note

In this setup, traffic between the proxy and Connect is unencrypted. Run the proxy and Connect on a trusted network where an adversary cannot capture plain text credentials. For example, many cloud providers allow isolating servers from the internet while permitting load balancers to access them. Please see your cloud provider’s documentation for more details.