.. /*
    * This file is part of the SavaPage project <https://www.savapage.org>.
    * Copyright (c) 2026 Datraverse B.V.
    * Author: Rijk Ravestein.
    *
    * SPDX-FileCopyrightText: (c) 2020 Datraverse B.V. <info@datraverse.com>
    * SPDX-License-Identifier: CC-BY-SA-4.0
    *
    * For more information, please contact Datraverse B.V. at this
    * address: info@datraverse.com
    */

.. _ch-security-access-over-internet:

Access over Internet
--------------------

Take extra care when |PRODUCT_NAME| is accessible over public Internet, as
a result of enabled |RST_LINK_INTERNETPRINT| or explicit
WAN to LAN routing, since authentication falls back to global defaults
for :ref:`User Authentication <ch-webapp-admin-options-user-auth>`. At
least make sure that access to the |RST_LINK_ADMIN_WEBAPP| is solidly secured.

Internet access to each Web App can be restricted with configuration
properties in the table below:

.. list-table:: Web App Internet Access Configuration Properties
   :width: 100%
   :widths: 40 60
   :header-rows: 1
   
   * - Configuration property
     - Description

   * - webapp.internet.enable
     - Set to ``Y`` (default) or ``N`` to  enable/disable Internet access for  **all** Web Apps.
   
   * - | webapp.internet.\*.enable
       |
       | \* = admin \| jobtickets \| mailtickets \| payment \| pos \| printsite \| user
     - Set to ``Y`` (default) or ``N`` to  enable/disable Internet access for a specific Web App.

   * - | webapp.internet.\*.auth-mode.enable
       |
       | \* = admin \| jobtickets \| mailtickets \| payment \| pos \| printsite \| user
     - Set to ``Y`` or ``N`` (default) to enable/disable webapp.internet.*.auth-modes for a specific Web App.  

   * - | webapp.internet.\*.auth-modes
       |
       | \* = admin \| jobtickets \| mailtickets \| payment \| pos \| printsite \| user
     - A comma-separated list of authentication methods (``name``, ``email``, ``id``, ``nfc-local``, 
       ``yubikey``, ``oauth``) for a  specific Web App. The first in the  list is the default method. |br|
       |br|
       Note: If webapp.internet.admin.auth-mode.enable = ``Y``, then user ``admin`` is
       denied access to Admin WebApp over the internet.
   
   
See |RST_LINK_CONFIG_EDITOR| on how to set these items.

.. important::

   If ``webapp.internet.admin.auth-mode.enable`` = ``Y``, then user
   ``admin`` is denied access to the |RST_LINK_ADMIN_WEBAPP| over the internet.

.. note::

   Exceptions to these generic restrictions can be configured by
   creating a :ref:`Terminal Device <ch-webapp-admin-devices-terminal>`
   for each trusted client IP address and configure 
   :ref:`Custom User Login <ch-webapp-admin-devices-terminal-custom-user-login>`
   methods.

.. _ch-security-access-over-internet-security-txt:

security.txt
~~~~~~~~~~~~

security.txt is a proposed standard which allows websites to define
security policies. The file is available via
``https://your-savapage-server/.well-known/security.txt`` and its
content is set with configuration properties as outlined in the table
below:

.. table:: Configuration Properties for security.txt

   +------------------------------------+------------------------------------+
   | Configuration property             | Description                        |
   +====================================+====================================+
   | securitytxt.enable                 | Set to ``Y`` or ``N`` (default) to |
   |                                    | enable/disable security.txt for    |
   |                                    | **all** Web Apps.                  |
   +------------------------------------+------------------------------------+
   | securitytxt.contact.mailto         | E-mail address for people to       |
   |                                    | contact you about security issues. |
   +------------------------------------+------------------------------------+
   | securitytxt.contact.tel            | Phone number for people to contact |
   |                                    | you about security issues.         |
   +------------------------------------+------------------------------------+
   | securitytxt.contact.url            | URL for people to contact you      |
   |                                    | about security issues. Must start  |
   |                                    | with ``https://``. |br|            |
   |                                    | |br|                               |
   |                                    | *At least one                      |
   |                                    | securitytxt.contact.\* property    |
   |                                    | must be configured.*               |
   +------------------------------------+------------------------------------+
   | securitytxt.encryption.uri         | URI to a key which security        |
   |                                    | researchers should use to securely |
   |                                    | talk to you (optional).            |
   +------------------------------------+------------------------------------+
   | securitytxt.acknowledgments.url    | URL to a web page where you say    |
   |                                    | thank you to security researchers  |
   |                                    | who have helped you (optional).    |
   |                                    | Must start with ``https://``.      |
   +------------------------------------+------------------------------------+
   | securitytxt.preferred-languages    | A comma-separated list of language |
   |                                    | codes that your security team      |
   |                                    | speaks (optional).                 |
   +------------------------------------+------------------------------------+
   | securitytxt.securitytxt.policy.url | URL to a policy detailing what     |
   |                                    | security researchers should do     |
   |                                    | when searching for or reporting    |
   |                                    | security issues (optional). Must   |
   |                                    | start with ``https://``.           |
   +------------------------------------+------------------------------------+
   | securitytxt.securitytxt.hiring.url | URL to any security-related job    |
   |                                    | openings in your organization      |
   |                                    | (optional). Must start with        |
   |                                    | ``https://``.                      |
   +------------------------------------+------------------------------------+

See |RST_LINK_CONFIG_EDITOR| on how to change these properties.

.. note::

   The “Expires:” property in ``security.txt`` is generated by
   |PRODUCT_NAME| and set one month in the future.