This article summarizes how ABRA Flexi addresses the most common security threats on the server side and REST API, and what you can configure yourself.
Man in the middle attack
One of the possible attacks on ABRA Flexi is Man in the middle — an attacker poses as ABRA Flexi servers, the user provides them with authorization credentials, and the attacker can then use them to authenticate against the real servers and analyze the communication.
By default, ABRA Flexi generates a so-called self-signed certificate; the SSL certificate can be replaced with your own. Against this type of attack, ABRA Flexi has two measures:
On startup, ABRA Flexi downloads the certificate and verifies it during subsequent communication with the server. Therefore, it is not possible to replace the certificate while the application is running.
DANE — storing the certificate fingerprint in DNS.
Storing the certificate in DNS (DANE)
The basis for the DNS record can be generated using the SWEDE tool:
$ ./swede --insecure create --port 5434 --certificate certifikat.pem --selector 1 --output rfc demo.flexibee.eu
_5434._tcp.demo.flexibee.eu. IN TLSA 1 0 1 85b928d1cab396d8e632d15d57b3a97ebbc2769ab74a292040dc4fc340153973
Instead of the SWEDE tool, it is also possible to get the configuration directly from a running ABRA Flexi server:
GET https://server:5434/certificate/tlsa
The endpoint returns the TLSA record parameters and the certificate fingerprint — i.e. the values usage, selector, matching type and the fingerprint itself:
1 1 2 3419e6e0631325af64da1f064e7779f9…
You then add this record to DNS:
_5434._tcp.demo.flexibee.eu. IN TXT TLSA 1 0 1 85b928d1cab396d8e632d15d57b3a97ebbc2769ab74a292040dc4fc340153973
The value stored is thus the entire TLSA 1 0 1 85b928d1….
The lookup proceeds in the following order:
_5434._tcp.demo.flexibee.eu.
_tcp.demo.flexibee.eu.
_5434._tcp.flexibee.eu.
_tcp.flexibee.eu.
🚨 If you are not also using DNSSEC, the security of the DNS server's response is not guaranteed — and therefore neither is the benefit of DANE.
⚠️ The ABRA Flexi client does not yet support full DANE, only the parameters --selector 1, --mtype 1, and --usage 0.
If the client reports an error while evaluating the TLSA record, the article Error TLSAException – Timeout while resolving TLSA can help.
CSRF
ABRA Flexi has built-in protection against Cross Site Request Forgery, so no configuration is needed in this regard.
SQL Injection and XSS
During the design phase, we devoted a great deal of effort to preventing SQL Injection and Cross Site Scripting (XSS). As a result, these types of vulnerabilities do not occur.
Password storage
Previously, ABRA Flexi used the MD5 function to store passwords. Now, salted SHA-256 is used. Old passwords are re-encoded only when they are changed.
ℹ️ The password hash is computed from the string salt + ":" + heslo. For details and a list of supported functions, see the articles Batch API and Contact Authentication.