{"action":"closed","issue":{"url":"https://api.github.com/repos/kyma-project/kyma/issues/732","repository_url":"https://api.github.com/repos/kyma-project/kyma","labels_url":"https://api.github.com/repos/kyma-project/kyma/issues/732/labels{/name}","comments_url":"https://api.github.com/repos/kyma-project/kyma/issues/732/comments","events_url":"https://api.github.com/repos/kyma-project/kyma/issues/732/events","html_url":"https://github.com/kyma-project/kyma/issues/732","id":360762471,"node_id":"MDU6SXNzdWUzNjA3NjI0NzE=","number":732,"title":"Insufficient Domain Isolation of Environments","user":{"login":"pbochynski","id":191769,"node_id":"MDQ6VXNlcjE5MTc2OQ==","avatar_url":"https://avatars2.githubusercontent.com/u/191769?v=4","gravatar_id":"","url":"https://api.github.com/users/pbochynski","html_url":"https://github.com/pbochynski","followers_url":"https://api.github.com/users/pbochynski/followers","following_url":"https://api.github.com/users/pbochynski/following{/other_user}","gists_url":"https://api.github.com/users/pbochynski/gists{/gist_id}","starred_url":"https://api.github.com/users/pbochynski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pbochynski/subscriptions","organizations_url":"https://api.github.com/users/pbochynski/orgs","repos_url":"https://api.github.com/users/pbochynski/repos","events_url":"https://api.github.com/users/pbochynski/events{/privacy}","received_events_url":"https://api.github.com/users/pbochynski/received_events","type":"User","site_admin":false},"labels":[{"id":1037620541,"node_id":"MDU6TGFiZWwxMDM3NjIwNTQx","url":"https://api.github.com/repos/kyma-project/kyma/labels/area/service-mesh","name":"area/service-mesh","color":"3cba12","default":false},{"id":1045657636,"node_id":"MDU6TGFiZWwxMDQ1NjU3NjM2","url":"https://api.github.com/repos/kyma-project/kyma/labels/security/medium","name":"security/medium","color":"2251f9","default":false},{"id":982732773,"node_id":"MDU6TGFiZWw5ODI3MzI3NzM=","url":"https://api.github.com/repos/kyma-project/kyma/labels/wontfix","name":"wontfix","color":"ffffff","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/kyma-project/kyma/milestones/5","html_url":"https://github.com/kyma-project/kyma/milestone/5","labels_url":"https://api.github.com/repos/kyma-project/kyma/milestones/5/labels","id":3593822,"node_id":"MDk6TWlsZXN0b25lMzU5MzgyMg==","number":5,"title":"Backlog_Gorilla","description":"","creator":{"login":"Disper","id":1783008,"node_id":"MDQ6VXNlcjE3ODMwMDg=","avatar_url":"https://avatars0.githubusercontent.com/u/1783008?v=4","gravatar_id":"","url":"https://api.github.com/users/Disper","html_url":"https://github.com/Disper","followers_url":"https://api.github.com/users/Disper/followers","following_url":"https://api.github.com/users/Disper/following{/other_user}","gists_url":"https://api.github.com/users/Disper/gists{/gist_id}","starred_url":"https://api.github.com/users/Disper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Disper/subscriptions","organizations_url":"https://api.github.com/users/Disper/orgs","repos_url":"https://api.github.com/users/Disper/repos","events_url":"https://api.github.com/users/Disper/events{/privacy}","received_events_url":"https://api.github.com/users/Disper/received_events","type":"User","site_admin":false},"open_issues":13,"closed_issues":15,"state":"open","created_at":"2018-08-23T14:48:23Z","updated_at":"2018-11-23T09:13:58Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2018-09-17T08:14:06Z","updated_at":"2018-11-23T09:13:58Z","closed_at":"2018-11-23T09:13:58Z","author_association":"CONTRIBUTOR","body":"When API Gateway exposes Services, Functions, etc. they are each available from a sub-domain of the main cluster domain (example.com). This is regardless of the environment that they are declared in.\r\n\r\nE.g. service foo in env prod and service bar in env stage might be exposed here:\r\n```\r\nfoo.example.com\r\nbar.example.com\r\n```\r\n\r\n**Risk:**\r\n\r\nMany clients of exposed Kyma APIs will be web-browsers (or will be running inside web-browsers). The web's security model is based on the concept of origins, which maps to domain names (for remote resources).\r\n\r\nE.g. web storage and cookies are associated with origins. The latter can be associated with the exact subdomain of the application, but also with parent domains. While we should not use cookies for security anymore, our customers may eventually do so anyway. Thus cookies might easily leak between different environments. Some of these may not be configured as securely as others, e.g. dev or stage environments.\r\n\r\nWeb applications can also use Content Security Policy (CSP) to to restrict themselves to resources from certain origins. E.g. they can define where to load JS or where to send AJAX requests. This is a very important second-line-of-defense for modern single-page apps, which handle access tokens themselves. Not having a dedicated subdomain for an environment will make it almost impossible to write effective CSPs.\r\n\r\n**Suggested Mitigation:**\r\n\r\nIntroduce an additional level to the domain structure of Kyma. Each environment should have it's own dedicated subdomain. APIs should be exposed on a subdomain of the subdomain belonging to the respective environment. For that to work, environments must follow naming conventions for DNS labels (or must maintain a new field for their DNS label).\r\n\r\nThe above example would then be exposed like this:\r\n\r\n```\r\nfoo.prod.example.com\r\nbar.stage.example.com\r\n```\r\n\r\nIdeally, cluster-wide subdomains of kyma should move underneath a dedicated sub-domain, too. E.g.:\r\n\r\n```\r\napiserver.kyma.example.com\r\nconsole.kyma.example.com\r\ndex.kyma.example.com\r\n```"}}
{"actor":{"display_login":"stale"}}