Mireya Cueto Garrido
af1b8e9956
- Updated Dockerfile to improve security with a non-root user and added health checks. - Modified docker-compose.yml to set containers as read-only, restrict ports to localhost, and implement health checks. - Enhanced .env.example with additional environment variables for security and configuration. - Improved FastAPI application with middleware for security headers, CORS, and body size limits. - Refactored authentication flow in auth.py to include state validation and improved error handling. - Added rate limiting to various endpoints to prevent abuse. - Updated researcher and publication handling to ensure better validation and error management.
82 lines
3.1 KiB
Bash
82 lines
3.1 KiB
Bash
# ============================================================
|
|
# ENVIRONMENT
|
|
# ============================================================
|
|
ENVIRONMENT=development
|
|
DEBUG=false
|
|
|
|
# ============================================================
|
|
# DATABASE / CACHE
|
|
# ============================================================
|
|
DATABASE_URL=postgresql://postgres:postgres@db:5432/orcid_db
|
|
REDIS_URL=redis://redis:6379/0
|
|
|
|
# ============================================================
|
|
# BASE URL (uso interno del scheduler)
|
|
# ============================================================
|
|
BASE_URL=http://localhost:8000/api
|
|
|
|
# ============================================================
|
|
# CORS — lista blanca estricta separada por comas
|
|
# Nunca uses "*" si allow_credentials=true.
|
|
# ============================================================
|
|
CORS_ALLOWED_ORIGINS=http://localhost:5173
|
|
|
|
# ============================================================
|
|
# Trusted Hosts — anti Host-header injection (en prod, sé explícito)
|
|
# ============================================================
|
|
TRUSTED_HOSTS=*
|
|
|
|
# ============================================================
|
|
# JWT (login ORCID)
|
|
# Genera un secreto fuerte: `openssl rand -base64 64`
|
|
# ============================================================
|
|
JWT_SECRET=change_me_to_a_long_random_value_at_least_32_chars
|
|
JWT_ALGORITHM=HS256
|
|
JWT_EXPIRES_MINUTES=720
|
|
JWT_ISSUER=orcid-sword-backend
|
|
JWT_AUDIENCE=orcid-sword-frontend
|
|
|
|
# ============================================================
|
|
# API key máquina-a-máquina (scheduler interno)
|
|
# Genera con: `python -c "import secrets;print(secrets.token_urlsafe(48))"`
|
|
# ============================================================
|
|
API_KEY_NAME=X-API-Key
|
|
API_KEY_VALUE=replace_with_a_strong_random_value_min_24_chars
|
|
|
|
# ============================================================
|
|
# ORCID OAuth 3-legged (authorization code)
|
|
# ============================================================
|
|
ORCID_CLIENT_ID=APP-XXXXXXXXXXXXXXXX
|
|
ORCID_CLIENT_SECRET=replace_me
|
|
ORCID_REDIRECT_URI=http://localhost:8000/api/auth/orcid/callback
|
|
ORCID_OAUTH_STATE_ENABLED=true
|
|
|
|
# ============================================================
|
|
# Rate limits (formato slowapi: "<n>/<window>")
|
|
# ============================================================
|
|
RATE_LIMIT_DEFAULT=60/minute
|
|
RATE_LIMIT_AUTH=10/minute
|
|
RATE_LIMIT_SEARCH_ANON=5/minute
|
|
RATE_LIMIT_SEARCH_AUTH=30/minute
|
|
RATE_LIMIT_EXPORT=20/minute
|
|
RATE_LIMIT_SYNC=5/minute
|
|
|
|
# ============================================================
|
|
# Tope de tamaños (anti DoS)
|
|
# ============================================================
|
|
MAX_ORCID_BATCH=25
|
|
MAX_PUB_IDS_BATCH=500
|
|
MAX_REQUEST_BODY_BYTES=1048576
|
|
|
|
# ============================================================
|
|
# Documentación interactiva (deshabilita en producción si no es necesaria)
|
|
# ============================================================
|
|
DOCS_ENABLED=true
|
|
|
|
# ============================================================
|
|
# HSTS
|
|
# ============================================================
|
|
SECURITY_HSTS_SECONDS=31536000
|
|
SECURITY_HSTS_INCLUDE_SUBDOMAINS=true
|
|
SECURITY_HSTS_PRELOAD=false
|