[M6] Redis default config has no authentication or TLS

[pradeepto]

Severity: Medium

Category

Cryptographic Failures (OWASP A02)

Files

• appconfig/default.yaml:56-57
• pkg/cache/redis/cache.go:33-38

Description

Default Redis configuration uses no password and no TLS. The Redis client connects without encryption. All cached user data including emails, backend user IDs, and group memberships is visible to anyone who can reach the Redis port on the cluster network.

The Redis deployment manifest at config/redis/redis.yaml also has no auth or TLS configured.

Fix

• Configure Redis with a password using file| or env| substitution in production configs
• Add TLS configuration options to the Redis client setup
• Update deployment manifests with auth enabled

[vinamra28]

Configure Redis with a password using file| or env| substitution in production configs

That's already taken care of. The appconfig for production isn't git committed hence they are not visible here.

Add TLS configuration options to the Redis client setup

yes, good idea but this should be handled gracefully wherein if the tls config isn't passed then redis connection shouldn't fail. Eg, while testing usernaut locally with a local instance of redis, application shouldn't fail.

Update deployment manifests with auth enabled

not needed as appconfig will take care of it.