Security
How much protection an instance needs depends on the requirements of your organisation. In the security settings, administrators and system administrators weigh each protective function against its effect on embedded content. You reach the highest level of security when all security functions are switched on. You will find the settings in the system administration under:
Administration > Login > Security
Configuration tab
In the "Configuration" tab, you switch the security functions on or off for the whole instance. With "Save" you apply the changes.
Files in folders
Force file download in folders: Select the checkbox "Force file download in folders" so that OpenOlat downloads files from folders instead of opening them directly in the browser. This prevents cross-site scripting (XSS). This applies to HTML pages, JavaScript and SVG files, and files whose type OpenOlat does not recognise. The course element "HTML page" is not affected by this mechanism.
HTTP headers
Prevent embedding in frames using JavaScript code: This function is permanently switched on and cannot be changed in the form. Due to compatibility reasons, the rich text component (TinyMCE) of OpenOlat cannot be embedded in a frame.
Prevent embedding in frames by sending HTTP header X-FRAME-OPTIONS=SAMEDOMAIN: Select this security function to prevent OpenOlat from loading in a frame or iFrame. This prevents cross-frame scripting (XFS). If this function is activated, you cannot embed OpenOlat in an existing website using frames.
Prevent downgrade of HTTPS to HTTP with HTTP header: The browser only calls the platform via HTTPS, even if a link points to HTTP. OpenOlat sends the Strict-Transport-Security header for this, valid for one year and including subdomains.
Prevent browser to guess script and style content with HTTP header: The browser keeps to the file type reported by the server instead of guessing it from the content. OpenOlat sends the header X-Content-Type-Options: nosniff for this.
Protection against forged requests
Cross-Site Request Forgery (CSRF) protection: This configuration increases security against forged requests that are sent from an external website in the name of a logged-in person.
SameSite cookie: Determines for which calls from other websites the session cookie is sent along. The options are Strict, Lax and None, with Strict being the most restrictive setting.
SSRF mitigation
frentix customers
Exceptions from the protection for individual IP addresses, address ranges and host names are part of the server configuration. For frentix customers, their customer advisor at frentix takes care of the change.
In several places, people enter an internet address in OpenOlat that the server then retrieves itself, for example when importing a calendar from a URL or when embedding an external blog. The "SSRF mitigation" checkbox (Server-Side Request Forgery) prevents anyone from using such an address to make the server retrieve services in the internal network of your organisation that cannot be reached from outside. Above the checkbox you see the note "Local addresses are not allowed in calendar URLs, external pages, LTI, badges…".
Switched on: OpenOlat resolves every address entered and only retrieves addresses on the public internet. OpenOlat rejects addresses of the server itself (loopback), local and private network ranges and their IPv6 equivalents. The check applies to every redirect, not only to the first call. Only the protocols HTTP and HTTPS are permitted.
Switched off: OpenOlat retrieves every address entered, including an address in the internal network.
Default value after a new installation and an update
On a new installation, "SSRF mitigation" is switched on. On an existing instance, the update to Release 21.1.0 switches the protection off, so that calendars and feeds from the internal network that are already set up keep working. Excepted are instances whose server configuration sets the value explicitly. After the update, check whether the checkbox is selected and switch the protection on if required.
The protection checks the addresses that people enter themselves:
- calendars imported from a URL and their regular synchronisation, see Calendar
- external blogs and podcasts, see How do I create a blog? and How do I create a podcast?
- the course element "External page" with the display "Embedded (source hidden)", see Course Element "External Page"
- the sites "External page n°1" and "External page n°2" with the "iFrame" checkbox selected, see Customizing
- LTI, videos from a URL, the verification of a badge and images from the web during a Markdown import into the content editor
For authors and participants, the protection shows when they enter an address: OpenOlat rejects an address from the internal network. The message does not name the protection as the cause, it reads the same as for a wrong address or a network error.
The protection does not check services whose address the administration has stored, for example OnlyOffice, BigBlueButton, Zoom or Opencast. They still reach internal servers, so switching the protection on does not interrupt an existing connection.
If the outgoing traffic of the server runs through a proxy, the proxy resolves the host names, not OpenOlat. OpenOlat then only checks the protocol and addresses that appear as an IP address in the URL. In this case, the proxy has to check the host names. Addresses that bypass the proxy according to the server configuration are checked by OpenOlat in full.
Individual IP addresses, address ranges and host names can be allowed despite the protection, for example a calendar server in the network of your organisation. These exceptions have no input field in the user interface. They are part of the server configuration and only take effect after the next restart following a change. The instance's own host name also belongs there if the server resolves it to a local address: otherwise the protection also rejects the subscription to a calendar of the same instance.
Content Security Policy
Content Security Policy (CSP): Defines the sources from which the browser may load content for OpenOlat.
Effect on content
This configuration can block content such as the LTI course element, the external page and the HTML page. The course elements card2brain, edubase, edubook, GoToTraining, openmeeting, vitero and PayPal are currently not supported.
If the Content Security Policy is switched on, the "Report only" checkbox and the input fields of the individual directives appear in addition. With "Report only", the browser only reports violations and blocks nothing; you will find the messages in the "Content security policy log" tab.
The individual directives
You can store your own sources for each directive, each as an address in the form https://example.com. Below the input field, OpenOlat shows the value that is always included and that your entry supplements.
| Directive | Applies to |
|---|---|
default-src |
all content types without their own directive |
form-action |
targets to which forms are sent |
script-src |
JavaScript |
style-src |
stylesheets |
img-src |
images |
font-src |
fonts |
connect-src |
connections from the browser, for example for retrieving data in the background |
frame-src |
pages that OpenOlat embeds in a frame |
frame-ancestors |
pages that are allowed to embed OpenOlat themselves |
media-src |
audio and video |
object-src |
embedded objects |
Tab Content security policy log
This tab appears as soon as the Content Security Policy is switched on. It lists the reported violations.
Tab Media server
In the "Media server" tab, you define from which platforms people may embed videos into OpenOlat via a URL. In the "Mode" field, "Allow all" permits every platform. With "Configure", only the platforms you select under "Enabled media servers" apply; YouTube, Vimeo and nanoo.tv are available. You add further platforms under "Custom media servers" with the "Add media server" button, each with name and domain.
Further information
Mentioned on this page
User tools: Calendar >
How do I create a blog? >
How do I create a podcast? >
Course Element "External Page" >
Customizing: Overview >
Further reading
Login: Overview >
Module Video >
Module External page >