Security features¶
The source includes safeguards for web requests, sessions, passwords, tokens, email, and extensions.
Overview¶
This page explains the security features and describes their main effects. Test changes in a test environment first whenever they may affect existing tickets, permissions, notifications, or automations.
Typical workflow¶
CSRF protection for write requests from browsers. Perform the function in the designated form and immediately verify the result in the corresponding overview or on the affected ticket.
Secure session and cookie handling. Perform the function in the designated form and immediately verify the result in the corresponding overview or on the affected ticket.
Password reset and two-factor authentication. Perform the function in the designated form and immediately verify the result in the corresponding overview or on the affected ticket.
Encrypted OAuth2 and module secrets. Perform the function in the designated form and immediately verify the result in the corresponding overview or on the affected ticket.
REST scopes and token verification. Perform the function in the designated form and immediately verify the result in the corresponding overview or on the affected ticket.
S/MIME processing. Perform the function in the designated form and immediately verify the result in the corresponding overview or on the affected ticket.
Validation and isolation of add-ons. Perform the function in the designated form and immediately verify the result in the corresponding overview or on the affected ticket.
Rate limiting for public forms. Perform the function in the designated form and immediately verify the result in the corresponding overview or on the affected ticket.
Notes¶
Visible menu items and actions depend on the signed-in agent’s group and program permissions.
Deactivated entries are often retained for existing tickets and reports, but are no longer available for new assignments.
After making changes, test at least one realistic use case with a user in the affected role.
