Maniphest T262651

Ensure that push-notifications requires TLS
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Jgiannelos
	Sep 11 2020, 9:35 AM

Project Tags

Referenced Files

None

Subscribers

Description

Finding from security review:

TLS

I assume the push-notifications service will require TLS per the trend in T235411. Risk: low.

We should ensure that assumption.

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved		sbassett	T251190 Security Request For Service - Push Notifications
		Resolved		• Mholloway	T262936 Enable app push notifications in production
		Resolved		sbassett	T246712 Security Readiness Review for push notifications infrastructure
		Resolved		MSantos	T262651 Ensure that push-notifications requires TLS

Event Timeline

Jgiannelos created this task.Sep 11 2020, 9:35 AM

Restricted Application added a subscriber: • Aklapper. · View Herald TranscriptSep 11 2020, 9:35 AM

Jgiannelos added a parent task: T246712: Security Readiness Review for push notifications infrastructure.Sep 11 2020, 9:35 AM

Jgiannelos moved this task from Needs triage to Kanban on the Product-Infrastructure-Team-Backlog-Deprecated board.Sep 15 2020, 9:08 AM

Jgiannelos edited projects, added: Product-Infrastructure-Team-Backlog-Deprecated (Kanban); removed: Product-Infrastructure-Team-Backlog-Deprecated.

MSantos added subscribers: jijiki, akosiaris.Sep 15 2020, 9:17 AM

MSantos subscribed.

• Mholloway triaged this task as High priority.Sep 15 2020, 3:40 PM

LGoto assigned this task to MSantos.Sep 15 2020, 3:40 PM

LGoto moved this task from To Do to Doing on the Product-Infrastructure-Team-Backlog-Deprecated (Kanban) board.

To confirm the hypothesis:

There isn't any non-TLS endpoint from LVS registered for push-notifications, see https://gerrit.wikimedia.org/r/plugins/gitiles/operations/puppet/+/refs/heads/production/hieradata/common/service.yaml
TLS is enabled for push-notifications in the current deployment-charts, see https://gerrit.wikimedia.org/r/c/operations/deployment-charts/+/622330

I'm going to mark this as resolved, but also leave it to @jijiki or @Joe to re-open if I'm making the wrong assumption.