<commit_before>= How to configure a production-ready APIM environment
:page-sidebar: apim_3_x_sidebar
:page-permalink: apim/3.x/apim_how_to_configuration.html
:page-folder: apim/how-tos
:page-layout: apim3x

== Overview

During APIM installation some default settings are created.
While these default settings can be useful for testing your new installation, some of them may not be suitable for a production environment, where security is more of a consideration.

NOTE: This How to gives some tips on important settings to check in APIM when preparing to move to a production environment.
APIM includes many other configuration options and every environment is unique. We recommend you also read the link:{{ '/apim/3.x/apim_configurationguide.html' | relative_url }}[Configuration Guide^] to determine if you have completed all the configuration you need before you deploy APIM in production.

=== Configuring APIM

You can configure APIM settings in various ways -- the `gravitee.yml` file, the APIM Console settings and environment and system variables.
When you configure new settings, it is important to understand that one configuration type can override another.
link:{{ '/apim/3.x/apim_installguide_rest_apis_configuration.html' | relative_url }}[Configure APIM API^] gives a good overview of this topic.

== Step 1: Disable the internal APIs

APIM API and APIM Gateway include internal APIs which are enabled by default. If you do not intend to use them, we recommend you disable them.

Perform the following steps on both the APIM API component and the APIM Gateway component:

. Open your `gravitee.yml` file.
. In the `services:` section, set the `http:` `enabled` value to `false`:
+
----
services:
  core:
    http:
      enabled: false
      port: 18083
      host: localhost
      authentication:
        # authentication type to be used for the core services
        # - none : to disable authentication
        # - basic : to use basic authentication
        # default is "basic"
        type: basic
        users:
          admin: adminadmin
----

To learn more about the internal APIs, see:

* link:{{ '/apim/3.x/apim_installguide_rest_apis_technical_api.html' | relative_url }}[Configure the APIM API internal API^]
* link:{{ '/apim/3.x/apim_installguide_gateway_technical_api.html' | relative_url }}[Configure the APIM Gateway internal API^]

== Step 2: Update the default users

Some default users are created for you during installation. We recommend you remove any users you do not need.

IMPORTANT: We strongly recommend that, regardless of the user management system you put in place, you keep the default *admin* user, so that you can recover APIM in case of issues.
Remember to change the default administrator password.

Perform the following steps on the APIM API component:

. Open your `gravitee.yml` file.
. In the `security \ providers` section, remove any users you do not need:
+
----
security:
  # When using an authentication providers, use trustAll mode for TLS connections
  # trustAll: false
  providers:  # authentication providers
    - type: memory
      # allow search results to display the user email. Be careful, It may be contrary to the user privacy.
#      allow-email-in-search-results: true
      # password encoding/hashing algorithm. One of:
      # - bcrypt : passwords are hashed with bcrypt (supports only $2a$ algorithm)
      # - none : passwords are not hashed/encrypted
      # default value is bcrypt
      password-encoding-algo: bcrypt
      users:
        - user:
          username: user
          #firstname:
          #lastname:
          # Passwords are encoded using BCrypt
          # Password value: password
          password: <PASSWORD>
          roles: ORGANIZATION:USER,ENVIRONMENT:USER
          # Useful to receive notifications
          #email:
        - user:
          username: admin
          #firstname:
          #lastname:
          # Password value: <PASSWORD>
          password: <PASSWORD>
          roles: ORGANIZATION:ADMIN,ENVIRONMENT:ADMIN
          #email:
        - user:
          username: api1
          #firstname:
          #lastname:
          # Password value: <PASSWORD>
          password: <PASSWORD>
          # You can declare multiple roles using comma separator
          roles: ORGANIZATION:USER,ENVIRONMENT:API_PUBLISHER
          #email:
        - user:
          username: application1
          #firstname:
          #lastname:
          # Password value: <PASSWORD>
          password: <PASSWORD>.
          roles: ORGANIZATION:USER,ENVIRONMENT:USER
----
+
. Update the default administrator password:
+
image:{% link images/apim/3.x/how-tos/configure-apim/admin-pwd.png %}[]

To learn more about configuring users, see link:{{ '/apim/3.x/apim_installguide_authentication.html' | relative_url }}[Configure authentication^].

== Step 3: Update the JWT secret

The JWT secret is used for signing session cookies in the APIM UI components. Any users with this secret can log in to APIM and update their permissions.

Perform the following steps on the APIM API component:

. Open your `gravitee.yml` file.
. In the `jwt` section, update the `secret` value:
+
----
jwt:
  secret: myJWT4Gr4v1t33_S3cr3t
  # Allows to define the end of validity of the token in seconds (default 604800 = a week)
  #expire-after: 604800
  # Allows to define the end of validity of the token in seconds for email registration (default 86400 = a day)
  #email-registration-expire-after: 86400
  # Allows to define issuer (default gravitee-management-auth)
  #issuer: gravitee-management-auth
  # Allows to define cookie context path (default /)
  #cookie-path: /
  # Allows to define cookie domain (default "")
  #cookie-domain: .gravitee.io
  # Allows to define if cookie secure only (default false)
  #cookie-secure: true
----
+
. You can also update other values, such as:
- the `expire-after` value, to change the validity period from the default value of one week
- the `cookie-path` and `cookie-domain` values, to adapt them to your own environment; the values you define must be specific to the domain and path where the API is running and not apply to any another environment (for example, `.gravitee.io` could apply to any domain called `xxx.gravitee.io`, such as `dev.gravitee.io` or `qa.gravitee.io`)

[[update-the-default-apim-settings]]
== Step 4: Update the default APIM settings

The most common settings are described below. Not all of these settings need to be changed in every environment.

Perform the following steps in APIM Console:

. link:{{ '/apim/3.x/apim_quickstart_console_login.html' | relative_url }}[Log in to APIM Console^].
. Click *Settings*.
. In the *PORTAL* section:
.. Click *Settings*.
.. Update the *Company name*.
.. In the *Management* section of the page:
- Update the *Title* of APIM Console to make it more appropriate for your own environment.
- Update the *Management URL* to your APIM Console URL.
+
image:{% link images/apim/3.x/how-tos/configure-apim/portal-management-settings.png %}[]
+
. In the *GATEWAY* section:
.. Click *Sharding Tags*.
.. In the *Default configuration* section of the page, update the *Entrypoint* field with your APIM API endpoint.
+
NOTE: You can also update this value link:{{ '/apim/3.x/apim_installguide_rest_apis_configuration.html#environment_variables' | relative_url }}[with an environment variable^].
+
image:{% link images/apim/3.x/how-tos/configure-apim/gateway-shardingtags-settings.png %}[]
+
.. Click *API Logging*.
.. Update the maximum logging duration for APIM API logging to avoid flooding. In this example, we have configured a logging duration of 15 minutes:
+
image:{% link images/apim/3.x/how-tos/configure-apim/gateway-api-logging-settings.png %}[]
+
The recommended value depends on the type of logging you have enabled: the more information you log, the lower the value needs to be (although the value must be above zero to be taken into account).<commit_msg>docs(apim): configuration to avoid Cross Site Framing<commit_after>= How to configure a production-ready APIM environment
:page-sidebar: apim_3_x_sidebar
:page-permalink: apim/3.x/apim_how_to_configuration.html
:page-folder: apim/how-tos
:page-layout: apim3x

== Overview

During APIM installation some default settings are created.
While these default settings can be useful for testing your new installation, some of them may not be suitable for a production environment, where security is more of a consideration.

NOTE: This How to gives some tips on important settings to check in APIM when preparing to move to a production environment.
APIM includes many other configuration options and every environment is unique. We recommend you also read the link:{{ '/apim/3.x/apim_configurationguide.html' | relative_url }}[Configuration Guide^] to determine if you have completed all the configuration you need before you deploy APIM in production.

=== Configuring APIM

You can configure APIM settings in various ways -- the `gravitee.yml` file, the APIM Console settings and environment and system variables.
When you configure new settings, it is important to understand that one configuration type can override another.
link:{{ '/apim/3.x/apim_installguide_rest_apis_configuration.html' | relative_url }}[Configure APIM API^] gives a good overview of this topic.

== Step 1: Disable the internal APIs

APIM API and APIM Gateway include internal APIs which are enabled by default. If you do not intend to use them, we recommend you disable them.

Perform the following steps on both the APIM API component and the APIM Gateway component:

. Open your `gravitee.yml` file.
. In the `services:` section, set the `http:` `enabled` value to `false`:
+
----
services:
  core:
    http:
      enabled: false
      port: 18083
      host: localhost
      authentication:
        # authentication type to be used for the core services
        # - none : to disable authentication
        # - basic : to use basic authentication
        # default is "basic"
        type: basic
        users:
          admin: adminadmin
----

To learn more about the internal APIs, see:

* link:{{ '/apim/3.x/apim_installguide_rest_apis_technical_api.html' | relative_url }}[Configure the APIM API internal API^]
* link:{{ '/apim/3.x/apim_installguide_gateway_technical_api.html' | relative_url }}[Configure the APIM Gateway internal API^]

== Step 2: Update the default users

Some default users are created for you during installation. We recommend you remove any users you do not need.

IMPORTANT: We strongly recommend that, regardless of the user management system you put in place, you keep the default *admin* user, so that you can recover APIM in case of issues.
Remember to change the default administrator password.

Perform the following steps on the APIM API component:

. Open your `gravitee.yml` file.
. In the `security \ providers` section, remove any users you do not need:
+
----
security:
  # When using an authentication providers, use trustAll mode for TLS connections
  # trustAll: false
  providers:  # authentication providers
    - type: memory
      # allow search results to display the user email. Be careful, It may be contrary to the user privacy.
#      allow-email-in-search-results: true
      # password encoding/hashing algorithm. One of:
      # - bcrypt : passwords are hashed with bcrypt (supports only $2a$ algorithm)
      # - none : passwords are not hashed/encrypted
      # default value is bcrypt
      password-encoding-algo: bcrypt
      users:
        - user:
          username: user
          #firstname:
          #lastname:
          # Passwords are encoded using BCrypt
          # Password value: password
          password: <PASSWORD>
          roles: ORGANIZATION:USER,ENVIRONMENT:USER
          # Useful to receive notifications
          #email:
        - user:
          username: admin
          #firstname:
          #lastname:
          # Password value: admin
          password: <PASSWORD>
          roles: ORGANIZATION:ADMIN,ENVIRONMENT:ADMIN
          #email:
        - user:
          username: api1
          #firstname:
          #lastname:
          # Password value: <PASSWORD>
          password: <PASSWORD>
          # You can declare multiple roles using comma separator
          roles: ORGANIZATION:USER,ENVIRONMENT:API_PUBLISHER
          #email:
        - user:
          username: application1
          #firstname:
          #lastname:
          # Password value: <PASSWORD>
          password: <PASSWORD>.
          roles: ORGANIZATION:USER,ENVIRONMENT:USER
----
+
. Update the default administrator password:
+
image:{% link images/apim/3.x/how-tos/configure-apim/admin-pwd.png %}[]

To learn more about configuring users, see link:{{ '/apim/3.x/apim_installguide_authentication.html' | relative_url }}[Configure authentication^].

== Step 3: Update the JWT secret

The JWT secret is used for signing session cookies in the APIM UI components. Any users with this secret can log in to APIM and update their permissions.

Perform the following steps on the APIM API component:

. Open your `gravitee.yml` file.
. In the `jwt` section, update the `secret` value:
+
----
jwt:
  secret: myJWT4Gr4v1t33_S3cr3t
  # Allows to define the end of validity of the token in seconds (default 604800 = a week)
  #expire-after: 604800
  # Allows to define the end of validity of the token in seconds for email registration (default 86400 = a day)
  #email-registration-expire-after: 86400
  # Allows to define issuer (default gravitee-management-auth)
  #issuer: gravitee-management-auth
  # Allows to define cookie context path (default /)
  #cookie-path: /
  # Allows to define cookie domain (default "")
  #cookie-domain: .gravitee.io
  # Allows to define if cookie secure only (default false)
  #cookie-secure: true
----
+
. You can also update other values, such as:
- the `expire-after` value, to change the validity period from the default value of one week
- the `cookie-path` and `cookie-domain` values, to adapt them to your own environment; the values you define must be specific to the domain and path where the API is running and not apply to any another environment (for example, `.gravitee.io` could apply to any domain called `xxx.gravitee.io`, such as `dev.gravitee.io` or `qa.gravitee.io`)

[[update-the-default-apim-settings]]
== Step 4: Update the default APIM settings

The most common settings are described below. Not all of these settings need to be changed in every environment.

Perform the following steps in APIM Console:

. link:{{ '/apim/3.x/apim_quickstart_console_login.html' | relative_url }}[Log in to APIM Console^].
. Click *Settings*.
. In the *PORTAL* section:
.. Click *Settings*.
.. Update the *Company name*.
.. In the *Management* section of the page:
- Update the *Title* of APIM Console to make it more appropriate for your own environment.
- Update the *Management URL* to your APIM Console URL.
+
image:{% link images/apim/3.x/how-tos/configure-apim/portal-management-settings.png %}[]
+
. In the *GATEWAY* section:
.. Click *Sharding Tags*.
.. In the *Default configuration* section of the page, update the *Entrypoint* field with your APIM API endpoint.
+
NOTE: You can also update this value link:{{ '/apim/3.x/apim_installguide_rest_apis_configuration.html#environment_variables' | relative_url }}[with an environment variable^].
+
image:{% link images/apim/3.x/how-tos/configure-apim/gateway-shardingtags-settings.png %}[]
+
.. Click *API Logging*.
.. Update the maximum logging duration for APIM API logging to avoid flooding. In this example, we have configured a logging duration of 15 minutes:
+
image:{% link images/apim/3.x/how-tos/configure-apim/gateway-api-logging-settings.png %}[]
+
The recommended value depends on the type of logging you have enabled: the more information you log, the lower the value needs to be (although the value must be above zero to be taken into account).


== STEP 5: Mitigate Cross Site Framing

Default configuration for NGinx

```
add_header X-Frame-Options "SAMEORIGIN" always;
```

In order to allow specific origin, you can add this header

```
add_header X-Frame-Options "ALLOW-FROM my-domain.com"
```
{'fraction_non_alphanumeric': 0.08232968933358038, 'fraction_numerical': 0.007102711382867025, 'mean_word_length': 3.4168030551009276, 'pattern_counts': {'":': 0, '<': 16, '<?xml version=': 0, '>': 16, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2010808', 'n_tokens_mistral': 4622, 'n_tokens_neox': 4480, 'n_words': 1904}