Browser tab content: # Secure OpenReplay

It’s highly recommended **to only allow open ports 80/443 to the machine** using security groups. There are some componenes litening to the 0.0.0.0 address, to make networking easier, like k3s server api, flannel api etc.

If you’re bringing your own certificate, create an SSL secret using the following command: `kubectl create secret tls openreplay-ssl -n app --key="private_key_file.pem" --cert="certificate.crt"`.

> **Note:** If you don’t have a certificate, generate one, that auto-renews, for your subdomain (the one provided during installation) using Let’s Encrypt. Simply connect to OpenReplay instance, run `cd openreplay/scripts/helmcharts && bash certmanager.sh` and follow the steps.

If you wish to enable http to https redirection (recommended) edit the configuration using `openreplay -e`, then uncomment the below block, under the `ingress-nginx` section:

```
ingress-nginx: &ingress-nginx
  controller:
    config:
      ssl-redirect: true
      force-ssl-redirect: true
```

> **Note:** Our `ingress-nginx` runs by default on ports `80|443`, but this can be easily changed, if needed, in `vars.yaml`:

```
ingress-nginx: &ingress-nginx
  controller:
    service:
      ports:
        http: 80
        https: 443
```

Save and exit using `:wq` for the service to reload.

To indicate whether or not a browser should be allowed to render a page in a `<frame>, <iframe>, <embed>` or `<object>` and avoid click-jacking attacks, set the `X-Frame-Options` response header by editing the configuration using `openreplay -e`:

```
ingress-nginx: &ingress-nginx
  controller:
    addHeaders:
      X-Frame-Options: "SAMEORIGIN"
```

Then, save and exit using `:wq` for the service to reload.

OpenReplay supports reCaptcha (v2) for additional security. To enable this protection:

1.  Get a v2 reCaptcha key from Google, with `invisible` mode enabled, i.e. do not prompt for `tick I am not a human`.
2.  Open `/var/lib/openreplay/vars.yaml` then uncomment and update the below env variables in `chalice` section:

-   `captcha_server`: The URL to your reCaptcha service (e.g. [https://www.google.com/recaptcha/api/siteverify](https://www.google.com/recaptcha/api/siteverify))
-   `captcha_key`: You reCaptcha secret key

3.  Edit `.env` in `openreplay/frontend/` (copy `.env.sample` if it does not exist) and substitute the `CAPTCHA_SITE_KEY` variable with your reCaptcha site key.
4.  Rebuild the frontend:

```
cd openreplay/frontend
IMAGE_TAG=my-custom-image PUSH_IMAGE=1 DOCKER_REPO=my-docker-user-name bash -x build.sh
```

5.  Open `/var/lib/openreplay/vars.yaml` and specify your newly built frontend image in the `frontend` block:

```
frontend:
  image:
    repository: "my-docker-username/frontend"
    tag: "my-custom-image"
```

6.  Restart the frontend and web server services for the changes to take effect:

```
openreplay -R
```

Here is an example of a policy (CSP) for allowing OpenReplay to record sessions. This has to be adapted depending on your domain and security requirements:

```
worker-src ‘self’ blob: https://openreplay.mycompany.com https://*.openreplay.com; script-src ‘self’ https://openreplay.mycompany.com https://*.openreplay.com;
```

To apply your CSP to NGINX, connect to your OpenReplay instance and follow the below steps:

1.  Run `openreplay -e` and add your CSP in the `frontend` block. Make sure to update

```
frontend:
  ingress:
    cspSnippet: |
      add_header Content-Security-Policy "worker-src 'self' blob: https://openreplay.mycompany.com https://*.openreplay.com; script-src 'self' https://openreplay.mycompany.com https://*.openreplay.com;";
```

> **Note:** Make sure to replace `https://openreplay.mycompany.com` occurences in the above CSP with your OpenReplay domain name. The value should be the same as `DOMAIN_NAME` in `/var/lib/openreplay/vars.yaml` file.

2.  Save and exit using `:wq` to apply your newly added CSP

Cross-domain requests are allowed, by default, from all origins (`Access-Control-Allow-Origin: *`). If you wish to restrict recordings from few domains only, then run `openreplay -e` and update the `http` block by adding the below annotations:

```
http:
  ingress:
    annotations:
      nginx.ingress.kubernetes.io/cors-allow-methods: POST
      nginx.ingress.kubernetes.io/cors-allow-headers: Content-Type,Authorization,Content-Encoding
      nginx.ingress.kubernetes.io/cors-allow-origin: https://app1.mycompany.com,https://app2.mycompany.com,https://*.mycompany.com
      nginx.ingress.kubernetes.io/enable-cors: "true"
      nginx.ingress.kubernetes.io/cors-expose-headers: "Content-Length"
```

Then save and exit using `:wq` to apply your newly added CSP.

If you have any questions about this process, feel free to reach out to us on our [Slack](https://slack.openreplay.com/) or check out our [Forum](https://forum.openreplay.com/).

Was siehst du?