Notable configuration settings and feature flags¶

TRUSTED_HOSTS¶

Invenio has a configuration option called TRUSTED_HOSTS which controls which hosts/domain names can be served. A client request to a web server usually includes the domain name in the Host HTTP header:

GET /
Host: example.org
...

The web server uses that for instance to host several websites on the same domain. Also, the host header is usually used in a load balanced environment to generate links with the right domain name.

An attacker has full control of the host header and can thus change it to whatever they like, and for instance have the application generate links to a completely different domain.

Normally your load balancer/web server should only route requests with a white-listed set of hosts to your application. It is however very easy to misconfigure this in your web server, and thus Invenio includes a protective measure.

Simply set TRUSTED_HOSTS to a list of allowed hosts/domain names:

TRUSTED_HOSTS = ['www.example.org']

Failing to properly configure this variable will cause the error Bad Request Host x.x.x.x is not trusted. when starting the web app.

PROXYFIX_CONFIG¶

Invenio is commonly used with both a load balancer and a web server in front of the application server. The load balancer and web server both work as proxies, which means that the clients remote address usually gets added in the X-Forwarded-For HTTP header. Invenio will automatically extract the clients IP address from the HTTP header, however to prevent clients from doing IP spoofing you need to specify exactly how many proxies you have in front of you application server:

PROXYFIX_CONFIG={'x_for': 1, 'x_proto': 1}

You can find out more about the configuration options in invenio-base

Secret keys¶

Probably the most important security measure is to have strong random secret keys set for your InvenioRDM instance.

Good practices:

• Never commit your secrets in the source code repository (or any other password for that sake).
• Use different secrets for different deployments (testing, staging, production).

List of secrets:

• SECRET_KEY: The secret key is used for instance to sign user session ids and encrypt certain database fields. The secret key must be kept secret. If the key is leaked or stolen somehow, you should immediately change it to a new key.
• SECURITY_LOGIN_SALT: The salt value is used when generating login links/tokens.
• CSRF_SECRET_SALT: The salt value is used when generating login CSRF tokens.

SECRET_KEY = '..put a long random value here..'
SECURITY_LOGIN_SALT = '..put a long random value here..'
CSRF_SECRET_SALT = '..put a long random value here..'

Content Security Policy (CSP)¶

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. To configure such headers, change the var APP_DEFAULT_SECURE_HEADERS in invenio.cfg:

APP_DEFAULT_SECURE_HEADERS = {
    ...
}

Mathematical formulas (MathJax)¶

To render mathematical formulas on record landing pages, configure MathJax in your invenio.cfg:

THEME_MATHJAX_CDN = (
    "//cdnjs.cloudflare.com/ajax/libs/mathjax/3.2.2/es5/tex-mml-chtml.js"
    "?config=TeX-AMS-MML_HTMLorMML"
)

Since MathJax is loaded from a CDN, make sure your Content Security Policy allows cdnjs.cloudflare.com in APP_DEFAULT_SECURE_HEADERS.

Citation styles¶

InvenioRDM supports citations styles defined in the CSL 1.0.1 specifications. You can find the list of all possible citation styles here.

In the record landing page, you can display a subset of the available styles. In your invenio.cfg change:

RDM_CITATION_STYLES = [
     ('chicago-annotated-bibliography', _('Chicago')),
     ('ieee', _('IEEE')),
     ('science', _('Science')),
     ('apa', _('APA')),
     ('cell', _('Cell')),
]

By changing the list above, these styles will be visible in the record landing page and the user can click on them to change citation style.

You can change the default citation style used when loading the record landing page by setting:

RDM_CITATION_STYLES_DEFAULT = 'chicago-annotated-bibliography'

Download all files button¶

Introduced in v11

To enable/disable the UI button and backend functionality for being able to download all of a record's files as a single ZIP file, you can set in your invenio.cfg the following config:

RDM_ARCHIVE_DOWNLOAD_ENABLED = True

ZIP and container file preview¶

Introduced in v14

Previewers¶

A new previewable_zip previewer enables container browsing for ZIP files in the record landing page. It should replace the old zip entry in PREVIEWER_PREFERENCE in your invenio.cfg to allow previewing ZIP files:

PREVIEWER_PREFERENCE = [
    "csv_papaparsejs",
    "pdfjs",
    "iiif",
    "simple_image",
    "json_prismjs",
    "xml_prismjs",
    "mistune",
    "video_videojs",
    "audio_videojs",
    "ipynb",
    "previewable_zip",
    "txt",
]

PREVIEWER_CONTAINER_ITEM_PREFERENCE controls which previewers are tried for files inside an archive. It follows the same format as PREVIEWER_PREFERENCE but IIIF is excluded, since it requires additional image server links that are not available for container items:

PREVIEWER_CONTAINER_ITEM_PREFERENCE = [
    "csv_papaparsejs",
    "pdfjs",
    "simple_image",
    "json_prismjs",
    "xml_prismjs",
    "mistune",
    "video_videojs",
    "audio_videojs",
    "ipynb",
    "zip",
    "txt",
]

See ZIP and container files for the full configuration guide.

ZIP processing limits¶

The following variables control ZIP processing to protect against resource exhaustion. They are enforced at upload time.

Membership requests¶

Enable the feature i.e., allow communities to decide if users can request to join them:

COMMUNITIES_ALLOW_MEMBERSHIP_REQUESTS = False
"""Feature flag for membership request."""

Set lifespan of such requests:

COMMUNITIES_MEMBERSHIP_REQUESTS_EXPIRES_IN = timedelta(days=30)
"""Default amount of time before a membership request expires."""

Other relevant configurations

Location: https://github.com/inveniosoftware/invenio-communities/blob/master/invenio_communities/config.py

Prefix: COMMUNITIES_MEMBERSHIP_REQUESTS_

Usage

See Members section for details.