Search results

Block Sending Data to Unknown Domain

The callback URL will be present throughout certain workflow within the application, allowing operation status and other data to be delivered back to the program via that URL (ex: Publishing dashboard from one server to another server). What if a scammer changes the URL and manages to regain access to the encrypted data? This is a kind of Server-side request forgery (SSRF) attack.

A Server-side request forgery (SSRF) attack is an attack that misuses server functionality to access or modify resources. By modifying the request URL, the attacker induces a server-side application to make requests to an unintended destination.

NOTE: Known Domain Configuration support is available in On-Premises Deployment and it is not available in Syncfusion Managed Cloud Server.

Avoid SSRF attack in Bold BI

This attack can be avoided by configuring known domains in Bold BI in a known domain JSON file.

Steps to configure the Known Domain’s

  1. Go to the UMS Administration page in Bold BI and click on the Configuration tab. A list of known domains in a JSON file can be configured here.

    UMS Settings

  2. Select the known_domains.json file to configure the allowed and denied domain list on this page.

    Known Domain Json

  3. If you want to configure known domains in Bold BI, you must set the Enabled node to true.

    Known Domain Json Enable

  4. You can add a list of denied domains to the Deny node. If you want to allow or deny all external domains, you can use wildcard * in known domain JSON nodes. You can also use a wildcard with the subdomain (*, *.*

    Denied Domains

  5. You can add a list of allowed domains to the Allow node. You can add more than one domain with a comma.

    Allowed Domains

Important: Internal Bold BI domains are allowed by default, i.e. domains from Bold BI sites.

  1. Once configured, click the Save button to update the Known Domain JSON file.

    Save Known Domain Json

Note: If you have configured the same domain in both Allow and Deny, the domain will be denied as the denied list takes first priority.