# Server Configuration
URL: https://docs.valsight.ai/server-configuration/
Description: Typical Setups use a separate reverse proxy as SSL Endpoint instead of the integrated SSL functionality. See Deployment overview.
The core server settings for an on-premise installation: session timeout, SSL/TLS, host header restrictions, CSRF prevention, user management and the CORS allowlist.

## Session duration

```
server: sessionTimeout: 5400
```

## SSL

> Typical Setups use a separate reverse proxy as SSL Endpoint instead of the integrated SSL functionality. See Deployment overview.

Generate a key:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365

openssl pkcs12 -export -in cert.pem -inkey key.pem -out keystore.p12 -name jetty -caname root

Make sure the keyAlias matches exactly - it is case sensitive.

To check the keystore, you may run

keytool(.exe) -list -v -keystore path\to\conf\keystore.p12

```
server:
    port: 8443
    ssl:
        keyStore: /certificates/keystore.p12
        keyStorePassword: secret
		keyAlias: jetty
```

## Restricting host headers

It is possible to configure exactly which host headers the HTTP requests are allowed to have. If we don't configure this, the servers accepts all hosts.

The server checks the values of 'X-Forwarded-Host' and 'Host' header, where the header 'X-Forwarded-Host' takes priority. If no configured headers match the HTTP header value the servers responds with HTTP status 400. This also happens if the HTTP headers are missing.

To configure simply add the property 'hostHeaderAllowlist' to the config.yml, followed by a comma separated list of accepted domains.

```
hostHeaderAllowlist: mydomain1.com:8080, mydomain3.net
```

The domains must be configured to the value that is sent to the server, which may differ from the URL in the browser.

## CSRF prevention

By default, the server is configured so that CSRF attacks are prevented by requiring a unique token to be send for form requests. The REST API requires the content type to be application/json. If needed, both security mechanism can be disabled via the *config.yml* using the following configuration.

```
disableCheckCSRF:
    contentTypeCheck: true
    tokenCheck: true
```

## Unblocking users and password reset

In case you need to reset a password for a user on startup, add the following to *config.yml.* The *new\_password* must comply with the configured password rules. The respective user will also be unblocked and enabled.

```
unblock:
    password: new_password
    username: existing_user
```

## Cross-Origin resource sharing (CORS) allowlist

This adds an allowlist for the 'Origin' HTTP header in requests where the HTTP request's 'URL' and 'Origin' do not match.

It protects against [Cross-Site WebSocket Hijacking](https://christian-schneider.net/CrossSiteWebSocketHijacking.html) (CSWSH) attacks and should always be set.

```
grails:
    cors:
       allowedOrigins:
       - http://www.allowedorigin1.com
       - http://www.allowedorigin2.com
```