Is there a list of what the Umbraco backoffice needs as a minimum to run happily?
Deployed for a client and their security team have recently locked everything down. We’re finding things one by one (newest one is that the Save and Publish uses a http PUT action and that’s blocked.
I don’t suppose anyone has a definitive list of what you definitely shouldn’t block?
Steve
Firstly, the management API is well documented and you can work from that somewhat as its basically a list of all the APIs that the back office uses.
However…
This is a slightly more nuanced question and depends a lot on how the WAF is implemented and what level of security the client wants/needs.
For example, you could say that you never want the WAF to block publishing. But, what if the user is trying to publish a page that contains a SQLi attack? You probably still want to block that!
IME the best approach is to do what you’re doing and run the backoffice through the WAF with the default rules in place, see what triggers and then add specific exceptions for the problem rules that are getting triggered.
Fair - just painful hitting each brick wall and waiting for them to respond to each ticket.
But hey - not my process 