Skip to main content

Setup, Configuration, Security, DevOps

OpenDXP Configuration​

Sites​

For every OpenDxp site, you have to define context subdomains:

  • api.your-main-domain.com (your FQDN where the api is exposed)
  • services.your-main-domain.com

Each site can also be individually configured for the headless bundle (General Domain, Flush Frontend Cache, Asset Base URI) via the site's Additional Settings in the admin panel. See Site-based Host Configuration for details.

Security​

Notes​

  • Form option csrf_protection for all forms will be disabled

Setup​

# config.yaml
opendxp:
    # [..]
    security:
        password_hasher_factories:
            OpenDxp\Model\DataObject\User: OpenDxp\Security\Hasher\Factory\UserAwarePasswordHasherFactory

# security.yaml
security:

    providers:
        # [...]
        api_user_provider:
            id: OpenDxp\Bundle\HeadlessBundle\Security\ApiUserProvider

    # [...]
    
    firewalls:
        headless_api: '%opendxp_headless.firewall_settings%'

Swagger Authentication​

If you want to add a simple basic auth to your swagger documentation, add this to your security configuration:

Main Security Configuration​

# packages/security.yaml
security:

    password_hashers:
        
        # [...]
        
        Symfony\Component\Security\Core\User\InMemoryUser:
            algorithm: bcrypt

    providers:

        swagger_provider:
            memory:
                users:
                    my_user:
                        password: '$2y$13$123'  # generate it with bin/console security:hash-password
                                                # you may want to use an env or parameter variable here
                        roles: ['ROLE_SWAGGER']

        # [...]
    
    firewalls:

        swagger:
            pattern: ^/doc
            host: 'api\..+'                     # you may want to use an env or parameter variable here
            stateless: true
            http_basic:
                realm: 'API Documentation'
                provider: swagger_provider

        # [...]
    
    access_control:
        
        - { 
            path: ^/doc,
            host: 'api\..+',                    # you may want to use an env or parameter variable here
            roles: ROLE_SWAGGER 
        }

       # [...]

Disable Authentication in DEV Environment​

# packages/dev/config.yaml
security:
    firewalls:
        swagger:
            security: false

DevOps​

TBD