.. _SecurityConfigurationSection:

Security Configuration Section
""""""""""""""""""""""""""""""

This section of the :ref:`ProductConfigurationParametersAdminPage` can be used to
set the following values:

.. list-table::
   :header-rows: 1
   :widths: 20 80
   :class: tight-table

   * - Parameter
     - Description
   * - *Whitelisted URLs*
     - URL prefixes that are explicitly allowed for features that fetch from
       user-submitted URLs, such as SPARQL ``SERVICE`` clauses and the ADS
       ``IO.http`` function. Each value must start with ``http://`` or
       ``https://``.


.. _url_whitelist:

The URL whitelist
'''''''''''''''''

Several features fetch data from URLs that are supplied by users, including:

* SPARQL queries that use the ``SERVICE`` keyword to query a remote endpoint
* the ADS ``IO.http`` function

To guard against `Server-Side Request Forgery (SSRF)
<https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html>`_,
requests made by these
features are validated against an **allowlist** of permitted URL prefixes. A
request is only carried out if the requested URL **starts with** one of the
whitelisted prefixes. Regardless of the whitelist, all requests must use the
``http://`` or ``https://`` scheme.

When this parameter is left empty, whether unlisted public URLs are allowed or
blocked is determined by the server's setup-file configuration, which is
managed by administrators. Access to private-network addresses is controlled in
the same place and cannot be granted here. See :ref:`Setup file: whitelistedURLs
<setup_whitelistedURLs>`.


**Further Reading on TopBraid**

* :ref:`introduction`