Merge pull request #217 from Axway-API-Management-Plus/security-findings

Fixed assigned security findings

Author: Chris Wiechmann

README.md

@@ -804,7 +804,7 @@ You can find more information about the individual certificates in the `.env` fi
 <p align="right"><a href="#table-of-content">Top</a></p>
 
 ### Secure API-Builder Traffic-Monitor API
-The API-Builder project for providing access to Elasticsearch data has no access restrictions right now. To ensure only API-Gateway Manager users (topology administrators with proper RBAC role) or other users with appropriate access rights can query the log data, one can expose this API via API-Manager and add security here.
+The API-Builder REST-API for accessing Elasticsearch data currently has no access restrictions. To ensure only API-Gateway Manager users (topology administrators with proper RBAC role) or other users with appropriate access rights can query the log data, one can expose this API via API-Manager and add security there.
 
 To import the API Builder application REST-API into your API-Manager, you can access the Swagger/OpenAPI definition here (replace docker-host and port appropriately for the container that is hosting the API-Builder project):  
 https://docker-host:8443/apidoc/swagger.json?endpoints/trafficMonitorApi

apibuilder4elastic/blocks/post_example.js

@@ -65,7 +65,7 @@ module.exports = {
 	// default configuration.
 
 	// API key
-	apikey: 'MH8gIje1mN0lAw5I3O52PmJ6JTC0sIOT',
+	apikey: '',
 
 	// This is the base url the service will be reachable at not including the
 	// port
@@ -195,23 +195,11 @@ module.exports = {
 
 	// You can generally leave this as-is since it is generated for each new
 	// service you created.
-	session: {
-		encryptionAlgorithm: 'aes256',
-		encryptionKey: 'fJuOadXFZcAh8G4MJ8ZairnpHIyNy4RSeeXm0Vksr20=',
-		signatureAlgorithm: 'sha512-drop256',
-		signatureKey: 'ETYlfmj6UYDok4HkzsApDqsjpvaavoZvs3UX2E1uMQ527pE9BQfRJ5C09n3IuQANg31ruSUp5q71EDjn01N7Jw==',
-		// should be a large unguessable string
-		secret: 'cYg2YZ8gGL3WnHDo01MrE+0QezqEhXZT',
-		// how long the session will stay valid in ms
-		duration: 86400000,
-		// if expiresIn < activeDuration, the session will be extended by
-		// activeDuration milliseconds
-		activeDuration: 300000
-	},
+	session: { },
 
 	// If you want signed cookies, you can set this value. if you don't want
 	// signed cookies, remove or make null
-	cookieSecret: '9GGH5fVoGbl45JnHHV0YSn032D+/g5oR',
+	cookieSecret: '',
 
 	// Your connector configuration goes here
 	connectors: {