From 60fa206d43d7f905568e01597dd0ddf6c5f8e8c9 Mon Sep 17 00:00:00 2001
From: jerebear12 <72420925+jerebear12@users.noreply.github.com>
Date: Tue, 27 Feb 2024 10:42:31 -0600
Subject: [PATCH] Updated security.toml to include new
 filer.expose_directory_metadata.enabled configuration option.

---
 Security-Configuration.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/Security-Configuration.md b/Security-Configuration.md
index 7e68c01..560f561 100644
--- a/Security-Configuration.md
+++ b/Security-Configuration.md
@@ -31,6 +31,13 @@ expires_after_seconds = 10           # seconds
 [access]
 ui = false
 
+# by default the filer UI is enabled. This can be a security risk if the filer is exposed to the public
+# and the JWT for reads is not set. If you don't want the public to have access to the objects in your
+# storage, and you haven't set the JWT for reads it is wise to disable access to directory metadata.
+# This disables access to the Filer UI, and will no longer return directory metadata in GET requests.
+[filer.expose_directory_metadata]
+enabled = true
+
 # this jwt signing key is read by master and volume server, and it is used for read operations:
 # - the Master server generates the JWT, which can be used to read a certain file on a volume server
 # - the Volume server validates the JWT on reading