From 1e0d7102ccfea4fdb64b5257bbcfd3cecc842a7e Mon Sep 17 00:00:00 2001 From: Felix Dreissig Date: Thu, 20 Mar 2025 14:22:54 +0100 Subject: [PATCH] Docs: Add auth for metrics to hardening page (#102475) --- .../configure-security-hardening/index.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/sources/setup-grafana/configure-security/configure-security-hardening/index.md b/docs/sources/setup-grafana/configure-security/configure-security-hardening/index.md index f5e66394faf..b06fad81904 100644 --- a/docs/sources/setup-grafana/configure-security/configure-security-hardening/index.md +++ b/docs/sources/setup-grafana/configure-security/configure-security-hardening/index.md @@ -118,6 +118,18 @@ Example: hide_version = true ``` +### Enable auth for metrics + +By default, metrics from Grafana itself can be accessed without authentication. This can lead to inadvertent information leakage. + +To enable basic authentication for the metrics endpoint: + +```toml +# If both are set, basic auth will be required for the metrics endpoints +basic_auth_username = +basic_auth_password = +``` + ### Enforce domain verification If set to `true`, the Grafana server redirects requests that have a Host-header value that is mismatched to the actual domain. This might help to mitigate some DNS rebinding attacks.