Skip to content
This page View Markdown Open in ChatGPT Open in Claude

Before you go live

A new installation is set up for its first steps, not for real users. Go through this list before real data arrives, and again after a big change.

In short

  • Change the default passwords, and replace the API user default and the group Default.
  • Add a row scoping pre hook to every table people reach, and run the security report.
  • HTTPS only, private databases, backups you have restored once.

Accounts and passwords

  • Change the passwords of the admin panel. A new installation has two users, [email protected] (R00t_123456789) and [email protected] (Admin_123456789) : change the password of the first in Root Settings, of the second in its profile.
  • Turn on two-factor sign-in for the people of the admin panel.
  • Replace the API user default. Its password is in the secret (common.apiUserPasswords.default) : empty on a new account, or the one your installation gives every new account. Give each application an API user of its own with a long password, and delete default or change its password.

Who reaches what

  • Replace the group Default. It grants everything. Make small groups, one per screen or per job, with the tables, APIs and fields each needs, and no allCollections or allSystemApis.
  • Close the row gate. Every table people reach through the generated APIs needs a row scoping pre hook : the owner in every filter, stamped on every write.
  • Run the security report and fix or skip, with a reason, every finding. Aim for grade A.
  • Review what is public. The APIs marked IS_PUBLIC, and the system APIs opened over HTTP : each one has a reason.
  • List the allowed origins of your web apps, so browsers on other sites are refused.

The server

  • HTTPS only. Give the reverse proxy of the server your domains (see HTTPS and addresses), or use the built-in web server of API Maker, so tokens never travel in clear. The built-in web server sends Strict-Transport-Security on the admin panel and can let only your addresses reach it (apiMaker.adminPanel.allowFrom).
  • Set your licence key. The key of API Maker Launchpad is for development on a computer.
  • Keep the databases private. Your databases, and the MongoDB and Redis of API Maker, answer on a private network or on the server itself, never on the internet.
  • Back up. The MongoDB of API Maker (mongodump), your own databases, and /root/config/.env with license.txt : a backup you have restored once is the one you can trust.

Your code

  • Run only code you trust on the server. The sandboxes stop faulty code, not hostile code : read what they protect. For clients who must not see each other's data, use separate servers.
  • Keep secrets in the secret. No key or password written in the code : the code scan of the report finds them.
  • Run the test cases : npm run test in the folder of the local client.