Configuration Properties: Reference (System)
Commons REST Client
The following are properties to configure the commons REST client library, a library that all SAS Viya microservices incorporate.
sas.commons.rest.client
The set of configuration properties for the commons REST client library.
- Bypass HTTP proxy
-
Enables requests to be routed directly to the service rather than through the HTTP proxy. Changing Bypass HTTP proxy requires you to restart all SAS Viya services.
HTML Clients
The following are properties to configure HTML clients.
sas.htmlcommons
The set of properties for HTML clients.
- blockedFileExtensions
-
A regular expression containing a list of file extensions that the HTML applications are allowed to block. Separate values with a vertical bar (|)
- blockCommentAttachments
-
Blocks users from viewing or adding attachments to comments. If set to true, the button for adding attachments to comments is hidden in the user interface. Any attachments that were previously added are also hidden.
- disableWelcomeScreens
-
If set to true, disables the welcome screen in HTML applications. Click Add property to specify this configuration property.
- insecureViewingCommentAttachmentTypes
-
The list of file content types that are allowed to be uploaded and viewed in a non-secure sandbox iframe from the Comments Manager. Use the OR character (|) to separate multiple values. Here are examples of values that you add: text/HTML | text/javascript | image/bmp | application/json | text/css | text/csv | image/gif | text/XML | image/png. The following default values are configured in the source code:
- application/msword
- application/vnd.openxmlformats-officedocument.wordprocessingml.document
- application/vnd.ms-powerpoint
- application/vnd.openxmlformats-officedocument.presentationml.presentation
- application/vnd.ms-excel
- application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
- application/pdf
Click Add property to specify this configuration property.
Note: Any virus content file or non-allowed domain-specific file is not allowed to view even if the file type is defined here.
Java Virtual Machine (JVM)
The set of properties (Java options) that are used to configure the Java Virtual Machine when it is launched. Each JVM property specified in SAS Environment Manager corresponds to a single Java option.
To specify service or global options for the JVM, follow the steps listed in Create Configuration Instances.
When adding each JVM property, remember these guidelines:
- For the list of the valid Java options and descriptions, see http://docs.oracle.com/javase/6/docs/technotes/tools/windows/java.html.
- The property name for each Java option that you add must start with the string, java_option_ (for example, java_option_xmx).
- The property value is a single Java command-line option (for example, -Xmx512m).
- When the property names match, Java options specified at the service level override global Java options.
- Matching a Java option’s property name (with a value consisting of a zero-length string) is the only way to disable Java option values.
- There is no control over the order that the JVM processes Java options.
Security
The following are properties to configure web security.
sas.commons.web.security
The set of properties that are used to configure web security.
- content-security-policy
-
The string used for the Content-Security-Policy HTTP header.
- content-security-policy-enabled
-
Sends the Content-Security-Policy header in HTTP responses to prevent injection attacks.
- x-content-type-options
-
The string used for the X-Content-Type-Options header for unsecured endpoints.
- x-content-type-options-enabled
-
Sends the X-Content-Type-Options header in HTTP responses for unsecured endpoints.
- x-frame-options
-
The string used for the X-Frame-Options HTTP header. A restart is required to pick up changes to this property.
- x-frame-options-enabled
-
Sends the X-Frame-Options header in HTTP responses. A restart is required to pick up changes to this property.
- x-xss-protection
-
Note: The protections brought by this property are largely superceded by a strong content security policy. It is recommended to use the content-security-policy property and to leave the x-xss-protection at its default value.
The string used for the X-XSS-Protection header for unsecured endpoints.
- x-xss-protection-enabled
-
Note: The protections brought by this property are largely superceded by a strong content security policy. It is recommended to use the content-security-policy property and to leave the x-xss-protection-enabled at its default value.
Sends the X-XSS-Protection header in HTTP responses for unsecured endpoints.
sas.commons.web.security.cookies
The set of properties that are used to configure security related to cookies.
Modifying one of these property values requires you to restart the service to which the property is applied.
- sameSite
-
Specifies whether cookies should be sent only with same-site requests. These are the valid values:
- Unset (default)
-
same-site cookie attribute is not set
- None
-
same-site cookie attribute is set and the cookie is always sent in cross-site requests
- Lax
-
browser sends the cookie only in same-site requests and cross-site top level GET requests
- Strict
-
browser prevents sending the cookie in any cross-site request
sas.commons.web.security.cors
The set of properties that are used to configure Cross-Origin Resource Sharing (CORS) security. By default, CORS is enabled. For more information about CORS, see CORS support in Spring Framework.
Modifying one of these property values requires you to restart the service to which the property is applied.
- allowCredentials
-
Allows credentials to be used in cross-origin requests. By default, this property is set to On.
- allowedHeaders
-
The comma-separated list of HTTP headers that are allowed, by default, in cross-origin requests. Specify an asterisk ('*') to match any header.
- allowedOrigins
-
The comma-separated list of origins that are allowed.
- allowedMethods
-
The comma-separated list of HTTP methods that are allowed, by default, in cross-origin requests. Specify an asterisk ('*') to match any method.
Note:
sas.commons.web.security.csrf
The set of properties
that are used to configure Cross-Site Request Forgery (CSRF) security.
By default, CSRF is enabled. To disable it, create a new configuration
for the security definition. Specify the property name as enable-csrf and
the value as false. For more
information, see Create Configuration Instances.
SAS Viya protects against CSRF using the following:
- Synchronizer Tokens: Randomly generated tokens that are associated with the user’s current session. CSRF is checked only on requests with authenticated sessions and is always skipped on GET, HEAD, TRACE, and OPTIONS requests.
- Header Checking: A filter that checks that the HTTP Referer header has the host and port of the requested URI or matches an optional whitelist of URIs that is configured as a comma-separated list in the sas.commons.web.security.csrf.allowedUris property.
For more information about CSRF, see Common application properties.
- allowedReferers
-
This property is currently not supported and should be left blank.
- allowedUris
-
The comma-separated list of referer URIs that are allowed by default. The list must contain regular expressions.
- failIfNoHeaders
-
Blocks requests if both the Origin and Referer headers are absent.
sas.security
The set of configuration properties that are used to configure security for SAS Viya servers and services. The sas.security configuration instance applies to all SAS Viya servers and services (global).
- network.databaseTraffic.enabled
-
Toggle security for database traffic.
- network.sasData.enabled
-
Toggle security for other SAS information.
- network.serverControl.enabled
-
Toggle security for serverControl.
- network.web.enabled
-
Toggle security for web-based traffic.
Spring Boot Services
Here is the list of third-party, Spring Boot services that you can configure. For a list of the valid property names and descriptions, see Common application properties.
CAUTION
When adding a property, be extremely careful. Entering the wrong property name or an invalid data type can cause SAS Viya to become inoperable.
- Endpoints
-
The set of properties that are used to configure Spring Actuator endpoints.
- Flyway
-
The set of properties that are used to configure Spring Flyway integration.
- Liquibase
-
The set of properties that are used to configure Spring Liquibase integration.
- Logging
-
The set of properties that are used to configure logging.
- Logging.Level
-
The set of properties that are used to configure logging levels.
- Management
-
The set of properties that are used to configure Spring application management.
- Multipart
-
The set of properties that are used to configure Spring multipart handling.
- Security
-
The set of properties that are used to configure Spring security.
- Server
-
The set of properties that are used to configure the embedded Spring server.
- Shell
-
The set of properties that are used to configure the Spring remote shell.
- Spring
-
The set of properties that are used to configure other Spring features.
zones
The set of properties that are used to configure zone information for multi-tenancy. Modifying one of these property values requires you to restart the service.
- internal.hostnames
-
The comma-separated list of internal host names that are used to access the provider zone, or that are used in a subdomain to access other zones.
TipBe sure to specify the base host name without any tenant prefixes.TipIf you use a load balancer as a front end to the Apache HTTP Server and microservices, you must include the full qualified domain name of the load balancer in the list of host names.