Server security options
arangod provides a variety of options to make a setup more secure. Administrators can use these options to limit access to certain ArangoDB server functionality as well as preventing the leakage of information about the environment that a server is running in.
General security options
The following security options are available:
--server.hardenIf this option is set to
trueand authentication is enabled, non-admin users will be denied access to the following REST APIs:
Additionally, no version details will be revealed by the version REST API at
The default value for this option is
arangod has several options that allow you to make your installation more
secure when it comes to running application code in it. Below you will find
an overview of the relevant options.
Allowlists and denylists
The set theory for these lists works as follow:
- Only a denylist is specified: Everything is allowed except a set of items matching the denylist.
- Only an allowlist is specified: Everything is disallowed except the set of items matching the allowlist.
- Both allowlist and denylist are specified: Everything is disallowed except the set of items matching the allowlist. From this allowed set, subsets can be forbidden again using the denylist.
Values for denylist and allowlist options need to be specified as ECMAScript regular expressions. Each option can be used multiple times. When specifying more than one pattern, these patterns will be combined with a logical or to the actual pattern ArangoDB will use.
These patterns and how they are applied can be observed by enabling
--log.level SECURITY=debug in the
arangosh log output.
The security option to observe the behavior of the pattern matching most easily is the masquerading of the startup options:
These sets will resolve internally to the following regular expressions:
Invoking an arangosh with these options will hide the denied commandline options from the output of:
… and an exception will be thrown when trying to access items that are masked in the same way as if they weren’t there in first place.
operations is only controlled via an allowlist, which can be specified via the
For example, when using the following startup options
/etc/issue will be allowed to accessed and all files in the directories
/etc/mtab plus their subdirectories will be accessible,
operations, with the following exceptions:
directory for storing temporary files. The temporary directory location
can be specified explicitly via the
--temp.pathoption at startup. If the option is not specified, ArangoDB will automatically use a subdirectory of the system’s temporary directory.
code running in ArangoDB. The exact path can be specified by the startup option
- http:// => tcp://
- https:// => ssl://
- no protocol will match http and https.
Filtering is done on the protocol, hostname / IP address, and the port.
arangodb.org will match:
ssl://arangodb.org will match:
ssl://arangodb.org:443 will match:
tcp://arangodb.org will match:
This can be tried out using an allowlist - all non matches will be blocked:
Options supporting allowlisting and denylisting
The following options are available for allowing and denying access to dedicated functionality for application code:
srv://. Note that for HTTP/SSL-based endpoints the port number will be included too, and that the endpoint can be specified either as an IP address or host name from application code.
true, this option enables the
internalmodule. The default value is
internalmodule, which may leak information about the environment:
The default value is
Security options for managing Foxx applications
The following options are available for controlling the installation of Foxx applications in an ArangoDB server:
--foxx.api: If set to
false, this option disables the Foxx management API, which will make it impossible to install and uninstall Foxx applications. Setting the option to
falsewill also deactivate the “Services” section in the web interface. The default value is
true, meaning that Foxx apps can be installed and uninstalled.
--foxx.store: If set to
false, this option disables the Foxx app store in ArangoDB’s web interface, which will also prevent ArangoDB and its web interface from making calls to the main Foxx application Github repository at github.com/arangodb/foxx-apps. The default value is