The J-Obs dashboard can be protected with authentication to prevent unauthorized access. Security is disabled by default for development convenience.

• Enabling Security
• Authentication Types
• Basic Authentication
• API Key Authentication
• Mixed Authentication
• Exempt Paths
• Configuration Reference
• Login Endpoints
• Best Practices

j-obs:
  security:
    enabled: true
    type: basic  # or "api-key" or "both"
    users:
      - username: admin
        password: ${J_OBS_PASSWORD}
        role: ADMIN
      - username: viewer
        password: ${J_OBS_VIEWER_PASSWORD}
        role: USER

For browser access, users see a login page at /j-obs/login. Sessions are maintained with configurable timeout.

j-obs:
  security:
    enabled: true
    type: basic
    users:
      - username: admin
        password: ${J_OBS_PASSWORD}
    session-timeout: 8h

API Access with Basic Auth:

curl -u admin:password http://localhost:8080/j-obs/api/traces

For programmatic access, use API keys:

j-obs:
  security:
    enabled: true
    type: api-key
    api-keys:
      - ${J_OBS_API_KEY_1}
      - ${J_OBS_API_KEY_2}
    api-key-header: X-API-Key

Usage:

# Via header
curl -H "X-API-Key: your-api-key" http://localhost:8080/j-obs/api/traces

# Via query parameter
curl "http://localhost:8080/j-obs/api/traces?api_key=your-api-key"

For maximum flexibility, enable both authentication types:

j-obs:
  security:
    enabled: true
    type: both
    users:
      - username: admin
        password: ${J_OBS_PASSWORD}
    api-keys:
      - ${J_OBS_API_KEY}

Certain paths can be exempt from authentication (e.g., static resources):

j-obs:
  security:
    enabled: true
    exempt-paths:
      - /static/**
      - /health
      - /ready

1. Use environment variables for passwords and API keys
2. Enable HTTPS in production
3. Set strong passwords with at least 12 characters
4. Rotate API keys periodically
5. Limit session timeout based on security requirements

J-Obs includes built-in rate limiting to protect against DoS attacks:

j-obs:
  rate-limiting:
    enabled: true
    max-requests: 100
    window: 1m

All user inputs are automatically sanitized to prevent:

• SQL Injection
• XSS attacks
• Log injection
• Path traversal

Webhook URLs are validated to prevent Server-Side Request Forgery:

• Blocks localhost and private IPs
• Validates URL scheme (HTTP/HTTPS only)
• Whitelist for known webhook domains (Telegram, Slack, Teams)