February 2023 Summaries

Composable architecture can reduce some common risks that affect websites built on a monolithic software stack. This includes reducing the impact of DDoS attacks and certain classes of OWASP Top 10 vulnerabilities such as Server-side Request Forgery (SSRF) vulnerabilities. With composable architecture, sensitive data is kept isolated from the rest of the application, making it harder for attackers to access. Additionally, the build and deploy process can mitigate common misconfigurations that expose sensitive data. However, other classes of OWASP vulnerabilities such as Cross Site Scripting (XSS) remain a concern if best practices are not followed. Ultimately, composable architecture can be a boon to security when used correctly, but it is not a panacea for all security issues.

Netlify has successfully transitioned to passwordless authentication using FIDO2 tokens, which provides a phishing-proof authentication method. This move aims to reduce the risks associated with phishing and other password-related attacks. FIDO2 is an open standard that eliminates the need for passwords or rotating codes, making it a secure alternative to traditional password-based authentication. Netlify customers can now implement single sign-on (SSO) with supported identity providers like Okta and OneLogin, providing an additional layer of security beyond just passwords. By adopting FIDO2, customers can prevent phishing attacks, protect against credential stuffing, comply with industry regulations, and enjoy a better user experience.

In a world where tech stacks are shifting towards SaaS products and composable architecture, securely storing API keys is crucial to protect user and company data. Traditionally, teams store API keys in .env files or local environments, but this approach has two primary vulnerabilities: exposure to unauthorized individuals and plain text storage. Storing API keys with Netlify environment variables offers a better solution, providing secure control over key storage, automatic provisioning of access, and granular scope management. This approach also enables sharing of environment variables securely among team members, reducing the risk of sensitive information exposure. By utilizing Netlify's environment variable management features, teams can protect their API keys and ensure the security of their data.

When serving content on the web, using a secured hosting solution is crucial to protect against compromise and attack, regardless of project size or budget. A securely designed architecture can reduce risk and friction for developers, from hobbyists to large brands. Netlify's approach simplifies security by removing vulnerable infrastructure, utilizing pre-generating assets in advance, and deploying them through a read-only content delivery network (CDN). This Jamstack model abstracts away the need for an active application server, reducing the burden of securing it and minimizing risk. Serverless runtimes, such as Netlify Functions, expand on this concept by enabling developers to build and deploy APIs, service layers, and logic without introducing a server, thereby avoiding added complexity and security responsibilities.

Netlify has decided to transfer ownership of its popular content management system, Netlify CMS, to a trusted agency partner PM, as part of the company's broader strategy to become a more versatile platform for composable architecture. The rebranded project, Decap CMS, will be fully maintained and developed as an open source project by PM, with no expected disruption to users. As part of this change, PM will take over Netlify CMS socials and assets, while ensuring continued support and investment in the product. This move is intended to provide even more customization and flexibility for users, allowing Netlify to focus on its core platform capabilities.

Netlify has introduced more granular access control for its sites, allowing users to restrict access to both production and non-production environments. This new feature supports Single Sign-On (SSO), providing teams with enhanced security and confidence when managing access. Site Access Control offers role-based user authentication and permission management, ideal for sites requiring personalized content or restricted access. The new feature is available on all pricing plans from Pro and above, offering extra flexibility in securing sites based on their environment.

Netlify has introduced SAML single sign-on (SSO) support, allowing organizations to configure SSO across multiple teams in a centralized manner. This feature reduces the time, overhead, and margin of error associated with configuring SSO individually for each team. Netlify has partnered with WorkOS to provide a simple flow for configuring the SAML app for organizations, which can be used for granular permission control of protected sites and Deploy Previews. The new feature also enables enforcement of organization-wide SSO configuration as the only method allowed to access teams, providing an added layer of protection. This marks the beginning of more security and team management features planned for Netlify's Enterprise Grid plan.

The Sentry Build Plugin for Netlify was initially developed to provide users with improved error monitoring and management capabilities, allowing developers to easily monitor their application's performance during the build process. The plugin has been updated to address feedback from users who wanted more visibility around function usage and spike patterns, enabling users to add Sentry error monitoring to Netlify Functions, Scheduled Functions, and Background Functions with minimal configuration. This integration provides developers with the efficiency and visibility they need to ensure their sites and apps are up and running smoothly, particularly in serverless environments where functions are used to execute tasks on a recurring basis or perform long-running tasks. To get started, users need to create a Sentry account and project, install necessary dependencies, and configure the integration by pasting their Sentry DSN into the Netlify UI. Once enabled, users can create functions with a handler method that includes the Sentry wrapper around the function, allowing them to easily monitor and debug errors in their application.