Using Flarum securely for the greater good

Fell

Hello! My name is Felix and I'm the creator of loveisnottourism.org, a website about the #LoveIsNotTourism movement, that tries to bring together couples who have been separated by borders.

I'm seeing a desperate need for a simple modern discussion platform in the community to share information and compassion and Flarum seems to be a perfect fit!

Now I know Flarum is beta software and you do not recommend it in a production environment. However, the need is there and I do not see any good alternatives that work in my environment. So, I'm gonna give it a try.

What I ask now, is, do you have any tips on running it securely? I am planning to use Twitter Auth only for now, because I don't want to store any passwords for security reasons.

Anything else? What do you guys think?

clarkwinkelmann

Fell there shouldn't be any security concern specific to Flarum.

As long as your webserver is kept up to date and that you're able to update Flarum in case we release a security update, everything should be fine.

To check that you installed Flarum properly you can perform a scan on the lab which should let you know whether there is any obvious security issue.

If you are not familiar with managing a VPS yourself, I recommend using a managed hosting (either shared or dedicated) that meets Flarum requirements, that way a lot of the things to keep up to date will already be managed by your host.

Fell

Thank you for your opinion!

I'm familiar with the server management, I've been making and running PHP applications for a few years. I'm not working the industry anymore, but I think I configured it as securely as possible. I was just worried about what state the project is in and if you would consider it ready to use, since it advertised itself so strongly to be in beta.

I don't care if it breaks, as long as my server doesn't get compromised, haha.

To be extra safe, I'll try to disable the password based signup to avoid storing people's passwords. I already searched the forum... so if you don't have any other idea I'll do it the hacky way by just hiding the form fields.

clarkwinkelmann

Fell unfortunately at this time Flarum doesn't have a built-in way of disabling password registration/login. If you just want to promote social login you could hide the password forms with CSS, but this won't technically prevent people from using it via the API.

There isn't much risk storing user passwords as they are hashed with bcrypt. Emails and other personal information stored in the database are probably more valuable to potential hackers anyway.

The beta label refers primarily to our extension API which is still in development, meaning community extensions may face more breaking changes up to stable. In general the less extensions you use, the less likely you'll be stuck in an older Flarum version waiting for extensions to catch up.