Secure the Connections to Your Hub Server

There are several ways to set up an encrypted HTTPS connection with TLS(SSL) between your Hub server and its clients.

Use a third-party TLS-terminating proxy server. For details, see Reverse Proxy Configuration.
Use built-in TLS for your Hub server.
- During installation or upgrade, you can configure built-in TLS in the web-based Configuration Wizard.
- For an existing installation, you can configure Hub to run in HTTPS mode from the command line.

You can switch from a third-party TLS-terminating proxy to built-in TLS and vice-versa at any time regardless of your current settings.

An external Hub installation uses cross-site cookies to maintain and support authentication sessions in connected services. To safeguard sites against Cross-Site Request Forgery (CSRF) attacks, leading web browsers only allow cross-site cookies that are accessed over HTTPS connections.

In web browsers that enforce the new security standards, Hub is unable to exchange authentication tokens with a connected service. This means that users are constantly logged out of connected services whenever their session cookies expire. Requests to extend the current session with refresh tokens are also blocked.

For security reasons, we have always advised against running Hub using plain HTTP. Following the latest initiatives to improve privacy and security across the web, you are effectively required to secure all traffic to your external Hub installation over TLS.

Last modified: 09 November 2023