IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-14 01:23:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

Live: document allowed_origins (#36433)

Browse Source
This commit is contained in:
Alexander Emelin 2021-07-07 06:47:05 +03:00 committed by GitHub
parent 0c20cc1d12
commit e60950a8c7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
docs/sources/administration/configuration.md
View File

@ -1508,6 +1508,23 @@ Refer to [Grafana Live configuration documentation]({{< relref "../live/configur
0 disables Grafana Live, -1 means unlimited connections.
### allowed_origins
> **Note**: Available in Grafana v8.0.4 and later versions.
The `allowed_origins` option is a comma-separated list of additional origins (`Origin` header of HTTP Upgrade request during WebSocket connection establishment) that will be accepted by Grafana Live.
If not set (default), then the origin is matched over [root_url]({{< relref "#root_url" >}}) which should be sufficient for most scenarios.
Origin patterns support wildcard symbol "*".
For example:
```ini
[live]
allowed_origins = "https://*.example.com"
```
<hr>
## [plugin.grafana-image-renderer]

9
docs/sources/live/configure-grafana-live.md
View File

@ -19,6 +19,15 @@ The number of maximum WebSocket connections users can establish with Grafana is
In case you want to increase this limit, ensure that your server and infrastructure allow handling more connections. The following sections discuss several common problems which could happen when managing persistent connections, in particular WebSocket connections.
## Request origin check
To avoid hijacking of WebSocket connection Grafana Live checks the Origin request header sent by a client in an HTTP Upgrade request. Requests without Origin header pass through without any origin check.
By default, Live accepts connections with Origin header that matches configured [root_url]({{< relref "../administration/configuration.md#root_url" >}}) (which is a public Grafana URL).
It is possible to provide a list of additional origin patterns to allow WebSocket connections from. This can be achieved using the [allowed_origins]({{< relref "../administration/configuration.md#allowed_origins" >}}) option of Grafana Live configuration.
### Resource usage
Each persistent connection costs some memory on a server. Typically, this should be about 50 KB per connection at this moment. Thus a server with 1 GB RAM is expected to handle about 20k connections max. Each active connection consumes additional CPU resources since the client and server send PING/PONG frames to each other to maintain a connection.