Specific controls for locking down Collabora Online: WOPI host allow lists, proof keys, access tokens, process isolation, TLS, macros and patching from Collabora's advisories.
Restricting which storage hosts may use a Collabora Online server with aliasgroups and WOPI host settings, the matching allow list on the Nextcloud side, and testing that unknown hosts are refused.
Generating proof keys with coolconfig, publishing them in discovery, verifying X-WOPI-Proof headers in a custom WOPI host, and rotating keys without breaking open sessions.
Issuing and validating WOPI access tokens in CheckFileInfo: short lifetimes, scoping tokens to one file and user, Bearer header support, and third-party token generation in Nextcloud.
How per-document Kit processes, chroot jails, dropped capabilities and seccomp filtering contain malicious documents, what the container or host must allow for them, and the risk of weakening them.
Choosing between TLS on coolwsd and SSL termination at a reverse proxy, configuring cipher lists and certificates, matching protocols with the WOPI host, and never running HTTP-only in production.
Using integration-controlled permissions, secure view and watermarks to limit downloads, printing and clipboard use for sensitive documents, and the limits of these controls.
Tracking Collabora security advisories and CVEs, the security newsletter, applying minor releases quickly, signed packages and key rotations, and keeping CODE out of production.
Securing access to the admin console and its WebSocket endpoint: credentials, restricting /cool/adminws at the reverse proxy, and audit logging of administrator actions.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.