GLPI session cookie security settings
Hardening PHP session settings for GLPI: secure, HttpOnly and SameSite cookies, HTTPS-only access and what breaks with embedded iframes.
GLPI security hardening
Specific hardening steps for self-hosted GLPI: session cookies, re-authentication, encryption keys, exposed endpoints and status information.
GLPI 12 re-authentication for sensitive actions
How GLPI 12 sudo mode protects user, profile, authentication and plugin administration from hijacked sessions, the 15-minute window and how to roll it out to administrators.
Rotating GLPI encryption keys
Changing GLPI's glpi.key and OAuth keys with the console, backing up keys before upgrades and what happens to stored passwords when keys are lost.
Exposing GLPI SCIM and API endpoints safely
Publishing the SCIM endpoint and the OAuth2 API to cloud identity providers and integrations without opening GLPI broadly: IP restrictions, scoped OAuth clients and logging.
GLPI status endpoint and information exposure
Using /status.php for monitoring without leaking versions, and keeping the private status output limited to the console.
