ohif-viewer/platform/app/.recipes/Nginx-Orthanc-Keycloak/SECURITY-NOTES.md

Security notes for this recipe

Secrets

This recipe no longer ships working credential values. Before docker compose up:

• Generate a fresh OAuth client secret for the ohif_viewer client and use it to replace the REPLACE_WITH_A_GENERATED_CLIENT_SECRET placeholder in BOTH config/ohif-keycloak-realm.json and config/oauth2-proxy.cfg (the two values must match). To generate one after the realm is imported: Keycloak admin console -> Clients -> ohif_viewer -> Credentials -> Regenerate.
• Copy .env.example to .env and set POSTGRES_PASSWORD and KEYCLOAK_ADMIN_PASSWORD to strong values. docker compose refuses to start while either is unset. POSTGRES_PASSWORD is the single PostgreSQL credential - it both provisions the keycloak database role and is what Keycloak uses to connect (the compose file derives KC_DB_PASSWORD from it), so there is one database password to set, not two.

Rotate if you deployed from an earlier checkout

Earlier versions of this recipe committed a fixed client secret and default admin/database passwords to the public repository. A committed secret stays burned even after this change, so any deployment created from an earlier checkout must rotate:

• the ohif_viewer client secret (Keycloak admin console -> Clients -> ohif_viewer -> Credentials -> Regenerate, then update config/oauth2-proxy.cfg to match), and
• the Keycloak admin and PostgreSQL passwords. Note that changing POSTGRES_PASSWORD in .env alone does not re-password an existing database: Postgres only applies it when the postgres_data volume is first initialized. To actually rotate it on an existing deployment, either ALTER ROLE keycloak WITH PASSWORD ... inside the running database or recreate the postgres_data volume.

CORS

The wildcard Access-Control-Allow-Origin: * defaults were removed from config/nginx.conf. The viewer is served by the same nginx as the DICOMweb proxy, so same-origin deployments need no CORS headers. If you host the viewer on a different origin, use the commented explicit-origin example in the nginx config - never * on an authenticated endpoint that serves PHI.