Start to use artifactory

Question

in company where I am working we are starting to use artifactory like tool of repositories managment, and then I'm reading the user guide of this tool. We started in the configuration creating a virtual repository, a few local and remote repositories. On the use guide i found the following thing:

Prevent disclosing sensitive business information derived from your artifact queries to whomever can intercept the queries, including the owners of the remote repository itself.

I saw that this could be avoided through

exclude pattern

functionality on the virtual repository. Can you give us some suggestion about this? What kinds of request we should avoided to do?

Answer 1

You should avoid requests for internal artifacts being sent to remote repositories (directly or via virtuals). This can happen when projects depends on internal libraries or within multi module projects where modules depends on each other. When working with virtual repositories Artifactory will always search for such artifacts in local repositories first. However, if someone asked for a wrong version or had a typo in the artifact name, the artifact will not be found in a local repository and Artifactory will try to look for it in the remote repositories configured in this virtual.

To avoid exposing sensitive business information as described above, we strongly recommend the following best practices:

• The list of remote repositories used in an organization should be managed under a single virtual repository to which all requests are directed
• All internal artifacts should be specified in the Excludes Pattern field of the virtual repository (or alternatively, of each remote repository) using wildcard characters to encapsulate the widest possible specification of internal artifacts.

Assuming all of your projects/modules are using some kind of namespace, for example com.mycompany, you can configure an exclusion pattern for artifacts under this namespace: com/mycompany/**.

For more information take a look at avoiding security risks with an excludes pattern