Security

The password gate

Setting REDRIVE_PASSWORD turns on cookie-based auth with rate-limited login. Leave it unset and there's no login at all — Redrive assumes it's talking only to you, on localhost.

The unprotected banner

Bind beyond loopback without a password, and Redrive logs a warning and shows a banner in the UI for the rest of the session. That's a reasonable setup for a trusted internal lab. Anywhere else, it's a real exposure — set the password.

Broker credentials at rest

Broker credentials are encrypted with ASP.NET Core Data Protection. On Windows, the encryption keys are DPAPI-protected, tied to the machine and user account. On Linux and macOS, the keys sit on disk beside the database. That's enough to stop a casual read or a copied database file from being useful on its own — it is not enough to stop someone who already has full access to your data directory.

Message payloads

Message payloads never touch your management credential. Peek, redrive, publish, discard, and purge all move over AMQP using your AMQP credential; Redrive adds no transport-level protection of its own beyond what that connection already gives you. Browsing queues and reading stats work fine with a monitoring-tagged, read-only management account.

Queue delete and binding changes (adding or removing a binding) are the exception — those go through the management API, not AMQP, so they fail against a read-only management credential. Give the account configure rights if you want to do those from Redrive.

A note on DNS rebinding

An unprotected instance bound to localhost is still reachable from a malicious website through DNS rebinding: a page you visit in your browser can trick it into talking to localhost:5100 as if it were the site's own server. If that's in your threat model, set REDRIVE_PASSWORD even for a local-only install. A Host-header allowlist to close this by default is on the roadmap.