The controller API supports bearer token authentication via the FW_API_TOKEN environment variable. When set, all API endpoints (except /api/v1/health) require an Authorization: Bearer <token> header.

export FW_API_TOKEN=$(openssl rand -hex 32)

The leaf agent reads the same variable and includes it in poll requests. Without FW_API_TOKEN, authentication is disabled (suitable for dev/lab only).

The leaf agent (fwcontrollerd) supports HTTPS with CA certificate validation:

fwcontrollerd.py --controller-url https://controller:8643 --ca-cert /etc/ssl/ca.pem

When using plain HTTP, the agent logs a warning. Policy bundles are transmitted in cleartext over HTTP — use HTTPS on any non-isolated management network.

The Web UI uses a double-submit pattern: a session-stored CSRF token is included as an X-CSRF-Token header on all HTMX requests and as a hidden form field. POST/PUT/DELETE/PATCH requests to UI routes without a valid token return 403.

SONiC Redis is accessed via Unix socket without authentication. This is a SONiC platform convention — Redis is not exposed on a network port by default.

Security relies on OS-level socket permissions. In the docker-firewall container, the Redis socket is bind-mounted read-write from the host. Any process in the container or on the host with access to /var/run/redis/redis.sock can read and write all firewall state (CONFIG_DB, APP_DB, STATE_DB).

Mitigations:

• The container runs with minimal capabilities (CAP_NET_ADMIN, CAP_NET_RAW, CAP_SYS_MODULE) instead of --privileged.
• --pid=host is not used (the container has its own PID namespace).
• For deployments outside SONiC's trust boundary, consider enabling Redis requirepass and updating the swsscommon connection configuration.

• Use gunicorn instead of Flask's dev server: gunicorn -w 4 -b 0.0.0.0:8643 "fwcontroller.wsgi:app"
• Never enable --debug in production (Werkzeug debugger allows RCE).
• Set FW_API_TOKEN and FW_SECRET_KEY environment variables.
• Bind the controller to 127.0.0.1 or a management VLAN interface.
• State files in /var/warmboot/firewall/ are written mode 0600.