Missing documentation profiling

[cmcrothers]

The v1 documentation has a great section on releasing to production, particularly that there is a /debug/pprof go endpoint exposed by default.

None of this has been replicated for v2 and has resulted in the deployment with this enabled without our operators being aware.

We have tested and the configuration is still working for v2 however is not present in the v2 documentation at all.

It would be good to have this content covered for new v2 users.

Strong suggesting that since v2 is a breaking change that FLIPT_DIAGNOSTICS_PROFILING_ENABLED be changed to false by default.

[erka]

Hey @cmcrothers

Just wondering. What’s the reason for disabling it by default?

[cmcrothers]

As per the many examples like this it's an exploitable endpoint.

As a feature flagging service for websites I would expect to not have to configure to increase security since a flag service needs to be public internet available in most cases and this endpoint does not require authentication anyway.