Silo Console Settings

Embedded Console fixes after 0903

Fixes are tracked for local-proxy source attribution (#147) and ignored WebSocket limits (#148). The behavior below requires a build containing both fixes; the 0903 image does not include them.

Proxy source addresses

Embedded Console uses MINIO_API_TRUSTED_PROXIES; CONSOLE_TRUSTED_PROXIES remains standalone-only. Client attribution affects aws:SourceIp policies and WebSocket limits.

Separate list entries with commas, semicolons or whitespace. Specify the actual peer addresses of proxies on other hosts or containers. Local proxies need no setting, but must sanitize forwarded source headers: this behavior trusts local processes. A loopback address inside a header does not automatically become a trusted hop. Standalone Console still requires explicit proxy trust.

The Server’s S3 policy is unchanged. With none/off, S3 also ignores the browser address forwarded by embedded Console, so IP policies through Console see the internal peer. WebSocket Origin checks still require a matching authority; loopback trust alone does not allow arbitrary origins.

WebSocket connection limits

Set these variables in the Server environment or MINIO_CONFIG_ENV_FILE:

Public browsing uses one WebSocket per tab. NAT clients share an address; IPv6 clients share a budget per /64. For example, set CONSOLE_WS_MAX_ANONYMOUS_CONNECTIONS_PER_CLIENT=16 to allow more anonymous tabs from one address. Defaults and authenticated capacity reservations remain unchanged.

Values must be integers from 1 to 1048576. Each anonymous cap must be strictly below its corresponding shared cap, and the anonymous per-client cap must not exceed the anonymous total. Unset uses the default; explicitly blank values, literal env:// references and invalid relationships are errors. Configuration errors exit Server before Console serves requests, although the S3 listener may already have started. Other CONSOLE_* operator overrides are still cleared and derived from Server configuration.

Object sharing

The fix requires no new setting. Its request restrictions always apply, and normal sharing remains available. CONSOLE_SHARE_MINIO_URL continues to select only the generated link format. The anonymous proxy is limited to object-content GET requests:

S3 continues to enforce authorization: unsigned public objects are allowed by their policies; private objects require valid authorization. Original URL encoding and signature parameters are preserved. Manual proxying of bucket listings, object subresources or downloads that depend on redirects no longer works through this endpoint.

The access boundary applies whenever sharing is available. A prototype included CONSOLE_SHARE_ENABLED=off, but that switch and its frontend and embedded-Server plumbing were removed: disabling an entire feature is a separate product requirement, while the proxy must enforce its scope without extra configuration. CONSOLE_SHARE_MINIO_URL therefore remains a link-format setting, not an access control. Requiring signature-shaped parameters would not protect public metrics, and a separate Console MAC or link registry is not needed for this bounded object download contract. The encoded URL is not authenticated as Console-issued.

These checks add local parsing and comparisons, without extra S3/IAM requests, stored tokens, new signing keys or whole-object buffering. New query-selected S3 operations must be reviewed against the deny list and regression tests. The issue decision record documents the threat model, alternatives and compatibility tradeoffs. Thanks to Jiri Pejchal (@jiri-pejchal) for reporting the internal-metrics exposure.

Console settings reference

This page covers settings that manage access and behavior for the MinIO Console.

You can establish or modify settings by defining:

• an environment variable on the host system prior to starting or restarting the MinIO Server. Refer to your operating system’s documentation for how to define an environment variable.
• a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO uses the environment variable value.

Some settings have only an environment variable or a configuration setting, but not both.

Browser Settings

The following settings control behavior for the embedded MinIO Console.

MinIO Console

Optional

Animation

Optional

Browser Redirect

Optional

Browser Redirect URL

Optional

Session Duration

Optional

Log Query URL

Optional

Content Security Policy

Optional

Configure MinIO Console to generate a Content-Security-Policy header in HTTP responses. Defaults to default-src 'self' 'unsafe-eval' 'unsafe-inline';

export MINIO_BROWSER_CONTENT_SECURITY_POLICY="default-src 'self' 'unsafe-eval' 'unsafe-inline';"

mc admin config set browser \
   csp_policy="default-src 'self' 'unsafe-eval' 'unsafe-inline';" \
   [ARGUMENT=VALUE ...]

Strict Transport Security

Optional

Configure MinIO console to generate a Strict-Transport-Security header in HTTP responses.

To generate the header, you must set a duration using either MINIO_BROWSER_HSTS_SECONDS or hsts_seconds. Other HSTS settings are optional.

export MINIO_BROWSER_HSTS_SECONDS=31536000

export MINIO_BROWSER_HSTS_INCLUDE_SUB_DOMAINS="on"

export MINIO_BROWSER_HSTS_PRELOAD="on"

mc admin config set browser \
   hsts_seconds="31536000" \
   [ARGUMENT=VALUE ...]

mc admin config set browser \
   hsts_include_subdomains="on" \
   hsts_seconds="31536000" \
   [ARGUMENT=VALUE ...]

mc admin config set browser \
   hsts_preload="on" \
   hsts_seconds="31536000" \
   [ARGUMENT=VALUE ...]

Examples

The following examples show the rendered header for the given configuration settings. The equivalent environment variables generate the same result. All examples use a value of 31536000, which is the number of seconds in a calendar year (365 days).

hsts_seconds

mc admin config set ALIAS browser hsts_seconds=31536000

Strict-Transport-Security: max-age=31536000

hsts_include_subdomains

mc admin config set ALIAS browser hsts_seconds=31536000 hsts_include_subdomains=on

Strict-Transport-Security: max-age=31536000; includeSubDomains

hsts_preload

mc admin config set ALIAS browser hsts_seconds=31536000 hsts_include_subdomains=on hsts_preload=on

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Referrer Policy

Optional

Configure MinIO Console to generate a Referrer-Policy header in HTTP responses. Defaults to strict-origin-when-cross-origin.

export MINIO_BROWSER_REFERRER_POLICY="strict-origin-when-cross-origin"

mc admin config set browser \
   referrer_policy="strict-origin-when-cross-origin" \
   [ARGUMENT=VALUE ...]

Prometheus Settings

The following settings manage how MinIO interacts with your Prometheus service.

Prometheus URL

Optional

Prometheus Job ID

Optional

Prometheus Auth Token

Optional

eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJwcm9tZXRoZXVzIiwic3ViIjoibWluaW8iLCJleHAiOjQ4NTAwMzg0MDJ9.GZCKR3d0FH2TCvNHSd39HaVfSuQVVV0s8glICBDmhT51V6CQ_hw8gTYlKHJmcpR8aHkqiJwCqcYJhaMmqwe00XY