Configuring Security in Hugo⁠🚥
Updated  by  nm  2024-March-10

Page contents

News

Ongoing  According to the Repology Hugo badges, the latest packaged Hugo is version [no network :(]. To keep up with Hugo releases, see github.com/gohugoio/hugo/releases, discourse.gohugo.io/c/announcements, or @gohugoio@fosstodon.org. To learn about upcoming Hugo releases, see github.com/gohugoio/hugo/milestones.

2023-December-30  As of today, this evolving⁠[1] article has been on the web for 2 years.🕯🕯

 

Introduction

In Hugo v0.91.0 and newer, you can specify a project’s security policy in a config file. Details are at gohugo.io/about/security-model/.

 

Default config.yaml security block

In March 2024, Hugo’s default security settings include the following.

security:
  enableInlineShortcodes: false
  exec:
    allow:
    - ^(dart-)?sass(-embedded)?$
    - ^go$
    - ^npx$
    - ^postcss$
    osEnv:
    - (?i)^((HTTPS?|NO)_PROXY|PATH(EXT)?|APPDATA|TE?MP|TERM|GO\w+|(XDG_CONFIG_)?HOME|USERPROFILE|SSH_AUTH_SOCK|DISPLAY|LANG|SYSTEMDRIVE)$
  funcs:
    getenv:
    - ^HUGO_
    - ^CI$
  http:
    mediaTypes: null
    methods:
    - (?i)GET|POST
    urls:
    - .*

 

To view a Hugo project’s current security settings, run one of the following commands from the root of the project.

hugo config
hugo config | more
hugo config | less
hugo config | grep security

 

To view the most up-to-date default security settings, go to gohugo.io/about/security-model/#security-policy.

 

Infinite Ink’s config.yaml security block

For Infinite Ink’s Hugo project, I’ve changed some of the above default security settings to the following.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

security:
  enableInlineShortcodes: true
  exec:
    allow:
    - ^asciidoctor
    - ^pandoc
    osEnv:
    - .*
  funcs:
    getenv:
    - ^INFINITEINKROOT$
  http:
    methods:
    - none
    urls:
    - none

 

ℹ
The value none, which is used in the above two emphasized lines, blocks everything.

 

Details are below.

 

enableInlineShortcodes

To learn about line 2’s enableInlineShortcodes, see Infinite Ink’s Hugo Shortcodes.

 

exec.allow

The Infinite Ink Hugo project needs lines 5 and 6 because both asciidoctor and pandoc are used as external⁠[2] markup renderers.

None of dart-sass-embedded, go, npx, and postcss are used by the Infinite Ink project so I do not specify these (which are part of Hugo’s default security policy) here.

 

exec.osEnv

Because of Asciidoctor or Scoop⁠[3] issues, I specify .* (which is a regular expression that matches everything) in line 8. There probably is a less extreme way to solve my issues and when I figure that out, I’ll write about it in this article.

 

funcs.getenv

Since I have an environment variable named INFINITEINKROOT that I use in Infinite Ink’s Hugo layout files, I specify it in line 11.

Since I do not use any environment variable that starts with HUGO_, I do not specify that here.

 

http.methods and http.urls

Since the Infinite Ink website does not currently use HTTP to get or post remote data, I specify the value none for these config options.⁠ ◊

 

See also

For more about Hugo, see Infinite Ink’s…

 

Endnotes

1. Many Infinite Ink pages, including this one, are evergreen 🌲 and regularly updated.
2. To learn about Hugo’s built-in and external markup renderers, see Infinite Ink’s Hugo’s Markup Languages.
3. On Windows, I install and update hugo, pandoc, and ruby with Scoop. To learn about Scoop, see Infinite Ink’s Scoop: A Windows Package Manager (featuring Hugo, Figlet, and Ruby).

Please share & discuss 📝 👎 👍 📯