Security - Snipe-IT

Snipe-IT provides comprehensive security features to protect your asset management data. This page covers authentication mechanisms, access control, and security hardening.

Authentication Methods

Snipe-IT supports multiple authentication methods:

Local Authentication - Built-in username/password authentication
LDAP/Active Directory - Integration with directory services
SAML 2.0 - Single Sign-On with enterprise identity providers
Two-Factor Authentication (2FA) - TOTP-based second factor

Local Authentication

Users are authenticated against the users table using Laravel’s built-in authentication system (configured in config/auth.php:16-19):

'defaults' => [
    'guard' => 'web',
    'passwords' => 'users',
],

Passwords are hashed using bcrypt by default, with configurable work factor:

.env

HASHING_DRIVER=bcrypt
BCRYPT_ROUNDS=10

Increasing BCRYPT_ROUNDS makes password hashing more computationally expensive, providing better protection against brute-force attacks at the cost of slower authentication.

Alternatively, use Argon2 for password hashing:

.env

HASHING_DRIVER=argon2
ARGON_MEMORY=1024
ARGON_THREADS=2
ARGON_TIME=2

Protect against brute-force attacks with login throttling:

.env

# Maximum login attempts before lockout
LOGIN_MAX_ATTEMPTS=5

# Lockout duration in seconds
LOGIN_LOCKOUT_DURATION=60

# Disable autocomplete on login form (security compliance)
LOGIN_AUTOCOMPLETE=false

Number of failed login attempts before the account is temporarily locked.

Duration in seconds that the account remains locked after exceeding max attempts.

Enable browser autocomplete on the login form. Set to false for security compliance.

Throttle configuration is defined in config/auth.php:101-104:

'throttle' => [
    'max_attempts' => env('LOGIN_MAX_ATTEMPTS', 5),
    'lockout_duration' => env('LOGIN_LOCKOUT_DURATION', 60),
]

Password Reset Security

.env

# Password reset link expiration (in minutes)
RESET_PASSWORD_LINK_EXPIRES=15

# Password confirmation timeout (in seconds)
PASSWORD_CONFIRM_TIMEOUT=10800

# Max password reset attempts per minute
PASSWORD_RESET_MAX_ATTEMPTS_PER_MIN=50

# Invitation link expiration (in minutes)
INVITE_PASSWORD_LINK_EXPIRES=1500

RESET_PASSWORD_LINK_EXPIRES

integer

default:"15"

How many minutes before a password reset link expires (default: 15 minutes).

PASSWORD_CONFIRM_TIMEOUT

integer

default:"10800"

How many seconds before requiring password re-confirmation for sensitive actions (default: 3 hours).

PASSWORD_RESET_MAX_ATTEMPTS_PER_MIN

integer

default:"50"

Rate limit for password reset requests per minute.

Two-Factor Authentication (2FA)

Snipe-IT implements TOTP (Time-based One-Time Password) 2FA using the Google2FA package.

Enabling 2FA

Two-factor authentication can be:

Optionally enabled by individual users
Enforced globally for all users (via Settings > Security)
Enforced for specific users (via user edit)

2FA Configuration

Configure 2FA settings in .env:

.env

# Enable/disable 2FA globally
OTP_ENABLED=true

# 2FA session lifetime (0 = eternal)
OTP_LIFETIME=0

# Keep 2FA session alive on new requests
OTP_KEEP_ALIVE=true

# Throw exceptions on 2FA errors
OTP_THROW_EXCEPTION=true

These settings are defined in config/google2fa.php:8-75.

OTP_ENABLED

boolean

default:"true"

Master switch for 2FA functionality. Set to false to completely disable 2FA.

OTP_LIFETIME

integer

default:"0"

How long (in minutes) before users must re-enter their 2FA code. 0 means eternal - users only authenticate once per session.

OTP_KEEP_ALIVE

boolean

default:"true"

Renew the 2FA session lifetime on each request. When true, users stay authenticated as long as they’re active.

Setting Up 2FA as a User

Click on your name in the top-right corner
Select Account Settings
Go to the Security tab
Click Enable Two-Factor Authentication
Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, etc.)
Enter the 6-digit code to confirm
Save your recovery codes in a secure location

Enforcing 2FA for All Users

As an administrator:

Navigate to Settings > Security
Enable Require Two-Factor Authentication
Save settings

Users without 2FA enrolled will be redirected to the enrollment page on next login.

2FA Implementation Details

The 2FA workflow is implemented in app/Http/Controllers/Auth/LoginController.php:398-437:

public function getTwoFactorAuth()
{
    // Display 2FA code entry form
}

public function postTwoFactorAuth(Request $request)
{
    $user = auth()->user();
    $secret = $request->input('two_factor_secret');
    
    if (Google2FA::verifyKey($user->two_factor_secret, $secret)) {
        // Mark 2FA as verified for this session
        session(['google2fa' => true]);
        return redirect()->intended('/');
    }
    
    return redirect()->back()->withErrors(['two_factor_secret' => 'Invalid authentication code']);
}

Resetting User 2FA

Administrators can reset a user’s 2FA if they lose access to their authenticator:

Navigate to People > Users
Edit the user
Click Reset Two-Factor Authentication
Confirm the reset

This action is logged in the activity log (app/Http/Controllers/Api/UsersController.php:828).

2FA Permissions

Users need the self.two_factor permission to manage their own 2FA settings (config/permissions.php:452-453):

[
    'permission' => 'self.two_factor',
    'display'    => true,
],

API Authentication

Snipe-IT uses Laravel Passport for OAuth2-based API authentication.

API Token Expiration

.env

API_TOKEN_EXPIRATION_YEARS=15

API_TOKEN_EXPIRATION_YEARS

integer

default:"15"

How many years before API personal access tokens expire.

Configured in config/passport.php:16:

'expiration_years' => env('API_TOKEN_EXPIRATION_YEARS', 20),

Generating API Tokens

Users can generate personal API tokens:

Go to Account Settings
Click the API Tokens tab
Click Create New Token
Give the token a name (e.g., “Mobile App”, “Automation Script”)
Copy the token immediately - it won’t be shown again

API tokens have the same permissions as the user who created them. Create dedicated service accounts with limited permissions for API integrations.

Using API Tokens

Include the token in the Authorization header:

curl -H "Authorization: Bearer YOUR_TOKEN_HERE" \
     https://snipeit.company.com/api/v1/hardware

API Rate Limiting

Protect your API from abuse with rate limiting:

.env

API_THROTTLE_PER_MINUTE=120

API_THROTTLE_PER_MINUTE

integer

default:"120"

Maximum API requests allowed per minute per IP address.

When the limit is exceeded, the API returns a 429 Too Many Requests response.

API Token Permissions

The self.api permission controls whether users can create their own API tokens (config/permissions.php:457-459):

[
    'permission' => 'self.api',
    'display'    => true,
],

Disable this permission to prevent non-admin users from generating API tokens.

CSRF Protection

Cross-Site Request Forgery (CSRF) protection is enabled by default for all POST, PUT, PATCH, and DELETE requests.

CSRF Configuration

The VerifyCsrfToken middleware is automatically applied to all web routes (app/Http/Middleware/VerifyCsrfToken.php).

API routes (under /api/*) are exempt from CSRF protection as they use token-based authentication.

CSRF Token in Forms

Blade templates automatically include CSRF tokens:

<form method="POST" action="/assets">
    @csrf
    <!-- form fields -->
</form>

For AJAX requests, include the token in the request headers:

$.ajaxSetup({
    headers: {
        'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
    }
});

Content Security Policy (CSP)

Enable CSP to mitigate XSS attacks:

.env

# Enable Content Security Policy
ENABLE_CSP=true

# Additional allowed CSP URLs (comma-separated)
ADDITIONAL_CSP_URLS=https://fonts.googleapis.com,https://cdn.example.com

ENABLE_CSP

boolean

default:"false"

Enable Content Security Policy headers. Test thoroughly before enabling in production.

ADDITIONAL_CSP_URLS

string

Comma-separated list of additional URLs to whitelist in the CSP policy (e.g., CDNs, external fonts).

Enabling CSP can break functionality if not configured correctly. Test in a development environment first and add necessary exceptions to ADDITIONAL_CSP_URLS.

Security Headers

Configure additional security headers:

.env

# Prevent framing (clickjacking protection)
ALLOW_IFRAMING=false

# Referrer policy
REFERRER_POLICY=same-origin

# Enable HTTP Strict Transport Security (HTTPS only)
ENABLE_HSTS=false

# Trusted proxy IPs (for load balancers)
APP_TRUSTED_PROXIES=192.168.1.1,10.0.0.1

# CORS allowed origins
CORS_ALLOWED_ORIGINS=https://app.company.com,https://mobile.company.com

ALLOW_IFRAMING

boolean

default:"false"

Allow Snipe-IT to be embedded in iframes. Keep false to prevent clickjacking attacks.

REFERRER_POLICY

string

default:"same-origin"

Controls how much referrer information is sent with requests. Options: no-referrer, same-origin, strict-origin, etc.

ENABLE_HSTS

boolean

default:"false"

Enable HTTP Strict Transport Security, forcing browsers to only use HTTPS.Only enable if you have a valid SSL certificate and all traffic is HTTPS.

APP_TRUSTED_PROXIES

string

Comma-separated list of trusted proxy IP addresses (load balancers, reverse proxies).Required for correct IP detection when behind a proxy.

CORS_ALLOWED_ORIGINS

string

Comma-separated list of origins allowed to make cross-origin requests to your API.

Session Security

Configure secure session handling:

.env

# Session driver (file, database, redis, memcached)
SESSION_DRIVER=file

# Session lifetime (in minutes)
SESSION_LIFETIME=12000

# Expire session on browser close
EXPIRE_ON_CLOSE=false

# Encrypt session data
ENCRYPT=false

# Session cookie name
COOKIE_NAME=snipeit_session

# Cookie domain (null for current domain)
COOKIE_DOMAIN=null

# Require HTTPS for cookies (enable in production with SSL)
SECURE_COOKIES=false

SESSION_DRIVER

string

default:"file"

Where to store session data. Options: file, database, redis, memcached.Use redis or memcached for multi-server deployments.

SESSION_LIFETIME

integer

default:"12000"

Session lifetime in minutes (12000 = ~8 days).

SECURE_COOKIES

boolean

default:"false"

Only transmit cookies over HTTPS. Enable this in production with SSL.

Set SECURE_COOKIES=true when using HTTPS to prevent session hijacking. Do not enable if you don’t have SSL configured.

Encrypted Custom Fields

Sensitive custom field data can be encrypted at rest: When creating a custom field, enable the Encrypt Field option. The data is encrypted using your APP_KEY.

Critical: If you lose or change your APP_KEY, all encrypted data becomes permanently unrecoverable. Store your APP_KEY securely and include it in backups.

Encryption is handled in app/Models/CustomField.php:389-396:

public function isFieldDecryptable($string)
{
    if (($this->field_encrypted == '1') && ($string != '')) {
        return true;
    }
    return false;
}

The permission assets.view.encrypted_custom_fields controls who can view encrypted field values.

Permission System

Snipe-IT uses a granular permission system defined in config/permissions.php.

Permission Structure

Permissions follow the pattern: {resource}.{action} Examples:

assets.view - View assets
assets.create - Create assets
assets.edit - Edit assets
assets.delete - Delete assets
assets.checkout - Checkout assets
assets.checkin - Checkin assets

Role Hierarchy

Superuser - Full access to everything, bypasses all permission checks
Admin - Administrative access to most features
Custom Roles - Granular permission assignments

Managing Roles and Permissions

Navigate to People > Permissions
Click Create New to create a custom role
Select the specific permissions to grant
Assign users to the role

Or edit a user directly and select their role:

Go to People > Users
Edit the user
Select their Permission Group
Save

Security Best Practices

Enable 2FA for all admins - Require two-factor authentication for all users with administrative permissions.

Use strong APP_KEY - Generate a secure random key using php artisan key:generate. Never share or commit your .env file.

Enable HTTPS - Always use SSL/TLS in production. Set SECURE_COOKIES=true and APP_FORCE_TLS=true.

Limit API access - Only grant API token permissions to users who need it. Use service accounts with minimal permissions for integrations.

Regular security updates - Keep Snipe-IT updated to the latest version to receive security patches.

Audit user permissions - Regularly review user roles and permissions to ensure least privilege access.

Monitor login attempts - Review failed login attempts in the activity log to detect potential attacks.

Backup encryption keys - Include .env in your backup strategy (stored securely!) to ensure you can recover encrypted data.

SAML Authentication

For enterprise Single Sign-On:

.env

# Require SAML authentication (disable local login)
REQUIRE_SAML=false

# SAML key size
SAML_KEY_SIZE=2048

REQUIRE_SAML

boolean

default:"false"

When enabled, all users must authenticate via SAML. Local authentication is disabled.

SAML configuration is done through the web interface at Settings > SAML.

Application Security

Force TLS/HTTPS

.env

# Force all requests to use HTTPS
APP_FORCE_TLS=false

# Allow connections to hosts with invalid/self-signed certificates (dev only!)
APP_ALLOW_INSECURE_HOSTS=false

APP_FORCE_TLS

boolean

default:"false"

Redirect all HTTP requests to HTTPS. Only enable if SSL is properly configured.

APP_ALLOW_INSECURE_HOSTS

boolean

default:"false"

Allow insecure SSL connections (self-signed certificates). Never enable in production.

Application Lock

.env

# Lock the application (maintenance mode)
APP_LOCKED=false

When true, the application is locked and shows a maintenance page to all users except super admins.

Troubleshooting

”CSRF Token Mismatch” Error

Causes:

Session expired
Session driver misconfigured
Proxy/load balancer not forwarding headers correctly

Solution:

Add proxy IPs to APP_TRUSTED_PROXIES
Check session configuration
Clear browser cookies

Users Can’t Enable 2FA

Check:

OTP_ENABLED=true in .env
User has self.two_factor permission
Server time is synchronized (TOTP is time-based)

API Returns 401 Unauthorized

Verify:

Token is included in Authorization: Bearer {token} header
Token hasn’t expired
User account is active and not locked

Next Steps

Configuration

Configure environment and application settings

Backups

Set up secure backup procedures

Users

Manage users and permissions

API Documentation

Secure API integration guide

Get Started

Core Features

Administration

Integration

​Authentication Methods

​Local Authentication

​Login Throttling

​Password Reset Security

​Two-Factor Authentication (2FA)

​Enabling 2FA

​2FA Configuration

​Setting Up 2FA as a User

​Enforcing 2FA for All Users

​2FA Implementation Details

​Resetting User 2FA

​2FA Permissions

​API Authentication

​API Token Expiration

​Generating API Tokens

​Using API Tokens

​API Rate Limiting

​API Token Permissions

​CSRF Protection

​CSRF Configuration

​CSRF Token in Forms

​Content Security Policy (CSP)

​Security Headers

​Session Security

​Encrypted Custom Fields

​Permission System

​Permission Structure

​Role Hierarchy

​Managing Roles and Permissions

​Security Best Practices

​SAML Authentication

​Application Security

​Force TLS/HTTPS

​Application Lock

​Troubleshooting

​”CSRF Token Mismatch” Error

​Users Can’t Enable 2FA

​API Returns 401 Unauthorized

​Next Steps

Configuration

Backups

Users

API Documentation

Build docs developers (and LLMs) love

Authentication Methods

Local Authentication

Login Throttling

Password Reset Security

Two-Factor Authentication (2FA)

Enabling 2FA

2FA Configuration

Setting Up 2FA as a User

Enforcing 2FA for All Users

2FA Implementation Details

Resetting User 2FA

2FA Permissions

API Authentication

API Token Expiration

Generating API Tokens

Using API Tokens

API Rate Limiting

API Token Permissions

CSRF Protection

CSRF Configuration

CSRF Token in Forms

Content Security Policy (CSP)

Security Headers

Session Security

Encrypted Custom Fields

Permission System

Permission Structure

Role Hierarchy

Managing Roles and Permissions

Security Best Practices

SAML Authentication

Application Security

Force TLS/HTTPS

Application Lock

Troubleshooting

”CSRF Token Mismatch” Error

Users Can’t Enable 2FA

API Returns 401 Unauthorized

Next Steps