# A few things about Redis security

DevFeed: [A few things about Redis security](<https://devfeed.tech/articles/a-few-things-about-redis-security-20687.md>)

Original publisher: [Read original article](<http://antirez.com/news/96>)

Published: 2015-11-03T08:53:04Z

Content type: opinion

Language: en

Sources: [Antirez](<https://devfeed.tech/sources/antirez.md>)

Topics: [Redis](<https://devfeed.tech/topics/redis.md>), [Security](<https://devfeed.tech/topics/security.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [servers](<https://devfeed.tech/topics/servers.md>)

Tags: [authorization](<https://devfeed.tech/tags/authorization.md>), [redis](<https://devfeed.tech/tags/redis.md>), [security](<https://devfeed.tech/tags/security.md>), [server](<https://devfeed.tech/tags/server.md>)

## AI overview

The article discusses Redis's security model, which assumes that untrusted clients should not have direct access. It explains that adding security features involves complexity, while many Redis instances are unintentionally exposed to the internet because they are not properly firewalled, restricted to localhost, or protected with AUTH. The article also notes that Redis 3.2 improved security with protected mode.

## Source excerpt

IMPORTANT EDIT: Redis 3.2 security improved by implementing protected mode. You can find the details about it here: https://www.reddit.com/r/redis/comments/3zv85m/new_security_feature_redis_protected_mode/ From time to time I get security reports about Redis. It's good to get reports, but it's odd that what I get is usually about things like Lua sandbox escaping, insecure temporary file creation, and similar issues, in a software which is designed (as we explain in our security page here http://redis.io/topics/security) to be totally insecure if exposed to the outside world. Yet these bug reports are often useful since there are different levels of security concerning any software in general and Redis specifically. What you can do if you have access to the database, just modify the content of the database itself or compromise the local system where Redis is running? How important is a given security layer in a system depends on its security model. Is a system designed to have untrusted users accessing it, like a web server for example? There are different levels of authorization for different kinds of users? The Redis security model is: "it's totally insecure to let untrusted clients access the system, please protect it from the outside world yourself". The reason is that, basically, 99.99% of the Redis use cases are inside a sandboxed environment. Security is complex. Adding security features adds complexity. Complexity for 0.01% of use cases is not great, but it is a matter of design philosophy, so you may disagree of course. The problem is that, whatever we state in our security page, there are a lot of Redis instances exposed to the internet unintentionally. Not because the use case requires outside clients to access Redis, but because nobody bothered to protect a given Redis instance from outside accesses via fire walling, enabling AUTH, binding it to 127.0.0.1 if only local clients are accessing it, and so forth. Let's crack Redis for fun and no profit at all