# Security overview This document outlines common risks and best practices for the Traefik charm. It focuses on configurations and protections available through the charm itself. ## Risks The following items include descriptions of the risks, their corresponding best practices for mitigation, as well as links to related documentation and configuration guidelines. ### Security vulnerabilities Running Traefik with one or more weaknesses that can be exploited by attackers. #### Best practices - Keep the Juju and the charm updated. See [How to upgrade](../../how-to/upgrade/index.html.md#how-to-upgrade), and learn more about Juju updates in the [documentation](https://canonical.com/juju/docs/juju-cli/3.6/explanation/juju-security/#controls-regular-updates). ### Unencrypted traffic If Traefik serves HTTP, the traffic between Traefik and the clients will be unencrypted, risking eavesdropping and tampering. #### Best practices - Always enable HTTPS by integrating with a charm providing the [`certificates`](https://charmhub.io/traefik-k8s/integrations#certificates) integration to configure TLS. - Consider encrypting in-cluster traffic, specially if your cluster is multi-tenant. ### Authentication The Traefik charm supports [BasicAuth](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/basicauth/). #### Best practices - Consider [enabling BasicAuth](../../how-to/enable-basicauth/index.html.md#how-to-enable-basicauth) if you want access to the backend workloads to be authenticated. Alternatively, [ForwardAuth](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/forwardauth/) can also be enabled as an experimental feature.