# MinIO Security Overview [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)

## Server-Side Encryption

MinIO supports two different types of server-side encryption ([SSE](#sse)):

- **SSE-C**: The MinIO server en/decrypts an object with a secret key provided by the S3 client as part of the HTTP request headers. Therefore, [SSE-C](#ssec) requires TLS/HTTPS.

		predCount++
	}
	if f.ObjectSizeLessThan != 0 {
		pType = sizeLtPred
		predCount++
	}
	// Note: S3 supports empty <Filter></Filter>, so predCount == 0 is
	// valid.
	if predCount > 1 {
		return errInvalidFilter
	}

	var err error
	switch pType {
	case nonePred:
	// S3 supports empty <Filter></Filter>
	case prefixPred:
	case andPred:
		err = f.And.Validate()
	case tagPred:

// This is one of the types able to be returned from the /api and /apis endpoint and contains an aggregated
// list of API resources (built-ins, Custom Resource Definitions, resources from aggregated servers)
// that a cluster supports.
message APIGroupDiscoveryList {
  // ResourceVersion will not be set, because this does not have a replayable ordering among multiple apiservers.

			}
			if h.Typeflag == TypeGNUSparse {
				whyOnlyGNU = "only GNU supports TypeGNUSparse"
				format.mayOnlyBe(FormatGNU)
			} else {
				whyNoGNU = "GNU supports sparse files only with TypeGNUSparse"
				format.mustNotBe(FormatGNU)
			}
			whyNoUSTAR = "USTAR does not support sparse files"
			format.mustNotBe(FormatUSTAR)
		}
	*/

	// Check desired format.

MinIO server supports storage class in erasure coding mode. This allows configurable data and parity drives per object.

This page is intended as a summary of MinIO Erasure Coding. For a more complete explanation, see <https://min.io/docs/minio/linux/operations/concepts/erasure-coding.html>.

## Overview

For discovery, the JWT token will be read directly from a file and sent as is. For CA, this logic is a bit more complex,
as the support for external CAs is more mature than external discovery servers. This supports some additional
configuration, a `CredentialFetcher` which allows fetching a token from places other than a file (for example, a local

    /**
     * @return context flags
     */
    int getFlags ();


    /**
     * @return array of supported mechanism OIDs
     */
    ASN1ObjectIdentifier[] getSupportedMechs ();


    /**
     * 
     * @return whether this mechanisms supports integrity
     */
    boolean supportsIntegrity ();


    /**
     * @param data
     * @return MIC

   * on HTTP/2.
   *
   * QUIC is not natively supported by OkHttp, but provided to allow a theoretical interceptor that
   * provides support.
   */
  QUIC("quic"),

  /**
   * HTTP/3 is the third and upcoming major version of the Hypertext Transfer Protocol used to
   * exchange information. HTTP/3 runs over QUIC, which is published as RFC 9000.
   *
   * HTTP/3 is not natively supported by OkHttp, but provided to allow a theoretical interceptor

import java.util.Locale;

/**
 * This class is emulated in GWT.
 *
 * @author Hayward Chan
 */
@GwtCompatible
final class Platform {

  /** Format the template with args, only supports the placeholder {@code %s}. */
  static String format(String template, Object... args) {
    return String.format(Locale.ROOT, template, args);
  }

  /** See {@link ListListIteratorTester} */

   * that it can be done securely, without vulnerability to race conditions (i.e. when the file
   * system does not support {@link SecureDirectoryStream}).
   *
   * <p><b>Warning:</b> On a file system that supports symbolic links, it is possible for an
   * insecure recursive delete to delete files and directories that are <i>outside</i> the directory