Skip to content
FactuStorm Docs

Security Guidelines

This document outlines the security principles and practices implemented in the SaaS Auth API, as well as recommendations for secure usage.

Security Features

The SaaS Auth API includes the following security features:

Authentication Security

  1. Password Security

    • Secure password hashing using bcrypt
    • Password salt configuration
    • Password complexity validation
    • Protection against brute force attacks with rate limiting

  2. JWT Security

    • Short-lived access tokens (default: 15 minutes)
    • Refresh token rotation
    • Secure token storage in Redis
    • Token invalidation on password change or logout

  3. API Key Security

    • Secure key generation and validation
    • Key hashing using SHA-256 + bcrypt
    • Key prefix system for lookups without exposing the entire key
    • API key expiration support
    • Fine-grained API key permissions

Authorization Security

  1. Role-Based Access Control (RBAC)

    • Granular permission system
    • Role-based access to endpoints
    • Easy permission management
    • Default roles and permissions

  2. Resource Access Control

    • Owner-based resource access
    • Admin override capabilities
    • API key permission scoping

API Security

  1. Rate Limiting

    • Configurable rate limiting based on IP and/or user ID
    • Protection against DoS attacks
    • Rate limit headers for client feedback

  2. Input Validation

    • Strict schema validation for all inputs
    • Protection against injection attacks
    • Error messages that don’t leak sensitive information

  3. Error Handling

    • Secure error handling that doesn’t expose internal details
    • Consistent error format
    • Validation error details for legitimate form inputs

  4. CORS Configuration

    • Configurable CORS settings
    • Default restrictive settings

  5. HTTP Security Headers

    • Content-Security-Policy
    • X-XSS-Protection
    • X-Content-Type-Options
    • X-Frame-Options
    • Referrer-Policy

Best Practices for Deploying Securely

Environment Configuration

  1. Secure Credentials

    • Change all default secrets and passwords
    • Use strong, unique values for JWT secrets and password salts
    • Use a secure secret management solution (e.g., HashiCorp Vault, AWS Secrets Manager)

  2. HTTPS Configuration

    • Always use HTTPS in production
    • Configure proper TLS/SSL settings
    • Use strong cipher suites
    • Implement HTTP Strict Transport Security (HSTS)

  3. Network Security

    • Use firewalls to restrict access to the API
    • Consider putting the API behind an API gateway
    • Deploy in a private subnet if possible
    • Use VPCs or network isolation where appropriate

  4. Database Security

    • Use strong, unique passwords for the database
    • Limit database access to only the application servers
    • Enable database encryption at rest and in transit
    • Implement proper database access controls

Application Configuration

  1. JWT Settings

    • Keep access token lifetime short (15 minutes or less)
    • Configure reasonable refresh token lifetime based on your security requirements
    • Use a strong, random JWT secret

  2. Rate Limiting

    • Enable rate limiting in production
    • Configure appropriate limits based on your API usage patterns
    • Monitor for abusive patterns

  3. API Key Management

    • Implement API key rotation policies
    • Use API key expiration for temporary access
    • Monitor API key usage

  4. Logging and Monitoring

    • Enable audit logging for security events
    • Monitor for suspicious activities
    • Set up alerts for security incidents
    • Don’t log sensitive information like passwords or tokens

Security Recommendations for Clients

Access Token Handling

  1. Token Storage

    • Store access tokens securely
    • For web apps: Use HttpOnly cookies or secure in-memory storage
    • For mobile apps: Use secure device storage or keychain
    • Never store access tokens in localStorage or sessionStorage for production web applications
    • Avoid storing tokens in client-side code

  2. Token Usage

    • Include tokens only in the appropriate header
    • Never send tokens in URL parameters
    • Implement token refresh logic properly

API Key Handling

  1. API Key Storage

    • Store API keys securely
    • Never expose API keys in client-side code
    • Use API keys only in server-to-server communications

  2. API Key Security

    • Assign the minimum necessary permissions to API keys
    • Rotate API keys regularly
    • Use expiration dates for API keys where appropriate
    • Implement monitoring for API key usage

General Security Recommendations

  1. Client-Side Security

    • Implement proper input validation
    • Protect against XSS and CSRF attacks
    • Use Content Security Policy
    • Keep client libraries and dependencies updated

  2. Error Handling

    • Implement proper error handling
    • Don’t expose sensitive information in error messages to end users
    • Log security-related errors appropriately

  3. User Education

    • Educate users about password security
    • Implement security notifications for sensitive actions
    • Encourage two-factor authentication where available

Security Incident Response

In case of a security incident:

  1. Identification

    • Monitor logs for suspicious activities
    • Set up alerts for potential security incidents

  2. Containment

    • Revoke compromised tokens and API keys
    • Implement IP blocking if necessary
    • Consider temporarily disabling affected services

  3. Remediation

    • Fix the security issue
    • Conduct a security review
    • Update security practices and documentation

  4. Communication

    • Notify affected users as required
    • Provide clear instructions for users
    • Be transparent about the incident and response

Security Compliance

The SaaS Auth API is designed with security best practices in mind, but depending on your specific compliance requirements, you may need to implement additional measures:

  • GDPR: Ensure proper data handling, privacy policies, and user consent
  • HIPAA: Additional encryption and audit logging may be required
  • PCI DSS: Additional security controls for payment-related information
  • SOC 2: Documentation of security controls and procedures

Security Testing

Implement regular security testing:

  1. Automated Security Testing

    • Static application security testing (SAST)
    • Dynamic application security testing (DAST)
    • Dependency vulnerability scanning

  2. Manual Security Testing

    • Penetration testing
    • Code security reviews
    • Architecture security reviews

  3. Regular Vulnerability Assessments

    • Scan for known vulnerabilities
    • Check for outdated dependencies
    • Verify security configurations