29 lines
3.9 KiB
Markdown
29 lines
3.9 KiB
Markdown
# Security support and threat model matrix
|
|
|
|
WRNexus security controls are defense layers, not substitutes for TLS, secret
|
|
management, database isolation, or operational monitoring. This matrix defines
|
|
the supported 0.8 contracts and the boundary application owners retain.
|
|
|
|
| Area | Framework guarantee | Application/operator responsibility |
|
|
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
|
|
| Sessions and passwords | Rotating sessions, idle/absolute expiry, revocation, password hashing policy, trusted-device controls | TLS, durable session storage, breach response, account recovery policy |
|
|
| MFA and passkeys | One-use OTP/recovery state, TOTP counter replay defense, WebAuthn challenge consumption, RP/origin provider inputs, signature-counter regression checks | Use a conformant WebAuthn provider, configure the exact public origin/RP ID, transactional credential storage |
|
|
| OAuth/OIDC | State consumption, PKCE, safe return URLs, strict issuer discovery, HTTPS endpoints, RS256 JWKS rotation, nonce/audience/`azp`/`at_hash` validation | Register exact redirect URIs, protect client secrets, select trusted issuers and scopes |
|
|
| JWT | HS256 local keyrings and bounded HTTPS RS256 JWKS caches with `kid` rollover | Rotate/retire keys deliberately, set issuer/audience/expiry/max-age, revoke refresh families |
|
|
| CAPTCHA and rate limits | Expiring one-use challenges, action/session binding, bounded create/verify endpoints | Treat CAPTCHA as one signal and keep route/account/network rate limits |
|
|
| Encrypted HTTP | AEAD, request context binding, age checks, optional one-use replay stores | Keep HTTPS, use a shared replay store across instances, rotate server-managed keys |
|
|
| Authorization | Explicit policies/roles and deny responses | Model tenant/object ownership and test privilege boundaries |
|
|
| Browser/runtime | Production CSP, HSTS, MIME-sniffing, referrer/permissions policies and safe hydration serialization | Configure allowed origins/sources, terminate TLS correctly, review third-party scripts |
|
|
|
|
`AUTH_SECURITY_EVENT_TYPES` is the stable machine-readable authentication audit
|
|
event vocabulary. Events include an ID, timestamp, severity and available actor,
|
|
user, session, IP, user-agent and structured data. Consumers should alert on
|
|
critical events and retain warning/critical records according to their policy;
|
|
never place credentials or raw tokens in event data.
|
|
|
|
Protocol and adversarial tests cover replay, expired state, counter regression,
|
|
key rotation, algorithm/key-type confusion, issuer/audience/nonce mismatch,
|
|
unsafe return URLs, request binding, rate limiting, and built production response
|
|
headers. Live provider certification remains an integration responsibility
|
|
because provider metadata and credential policies are deployment-specific.
|