Security

Authentication

• Backend is the authorization enforcement point.
• Use short-lived access tokens and rotating refresh tokens.
• Web stores session material in HttpOnly, Secure, scoped cookies.
• Mobile stores refresh credentials in platform secure storage.
• Mobile sends access tokens through Authorization: Bearer.

Authorization

• Roles are coarse-grained.
• Permissions enforce actual operations.
• Every protected endpoint needs authorization tests.
• UI visibility is not authorization.

Secrets

• Do not commit production credentials, signing keys, tokens, or database URLs.
• Do not store long-lived browser tokens in localStorage.
• Use environment-specific secret managers outside source control.

Logging

Logs must exclude:

• passwords;
• access and refresh tokens;
• signing keys;
• personal data not needed for debugging;
• full document contents unless explicitly approved.

Review Checklist

• CORS is limited to known origins.
• Cookies use secure settings in staging and production.
• Token refresh is serialized on mobile.
• Rate limits protect authentication endpoints.
• Sensitive operations create audit records.
• Dependency, secret, SAST, and container scans run in CI.