Security Architecture
Authentication, authorization, and security
Security Architecture
Authentication
JWT Tokens:
- Signed with secret key
- Contains user ID and roles
- Expires after 7 days
- Stored in localStorage
Password Security:
- SHA-256 hashing
- Never stored in plain text
- Password reset via secure tokens
Authorization
Role-Based Access Control (RBAC):
- Roles define permission sets
- Users assigned to roles
- Permissions checked per request
- Admin role has wildcard access
Input Validation
- Frontend validation (UX)
- Backend validation (security)
- Database constraints
- Type checking (TypeScript)
Security Measures
- SQL injection prevention (parameterized queries)
- XSS prevention (content sanitization)
- CORS configuration
- Audit logging