[JWT / Session / OAuth / Clerk / etc.]
1. User submits credentials
2. Server validates
3. Issue token/session
4. Client stores securely
5. Include in subsequent requests
- Web: HttpOnly cookies
- Mobile: Secure storage
| Role | Permissions |
|---|---|
| admin | Full access |
| member | Read/write own resources |
| viewer | Read only |
[Describe per-resource authorization if applicable]
| Data | At Rest | In Transit |
|---|---|---|
| Passwords | bcrypt hash | HTTPS |
| PII | AES-256 | HTTPS |
| API Keys | Encrypted | HTTPS |
- Never log sensitive data
- Mask in error messages
- Redact in API responses
- Validate all user input
- Use parameterized queries
- Sanitize for XSS
| Risk | Mitigation |
|---|---|
| Injection | Parameterized queries |
| Broken Auth | Secure session management |
| XSS | Output encoding |
| CSRF | Token validation |
| Security Misconfiguration | Secure defaults |
| Secret | Storage |
|---|---|
| Database URL | Environment variable |
| API Keys | Environment variable |
| Encryption Keys | Secrets manager |
Never commit secrets to git.
Content-Security-Policy: default-src 'self'
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
- Log authentication events
- Monitor for anomalies
- Alert on suspicious activity
- Identify and contain
- Assess impact
- Notify affected parties
- Fix and document
- Post-mortem
[GDPR / HIPAA / SOC2 requirements if applicable]