Skip to main content

Security checklist

Use this before a service takes real traffic. Most items are enforced at startup when you declare app.require_posture(Posture::AuthenticatedApi). See Secure defaults for the codes.

Identity​

  • auth_provider = "Keycloak" (or your OIDC IdP). MockAuth is for development only.
  • issuer, audience, and a non-empty accepted_azp are set.
  • application_secret_key and oauth2_client_secret come from a secret store, never the file.
  • cookie_https_only = true, validate_csrf_token = true, and a deliberate cookie_same_site.
  • safe_redirect_domains lists only your own front ends.

Authorization​

  • [riverbase.casbin] enabled = true, with a policy reviewed like code.
  • Every mounted command has a policy row (no CAS-013 at startup).
  • Every custom route is registered with RouteAccess::Enforced or is public with a reason and sign-off.
  • Workers that send commands run with a CommandPolicy.
  • omit_inaccessible_openapi = true if API documents are exposed to end users.

Data​

  • Every query resource declares policy:. public(…) only for data that is truly shared.
  • Tenant-owned resources rely on _tenant filtering and add a scope_policy where rows need finer restriction.
  • tenant_access_policy = "system" only on operator portals.
  • Deletion semantics (soft, hard, or prohibited) are decided for every aggregate root.

Surface​

  • api_zone is declared, so each deployment registers only its routes.
  • CORS is configured with explicit origins. No wildcard with credentials.
  • Body and upload limits match the largest legitimate request.
  • deny_unknown_fields = true for public APIs.
  • RIVERBASE_INSECURE_ALLOW is absent from production configuration.
  • RIVERBASE_DEBUG is unset, or understood to change verbosity only.

Operations​

  • Logs are json and do not include raw tokens. The framework never logs secrets; keep it that way in custom handlers.
  • Database credentials are least-privilege, and migrations run with a separate role if your policy requires it.
  • Audit retention is configured to your compliance window.
  • Outbox consumers are idempotent.