9. Secure defaults
An authenticated production service should fail closed. Declare the posture and Riverbase turns the checklist below into startup checks: the service refuses to boot instead of running insecurely.
use riverbase_http::web::Posture;
app.require_posture(Posture::AuthenticatedApi);
With Posture::AuthenticatedApi, startup fails with CFG-152 if auth is off. Posture::OpenApi is
for discovery-only services such as documentation or health endpoints.
Checklist
| Must have | Mechanism | Code when missing or unsafe |
|---|---|---|
| Authentication configured | [riverbase.auth] with Keycloak/OIDC (or MockAuth outside production) | AUT-001, CFG-148 (empty accepted_azp) |
| Casbin on, with a policy | [riverbase.casbin] enabled = true plus a policy | CAS-011 unmapped route, CAS-012 drift, CAS-013 missing command row |
| No default secrets | Secrets are Options with no fallback | CFG-141 to CFG-147 |
| No wildcard CORS with credentials | No CORS layer unless you add one | CFG-150 |
| Secure cookies | cookie_https_only and CSRF validation on (the default) | CFG-149 |
| A declared API zone | [riverbase] api_zone | CFG-145 |
azp checked | accepted_azp lists your clients | AUT-147 |
| Body and upload limits | request_body_max_bytes, request_upload_max_bytes | WEB-103, MED-086 |
| A row policy on every resource | policy: public("reason", "sign-off"), or required + scope_policy | QRY-123, QRY-124, QRY-125 |
| Explicit route access | register_routes(…, RouteAccess::Enforced) or register_public_routes | CAS-011 |
Waivers are explicit and named
RIVERBASE_DEBUG only changes verbosity; it never relaxes a check. To waive a specific check in a
throwaway environment, name it:
RIVERBASE_INSECURE_ALLOW=insecure-cookies cargo run -p todo-service
Keep RIVERBASE_INSECURE_ALLOW out of production configuration. A good rule is to allow it only in
the scripts that provision disposable test databases.
Where to go from here
You now have every building block: a domain bundle, commands, queries, custom HTTP, identity, and permissions. Next steps:
- Architecture and the other Concepts pages, for the design behind each piece;
- Deployment, to run command and query as separate processes;
- Crates, for workers, media files, and forms.