Jon Chery
496303471d
---ci--- project: atelier phase: 7 milestone: v0.1 status: complete phase_role: final milestone_complete: true requirements: covered: [ATELIER-01, ATELIER-02, ATELIER-03, ATELIER-04, ATELIER-05, ATELIER-06, ATELIER-07, ATELIER-08, ATELIER-09, ATELIER-10, ATELIER-11, ATELIER-12, ATELIER-13, ATELIER-14, ATELIER-15, ATELIER-16, ATELIER-17, ATELIER-18, ATELIER-19, ATELIER-20, ATELIER-21, ATELIER-22, ATELIER-23, ATELIER-24, ATELIER-25, ATELIER-26, ATELIER-27, ATELIER-28, ATELIER-29, ATELIER-30, ATELIER-31, ATELIER-32, ATELIER-33, ATELIER-34, ATELIER-35] partial: [] ship: milestone: v0.1 type: NFR tag: v0.0.7 merge: milestone/v0.1-atelier -> main release: https://git.cloudinit.dev/cloudinit-bot/atelier/releases/tag/v0.0.7 ---/ci--- Milestone v0.1 — Initial Framework (NFR, complete). 8 core principles (C1-C8), 11 domains, 110 domain principles, 27 derived docs, 4 good + 3 bad examples, 4 language docs, full matrix, 3 review docs. All 35 requirements covered. 7 patches (v0.0.0 pre-execution through v0.0.7 final). v0.0.7 IS the v0.1.0 milestone release.
2.6 KiB
2.6 KiB
Authentication — Derived Rules
Derives from
domains/security/first-principles.mdP1 (Zero Trust), P2 (Least Privilege), P6 (Crypto Correctness).
The Default: Authenticated
- Every endpoint is authenticated unless explicitly public.
- "Public" is an explicit declaration, not a default.
- A missing auth check is a bug, not an oversight.
Authentication Methods
Session-based (browser)
- Server-side session, cookie-borne session ID.
- Cookie:
HttpOnly,Secure,SameSite=Lax(orStrict). - Session ID: cryptographically random, ≥ 128 bits.
- Session timeout: bounded. Idle timeout + absolute timeout.
Token-based (API, SPA)
- Bearer token in
Authorization: Bearer <token>. - Token: JWT (signed) or opaque (server-stored).
- JWT: signed (HS256/RS256), never
none. Short TTL (≤ 1 hour). Refresh token for long sessions. - Opaque: server-stored, revocable. Use when revocation matters.
API Keys (service-to-service)
- Long-lived, scoped, rotatable.
- Sent in header (
X-API-Key), not query string (logged in URLs). - Stored in a secrets manager, never in code.
What Never to Do (P6 Crypto Correctness)
- Never roll your own auth. Use a vetted library or framework.
- Never store passwords in plaintext. Use bcrypt/scrypt/argon2 with a work factor.
- Never use MD5 or SHA1 for password hashing.
- Never put a token in a URL. URLs are logged.
- Never accept
alg: nonein a JWT. - Never trust a token without verifying its signature.
Password Rules (P4 Input Validation)
- Minimum length: 12 characters (NIST 800-63B). No maximum (don't prevent long passwords).
- No composition rules (no "must contain a symbol"). They don't help and frustrate users.
- Check against a breach corpus (HIBP API or similar).
- Rate limit login attempts. Lockout after N failures (with exponential backoff, not a hard lock).
Multi-Factor (P3 Defense in Depth)
- MFA is the default for privileged accounts.
- TOTP (RFC 6238) or WebAuthn. SMS is deprecated (SIM swapping).
- MFA is a layer, not a replacement for strong primary auth.
Session Lifecycle (P2 Least Privilege, P5 Reversibility)
- Sessions are revocable. A logout invalidates the session server-side, not just client-side.
- Tokens are revocable. A refresh token revocation list is maintained.
- "Remember me" extends the session, it does not make it permanent.
Audit (P7 Auditability)
- Every auth event is logged: login (success/fail), logout, token issuance, token revocation.
- Logs include: user ID, timestamp, IP, user agent, outcome.
- Logs do not include: passwords, tokens, session IDs (use a hash).