Jon Chery
496303471d
---ci--- project: atelier phase: 7 milestone: v0.1 status: complete phase_role: final milestone_complete: true requirements: covered: [ATELIER-01, ATELIER-02, ATELIER-03, ATELIER-04, ATELIER-05, ATELIER-06, ATELIER-07, ATELIER-08, ATELIER-09, ATELIER-10, ATELIER-11, ATELIER-12, ATELIER-13, ATELIER-14, ATELIER-15, ATELIER-16, ATELIER-17, ATELIER-18, ATELIER-19, ATELIER-20, ATELIER-21, ATELIER-22, ATELIER-23, ATELIER-24, ATELIER-25, ATELIER-26, ATELIER-27, ATELIER-28, ATELIER-29, ATELIER-30, ATELIER-31, ATELIER-32, ATELIER-33, ATELIER-34, ATELIER-35] partial: [] ship: milestone: v0.1 type: NFR tag: v0.0.7 merge: milestone/v0.1-atelier -> main release: https://git.cloudinit.dev/cloudinit-bot/atelier/releases/tag/v0.0.7 ---/ci--- Milestone v0.1 — Initial Framework (NFR, complete). 8 core principles (C1-C8), 11 domains, 110 domain principles, 27 derived docs, 4 good + 3 bad examples, 4 language docs, full matrix, 3 review docs. All 35 requirements covered. 7 patches (v0.0.0 pre-execution through v0.0.7 final). v0.0.7 IS the v0.1.0 milestone release.
62 lines
2.6 KiB
Markdown
62 lines
2.6 KiB
Markdown
# Authentication — Derived Rules
|
|
|
|
> Derives from `domains/security/first-principles.md` P1 (Zero Trust), P2 (Least Privilege), P6 (Crypto Correctness).
|
|
|
|
## The Default: Authenticated
|
|
|
|
- Every endpoint is authenticated unless explicitly public.
|
|
- "Public" is an explicit declaration, not a default.
|
|
- A missing auth check is a bug, not an oversight.
|
|
|
|
## Authentication Methods
|
|
|
|
### Session-based (browser)
|
|
- Server-side session, cookie-borne session ID.
|
|
- Cookie: `HttpOnly`, `Secure`, `SameSite=Lax` (or `Strict`).
|
|
- Session ID: cryptographically random, ≥ 128 bits.
|
|
- Session timeout: bounded. Idle timeout + absolute timeout.
|
|
|
|
### Token-based (API, SPA)
|
|
- Bearer token in `Authorization: Bearer <token>`.
|
|
- Token: JWT (signed) or opaque (server-stored).
|
|
- JWT: signed (HS256/RS256), never `none`. Short TTL (≤ 1 hour). Refresh token for long sessions.
|
|
- Opaque: server-stored, revocable. Use when revocation matters.
|
|
|
|
### API Keys (service-to-service)
|
|
- Long-lived, scoped, rotatable.
|
|
- Sent in header (`X-API-Key`), not query string (logged in URLs).
|
|
- Stored in a secrets manager, never in code.
|
|
|
|
## What Never to Do (P6 Crypto Correctness)
|
|
|
|
- Never roll your own auth. Use a vetted library or framework.
|
|
- Never store passwords in plaintext. Use bcrypt/scrypt/argon2 with a work factor.
|
|
- Never use MD5 or SHA1 for password hashing.
|
|
- Never put a token in a URL. URLs are logged.
|
|
- Never accept `alg: none` in a JWT.
|
|
- Never trust a token without verifying its signature.
|
|
|
|
## Password Rules (P4 Input Validation)
|
|
|
|
- Minimum length: 12 characters (NIST 800-63B). No maximum (don't prevent long passwords).
|
|
- No composition rules (no "must contain a symbol"). They don't help and frustrate users.
|
|
- Check against a breach corpus (HIBP API or similar).
|
|
- Rate limit login attempts. Lockout after N failures (with exponential backoff, not a hard lock).
|
|
|
|
## Multi-Factor (P3 Defense in Depth)
|
|
|
|
- MFA is the default for privileged accounts.
|
|
- TOTP (RFC 6238) or WebAuthn. SMS is deprecated (SIM swapping).
|
|
- MFA is a layer, not a replacement for strong primary auth.
|
|
|
|
## Session Lifecycle (P2 Least Privilege, P5 Reversibility)
|
|
|
|
- Sessions are revocable. A logout invalidates the session server-side, not just client-side.
|
|
- Tokens are revocable. A refresh token revocation list is maintained.
|
|
- "Remember me" extends the session, it does not make it permanent.
|
|
|
|
## Audit (P7 Auditability)
|
|
|
|
- Every auth event is logged: login (success/fail), logout, token issuance, token revocation.
|
|
- Logs include: user ID, timestamp, IP, user agent, outcome.
|
|
- Logs do not include: passwords, tokens, session IDs (use a hash). |