Enterprise Platform Configuration (appsettings.json)

The SCRIPE platform host is governed by an enterprise-grade configuration matrix in appsettings.json. Spanning defense-in-depth security headers, multi-tier distributed rate limiters, AstraFlow request coverage diagnostics, GeoIP origin verification, and pluggable database providers, this document provides the canonical specification for operators and DevOps engineers.

Configuration Architecture & Topology

Designed to satisfy SOC2, ISO 27001, and banking-grade cloud security requirements across multi-tenant environments.

• Defense-in-Depth Security

  Mandatory HSTS, strict Content-Security-Policy headers, account lockout thresholds (5 failed attempts / 15-min lockout), and OTP expiration policies.

• Multi-Tier Rate Limiting

  Redis-backed token-bucket algorithms enforcing distinct ceilings per endpoint: 10/min for logins, 30/min for mutations, 5/min for heavy exports, and 3/min for phone OTP sends.

• GeoIP & Cloudflare Origin

  Origin verification headers preventing direct-to-IP bypasses, integrated with cached GeoIP lookups and CIDR access lists.

• AstraFlow Diagnostics

  Startup automated verification of request test coverage, DTO mapping catalog completeness, and API contract diagnostics.

• Multi-Database Strategy

  Pluggable EF Core providers supporting PostgreSQL, Oracle, and Microsoft SQL Server with zero application code changes.

• Automated Background Sweepers

  Scheduled background tasks sweeping orphaned tenant records, pending signup TTLs (24 hours), and soft-delete retention purges.

Canonical appsettings.json Matrix

The core enterprise schema from src/Host/API/appsettings.json demonstrating production security parameters and diagnostic flags:

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "Security": {
    "EnableHsts": true,
    "EnableSecurityHeaders": true,
    "MaxFailedAttempts": 5,
    "LockoutMinutes": 15,
    "OtpExpirationMinutes": 5,
    "SessionTimeoutMinutes": 60,
    "InternalApiKey": "${INTERNAL_API_KEY}"
  },
  "RateLimiting": {
    "Enabled": true,
    "GlobalLimit": 1000,
    "PerIpLimit": 200,
    "LoginLimit": 10,
    "ReadLimit": 200,
    "MutationLimit": 30,
    "PerUserLimit": 100,
    "ExportHeavyLimit": 5,
    "SignupLimit": 3,
    "PhoneOtpSendLimit": 3,
    "PasskeyAuthLimit": 5,
    "QrPollLimit": 60
  },
  "GeoIp": {
    "EnableIpApiFallback": true,
    "IpApiProviderUrl": "https://ipwho.is",
    "CacheHours": 12,
    "RequestTimeoutSeconds": 5,
    "TrustProxyHeaders": false,
    "RequireCloudflareOriginVerification": true,
    "OriginVerificationHeaderName": "X-Scripe-Origin-Verify",
    "OriginVerificationSecret": "${ORIGIN_VERIFY_SECRET}"
  },
  "AstraFlow": {
    "Diagnostics": {
      "ValidateRequestCoverage": true,
      "ValidateMappingCatalog": true,
      "IncludeInfoFindings": true,
      "ThrowOnErrors": true,
      "LogFullMarkdownReport": false,
      "MinimumLogSeverity": "Error",
      "EnableDiagnosticsEndpoint": true
    }
  },
  "Signup": {
    "Enabled": true,
    "PendingTtlHours": 24,
    "OrphanTtlHours": 1,
    "SweepIntervalMinutes": 15,
    "SessionRetentionDays": 7,
    "LeadDailyCap": 100,
    "BlockDisposableEmails": true,
    "MaxTenantsPerEmail": 3,
    "RequireEmailVerification": true
  }
}

Inbound Request Security & Governance Pipeline

The end-to-end execution flow through SCRIPE's infrastructure layers before reaching application domain handlers: