Security Overview

SCRIPE implements a defense-in-depth security strategy with five layers: network protection, authentication, authorization, data isolation, and audit logging. Every request passes through multiple security checks before reaching business logic.

Security Defense Layers

Security Features

• JWT Authentication

  Short-lived access tokens (15 min) with automatic refresh. HMAC-SHA256 signing with configurable secret.

• Two-Factor Auth

  TOTP-based 2FA with QR code setup. Optional per-user, enforceable per-tenant or globally.

• RBAC Permissions

  A complete PBAC enforcement engine executing Role-Based (RBAC), Group-Based (GBAC), and Attribute/Field-Based (ABAC) rules instantly via zero-latency server-side JWT caching.

• Rate Limiting

  4-tier rate limiting: global DDoS, per-IP, per-endpoint, and authentication-specific.

• Audit Logging

  Every action logged with who, what, when, where. Real-time SignalR broadcasting.

• CORS Configuration

  Strict origin validation in production. Open CORS for localhost in development.

CORS Configuration

CORS policies differ between development and production environments. In development, all localhost origins are allowed. In production, only explicitly configured origins are accepted.

// Development: Open CORS for local testing
policy.WithOrigins("http://localhost:3000", "https://localhost:3000")
      .AllowAnyMethod()
      .AllowAnyHeader()
      .AllowCredentials();

Rate Limiting Policies

Password Policies