Encryption & Data Protection

AuthProxy implements multiple layers of security to protect user data and prevent common attack vectors.

Authentication Security

Cryptographic Methods

Method	Algorithm	Description
FIDO2/WebAuthn	W3C Standard	Browser-native passkey support, hardware security keys
EdDSA	Ed25519	High-security digital signatures for applications and services
Password Keys	Ed25519 derived	Passwords converted to EdDSA keys for consistent verification

Session Protection

• HttpOnly Cookies: Session tokens inaccessible to JavaScript
• SameSite: In production the sid cookie is Strict by default, switching to None only when cross-domain cookies are enabled (CrossDomainCookie) or for app-login sessions that legitimately span domains. In dev/test/local it falls back to Lax.
• Secure Flag: Cookies transmitted over HTTPS in production (omitted in dev/test/local for localhost)
• Session Timeout: Configurable session lifetime
• Device Tracking: Each session bound to device fingerprint

Transport Security

HTTPS Enforcement

• Mandatory HTTPS: All production communications require TLS
• HSTS Headers: HTTP Strict Transport Security with preload
• TLS 1.2+: Modern TLS versions only
• Strong Ciphers: Disabled legacy and weak cipher suites

Certificate Management

• Supports standard X.509 certificates
• Compatible with Let's Encrypt automation
• Reverse proxy SSL termination support

Attack Protection

CSRF Protection

• SameSite cookies: Primary defense (Strict in production unless cross-domain/app-login requires None)
• Origin validation: Request origin verification
• Referer checking: Additional validation layer
• Challenge-response: Cryptographic request signing

XSS Prevention

• Content Security Policy (CSP): Strict source restrictions
• Input sanitization: Server-side validation
• Output encoding: Proper HTML escaping
• X-Content-Type-Options: Prevents MIME sniffing

SQL Injection Prevention

• Parameterized queries: All database operations use parameters
• Dapper ORM: Type-safe query building
• Input validation: Server-side type checking

Brute Force Protection

• Rate limiting: Per-IP, per-session, per-key limits
• Exponential backoff: Increasing delays on failures
• Account lockout: Configurable failed attempt threshold
• IP blocking: Automatic and manual blacklisting

DDoS Protection

• Request throttling: Middleware-level rate limiting
• IP whitelist/blacklist: Manual access control
• Edge firewall integration: External firewall support
• Connection limits: Per-source restrictions

Audit & Compliance

Logging

All authentication events are logged with:

Field	Description
ip_address	Client IP with geolocation
device_info	User agent string
screen_resolution	Browser viewport
device_guid	Device fingerprint
timezone	Client timezone
browser_lang	Preferred language
login_type	Authentication method used, stored as the sequential LoginType enum (e.g. 7 = Email), not the LoginMethod bitmask

Monitoring

• OpenTelemetry integration: Distributed tracing
• Uptrace support: Performance analytics
• Structured logging: JSON format for analysis
• Health endpoints: System status monitoring

Key Management

Storage

• Public keys stored in user_key table
• FIDO2 credentials in CBOR format
• Sign counter for replay protection
• Key flags for type identification

Rotation

• Multiple keys per user supported
• Key revocation without session invalidation
• Historical keys preserved for audit (marked deleted)