Reflection-Modell, security

Reflektiert Security-relevante Flows, Controller, Templates und Konfigurationen gegen OWASP- und Projektregeln.

route_security

• route
• method
• auth_required
• roles_or_policies
• tenant_scope
• csrf_required
• rate_limit

session_policy

• cookie_name
• secure
• http_only
• same_site
• idle_timeout_minutes
• absolute_timeout_minutes
• rotation_on_login

reauth_flow

• trigger_condition
• method
• magic_code_ttl_minutes
• preserves_unsaved_data
• returns_to_original_action
• no_modal_dependency

transient_sensitive_state

• flow_name
• sensitive_fields
• appears_in_query_string
• appears_in_redirect_location
• appears_in_referer
• appears_in_access_log
• storage_mechanism
• server_side_state
• opaque_cookie_token
• cookie_secure
• cookie_http_only
• cookie_same_site
• direct_cookie_payload_encrypted
• ttl_seconds
• clear_on_success

output_context

• template
• variable
• html_context
• escaping_function
• allows_html

upload_policy

• field_name
• allowed_extensions
• allowed_mime_types
• max_size_bytes
• storage_location
• malware_scan_policy
• download_authorization

secret

• name
• storage
• rotation_policy
• exposed_to_client
• logged

security_header_set

• csp
• frame_ancestors
• referrer_policy
• content_type_options
• hsts

audit_event

• event_type
• actor_id
• subject_id
• tenant_id
• timestamp
• correlation_id

db_context_policy

• context_name
• context_scope
• transaction_required
• reset_policy
• persistent_worker_safe
• actor_source
• server_authoritative
• client_override_allowed

Zurück zum Bereich