Security Components
The documentation is constantly evolving and updated alongside the project's progress. Since it is developed in parallel with the code, some sections may temporarily refer to earlier versions of the system-these are gradually adapted to the current state of the application. If you notice any outdated information, please report it or open an Issue / Pull Request.
Documentation
# Security Components
The framework supplies security helpers. The application composes them into routes and middleware and supplies identity, role, and permission behavior.
# Permissions and access checks
AccessGuard evaluates permissions through AccessControlInterface. UserRoleProviderInterface supplies role information; null implementations provide no-op alternatives. RouteBuilder can attach permissions to routes. AuthMiddleware reads that permission and delegates the check to the guard.
# JWT
JwtService generates, validates, decodes, and refreshes tokens and checks role/scope claims. JwtAuthMiddleware validates a Bearer token for routes with a permission. It does not issue tokens or implement a login endpoint.
Configuration uses API_ENABLED, API_JWT_SECRET, and API_JWT_EXPIRATION. The current service has a fallback secret when the environment secret is empty; production must explicitly set a strong secret outside source control.
# Passwords, CSRF, and rate limits
PasswordHasher centralizes password hashing and verification.
CsrfTokenManager compares a submitted token with a session token. The
manager validates tokens but does not generate them; templates can use
getCsrfToken() to generate and retrieve the session token.
For a complete example covering the form field, session requirements, controller-side validation, and failure handling, see [CSRF Protection](02-csrf-protection).
RateLimiter and RateLimitRepository provide rate-limit support using the database abstraction. The application configures the policy and storage.
# Integration checklist
- Mark protected routes with permissions and register required
middleware.
- Bind application-specific access-control and role-provider
implementations.
- Configure JWT secrets outside source control.
- Regenerate session IDs when authentication state changes.
- Include and validate CSRF tokens on state-changing form submissions.
See CSRF Protection.
- Validate input and escape output at the appropriate application
boundary.
- A valid token or cookie is not authorization unless route policy
checks access.