Security Configuration Reference

# Recommended for SOC 2 / ISO 27001 compliance

[vars]
# --- Authentication (SOC 2 CC3.1.2) ---
PASSWORD_MIN_LENGTH = "12"                    # Min 12, recommend 14+
REQUIRE_EMAIL_VERIFICATION = "true"           # Required for enterprise
MFA_MODE = "required"                         # Required for SOC 2

# --- Session Management (SOC 2 CC3.1.2) ---
SESSION_DURATION_SECONDS = "28800"             # 8 hours (max working day)
REFRESH_TOKEN_DURATION_SECONDS = "604800"       # 7 days (max recommended)
ACCESS_TOKEN_DURATION_SECONDS = "3600"          # 1 hour (industry standard)
AUTH_CODE_DURATION_SECONDS = "600"             # 10 minutes (OAuth standard)

# --- Rate Limiting (SOC 2 CC3.1.2f) ---
RATE_LIMIT_LOGIN_ATTEMPTS = "5"                # Lock after 5 attempts
RATE_LIMIT_WINDOW_SECONDS = "900"              # 15 minute window

# --- Registration Control (ISO 8.2) ---
ALLOW_REGISTRATION = "false"                  # Closed registration

# Required secrets
JWT_PRIVATE_KEY     # RSA 2048+ bit private key
JWT_PUBLIC_KEY      # Matching public key
ENCRYPTION_KEY       # 32-byte hex (256-bit) for MFA secrets

# Email provider (choose one)
RESEND_API_KEY
MAILGUN_API_KEY      # + MAILGUN_DOMAIN in vars
SENDGRID_API_KEY
POSTMARK_API_KEY
AWS_SES_ACCESS_KEY   # + AWS_SES_SECRET_KEY, AWS_SES_REGION in vars

# Social login (if enabled)
GOOGLE_CLIENT_SECRET
FACEBOOK_APP_SECRET
GITHUB_CLIENT_SECRET
MICROSOFT_CLIENT_SECRET

# SAML (if enabled)
SAML_PRIVATE_KEY
SAML_CERTIFICATE

'login_success'        // User successfully logged in
'login_failure'        // Authentication failed
'logout'              // User logged out
'register_success'     // New user created
'register_failure'     // Registration failed

'password_reset_request'  // Password reset initiated
'mfa_verify_success'     // MFA code valid
'mfa_verify_failure'     // MFA code invalid
'account_locked'         // Account automatically locked
'rate_limit_exceeded'    // Rate limit triggered

'admin_user_created'   // Admin created user
'admin_user_deleted'   // Admin deleted user
'admin_password_reset' // Admin reset password
'api_key_created'      // API key generated
'api_key_revoked'      // API key revoked

'oauth_authorize'     // Authorization requested
'oauth_token_issued'   // Access token granted
'oauth_token_revoked'  // Token revoked

// User management
'users:read'      // List and view users
'users:write'     // Create and update users
'users:delete'    // Delete users

// OAuth client management
'clients:read'    // List and view clients
'clients:write'   // Create and update clients
'clients:delete'  // Delete clients

// API key management
'api-keys:read'   // List API keys
'api-keys:write'  // Create API keys
'api-keys:delete' // Delete API keys

// Read-only operations
'audit:read'      // View audit logs
'stats:read'      // View statistics

-- Failed login attempts by IP
SELECT ip_address, COUNT(*) as attempts
FROM audit_log
WHERE event_type = 'login_failure'
  AND created_at > ?  -- timestamp
GROUP BY ip_address
HAVING attempts > 5
ORDER BY attempts DESC;

-- Recent admin actions
SELECT * FROM audit_log
WHERE event_type LIKE 'admin_%'
ORDER BY created_at DESC
LIMIT 50;

-- User authentication history
SELECT event_type, event_status, ip_address,
       datetime(created_at/1000, 'unixepoch') as time
FROM audit_log
WHERE user_id = ?
ORDER BY created_at DESC;

-- Active sessions
SELECT * FROM user_sessions
WHERE is_active = 1 AND expires_at >
ORDER BY last_activity_at DESC;

# Lock a user account
wrangler d1 execute DB --command="UPDATE users SET is_locked = 1 WHERE email = '[email protected]'"

# Revoke all user sessions
wrangler d1 execute DB --command="UPDATE user_sessions SET is_active = 0 WHERE user_id = 'user-id'"

# Revoke all refresh tokens for a user
wrangler d1 execute DB --command="UPDATE refresh_tokens SET is_revoked = 1, revoked_at = $(($(date +%s)*1000)) WHERE user_id = 'user-id'"

# View recent failed logins
wrangler d1 execute DB --command="SELECT * FROM audit_log WHERE event_type = 'login_failure' ORDER BY created_at DESC LIMIT 20"

# Export audit logs (last 24 hours)
wrangler d1 execute DB --command="SELECT * FROM audit_log WHERE created_at > $(($(date +%s)*1000 - 86400000)) ORDER BY created_at DESC" > audit-export.json