starkey/notesvault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add security section.

Browse Source
This commit is contained in:
Sean Starkey
2026-06-02 10:29:58 -06:00
parent a1e148f2ee
commit ff70912e31
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
README.md
View File

@@ -61,6 +61,16 @@ JWT_SECRET=dev-secret-change-me-do-not-use-in-production mvn spring-boot:run
- The service returns structured error responses for application-level failures so clients can handle validation, authentication, authorization, and conflict cases predictably. - The service returns structured error responses for application-level failures so clients can handle validation, authentication, authorization, and conflict cases predictably.
- This implementation favors clarity over extra infrastructure. Features such as refresh tokens, token revocation, audit logging, pagination, rate limiting, and OpenAPI generation would be good production follow-ups. - This implementation favors clarity over extra infrastructure. Features such as refresh tokens, token revocation, audit logging, pagination, rate limiting, and OpenAPI generation would be good production follow-ups.
## Security considerations
- Passwords are hashed with BCrypt before being persisted. Plaintext passwords are accepted only in registration/login request bodies and are never returned by the API.
- Authentication uses JWT bearer tokens. Protected endpoints require an `Authorization: Bearer <token>` header.
- The JWT signing secret is supplied through configuration. The local development value should not be used in production; production deployments should load it from an environment variable or secret manager.
- Access control is enforced in the service layer. Users can read and modify only their own notes unless a note has been explicitly shared with them.
- Shared notes are read-only for recipients. Only the owner can update, delete, or share a note.
- The API returns `404 Not Found` for another user's unshared note so callers cannot distinguish between a missing note and a note they are not allowed to see.
- Production deployments should run behind HTTPS, avoid logging credentials or tokens, and consider token expiration, rotation, revocation, rate limiting, and audit logging.
## Testing ## Testing
The automated tests run with Spring Boot, MockMvc, Spring Security, JPA, validation, and Flyway-backed H2 enabled. This keeps the tests close to real API behavior while still making them fast enough to run locally. The automated tests run with Spring Boot, MockMvc, Spring Security, JPA, validation, and Flyway-backed H2 enabled. This keeps the tests close to real API behavior while still making them fast enough to run locally.