Auth and Backend Security
Doris Infotech
A backend that stores customer data without a clear auth model is already a risk. Login is the visible part. The hard part is who can read which row, which action is allowed after the token is valid, and what happens when a token is stolen or expired.
Doris Infotech builds auth into the product from the first private endpoint. Sessions or tokens have a lifetime. Roles map to actions, not to hope. Secrets stay out of the repo. Input is treated as untrusted even when it comes from our own frontend.
Security that only exists in a policy document does not protect the API. Security that lives in the request path does.
Authenticate the caller. Authorize the action.
Knowing who is logged in is not enough. A user should not fetch another tenant’s records because the ID was in the URL. Check ownership and role on every sensitive read and write. Put that check in one place the team cannot skip - a policy helper, not a comment in the ticket.
Tokens and sessions need an end date
Long-lived tokens in local storage are convenient and dangerous. Prefer short access tokens, refresh with rotation, and revoke on logout and password change. HttpOnly cookies for web sessions reduce one class of theft. Document how clients store credentials so they do not invent a worse pattern.
Validate at the edge of the backend
Never trust body, query, or headers. Enforce types, lengths, and allowed values before they reach the database. Parameterized queries and an ORM used correctly beat string-built SQL. File uploads need type, size, and virus-aware handling - not a public folder that executes whatever arrives.
Secrets are not configuration comments
API keys, database URLs, and JWT secrets belong in the environment or a vault, rotated when people leave, and never committed. Different credentials for local, staging, and production. If a key leaked in a screenshot, treat it as burned.
Least privilege, everywhere it counts
The app database user should not be a superuser. Third-party tokens should scope to the job they do. Admin routes should not share the same middleware as public pages. Review access when a feature ships, not once a year. Least privilege is slower on day one and cheaper after the first incident you never have.
