Security, Auth & Rate Limiting
Relevant source files
The following files were used as context for generating this wiki page:
The Security, Auth & Rate Limiting systems in ALwrity provide a multi-layered defense and access control mechanism for the AI-powered digital marketing platform. This system ensures secure interactions between the React frontend and the FastAPI backend, manages sensitive AI provider credentials, and protects internal services from abuse through intelligent request management.
The architecture is built on a multi-tenant framework that supports JWT-based authentication and OAuth2 protocols for third-party integrations. These security measures are critical for protecting user data, preventing unauthorized access to AI models, and maintaining the integrity of content generation workflows.
Sources: README.md, backend/README.md, SETUP_GUIDE.md
Authentication & Multi-Tenancy
ALwrity utilizes a JWT-based multi-tenant authentication system. This allows the platform to segregate data and access permissions across different users and organizations, ensuring that content strategies and API keys remain private to the authorized tenant.
Core Authentication Components
- JWT & OAuth2: The backend implements standard JSON Web Tokens and OAuth2 flows for secure session management.
- Tenant Isolation: Data models are designed to be "PostgreSQL ready" to support robust multi-tenant data separation.
- Onboarding Security: A dedicated onboarding wizard handles the initial security setup, including API key validation and website verification.
Sources: README.md:27-33, backend/README.md:73-86, SETUP_GUIDE.md:200-210
The diagram above illustrates the typical authentication flow where a JWT is issued to a user and validated against tenant-specific records in the database.
Sources: backend/README.md, SETUP_GUIDE.md
API Key & Credential Management
ALwrity acts as an orchestrator for multiple AI providers (OpenAI, Google Gemini, Anthropic, Mistral). Consequently, secure management of these third-party credentials is a primary security feature.
API Key Management Features
- Key Validation: The system includes endpoints to validate keys directly with providers (e.g., OpenAI) before saving them.
- Secure Storage: Credentials are managed via the
api_key_manager.pyservice. - Provider Isolation: Each provider (Twitter, WordPress, Wix) has specific configuration schemas for API secrets and access tokens.
Sources: backend/README.md:37-40, SETUP_GUIDE.md:88-95, ToBeMigrated/integrations/platform_adapters/README.md:65-95
| Provider | Configuration Fields | Validation Endpoint |
|---|---|---|
| OpenAI | api_key | POST /api/onboarding/providers/openai/validate |
api_key, api_secret, access_token, access_token_secret | Internal Manager Validation | |
| WordPress | site_url, username, application_password | Application Password Verification |
| Wix | site_id, api_key, access_token | API Key Verification |
Sources: SETUP_GUIDE.md:100-110, ToBeMigrated/integrations/platform_adapters/README.md:65-95
Rate Limiting & Performance Security
The platform implements intelligent rate limiting to prevent denial-of-service (DoS) attacks and to manage the costs associated with high-volume AI API calls.
Intelligent Request Management
- Streaming Exemptions: The backend supports intelligent rate limiting that can exempt specific streaming endpoints (like AI text generation) to ensure a smooth user experience while still protecting standard REST endpoints.
- Enterprise Features: Planned enterprise features include granular API rate limiting and white-label support for customizable branding.
- Timeout Handling: Security analysis components (like the SEO Analyzer) implement strict timeout settings to prevent resource exhaustion during long-running network requests.
Sources: README.md:32, backend/services/seo_analyzer/README.md:46, 216-222
This flowchart describes the logic used to differentiate between standard requests and streaming AI responses for rate limiting purposes.
Sources: README.md:32, backend/services/seo_analyzer/README.md
Technical SEO & Network Security
ALwrity includes specialized components for analyzing and enforcing technical security standards for web content created or analyzed by the platform.
Security Headers Analysis
The SecurityHeadersAnalyzer evaluates web targets for the presence of defensive HTTP headers. These checks protect against common web vulnerabilities like Cross-Site Scripting (XSS) and Clickjacking.
| Header | Security Purpose |
|---|---|
Strict-Transport-Security | Enforces HTTPS communication |
Content-Security-Policy | Prevents unauthorized script execution (XSS defense) |
X-Frame-Options | Protects against Clickjacking |
X-Content-Type-Options | Prevents MIME-type sniffing |
X-XSS-Protection | Enables browser-side XSS filters |
Sources: backend/services/seo_analyzer/README.md:175-185
Implementation Detail: SEO Analyzer Security
# Configuration for Security Analysis
TIMEOUT_SETTINGS = {
"html_fetching": 30, # seconds
"security_headers": 15,
"performance_analysis": 20
}
Sources: backend/services/seo_analyzer/README.md:216-220
Conclusion
The security architecture of ALwrity is designed to balance user convenience with enterprise-grade protection. By combining JWT-based multi-tenancy with strict API key validation and intelligent rate limiting, the platform provides a secure environment for content strategy and AI generation. Furthermore, the inclusion of technical security analyzers ensures that the content produced is not only optimized for search engines but also adheres to modern web security standards.
Sources: README.md, backend/README.md, backend/services/seo_analyzer/README.md