Security Policy

Relevant source files

The following files were used as context for generating this wiki page:

• SECURITY.md
• README.md
• swagger/swagger.yml
• web/src/Setting.js
• web/src/ApplicationEditPage.js
• object/permission_enforcer.go
• web/src/auth/Provider.js

Casdoor is an AI-first Identity and Access Management (IAM) and Single-Sign-On (SSO) platform designed to provide a secure gateway for application authentication and authorization. The security policy encompasses vulnerability reporting, multi-factor authentication (MFA), certificate management, and robust access control models powered by Casbin.

Sources: README.md:1-5, web/src/Setting.js:1015-1025

Reporting a Vulnerability

The project maintains a strict policy for handling security disclosures to ensure user safety and timely remediation.

• Non-Public Reporting: Security vulnerabilities should not be reported directly on GitHub via public issues.
• Official Channel: Vulnerabilities must be reported via email to admin@casdoor.org.

Sources: SECURITY.md:1-12

Multi-Factor Authentication (MFA)

Casdoor supports multiple MFA methods to enhance account security. Organizations can enforce MFA requirements for their users through various levels of strictness: Required, Prompted, or Optional.

Supported MFA Methods

Method	Description
TOTP	Time-based One-Time Password using an Authenticator App.
SMS	Verification code sent via SMS providers.
Email	Verification code sent via configured Email providers.
RADIUS	Integration with RADIUS servers for enterprise authentication.

Sources: web/src/Setting.js:464-470, web/src/Setting.js:1025-1035, web/src/Setting.js:1095-1110

MFA Enforcement Flow

The system checks the user's MFA status and the organization's requirements during the login process.

Application Security Configuration

Administrators can configure granular security settings for each application to prevent brute-force attacks and control session lifecycles.

• Signin Protection: Includes failedSigninLimit (max attempts) and failedSigninFrozenTime (cooldown period in minutes).
• Session Management: Supports cookieExpireInHours and enableExclusiveSignin (prevents multiple active sessions).
• Verification Codes: Configurable codeResendTimeout to prevent spamming.
• Network Security: Support for IP Whitelisting at both application and organization levels.

Sources: web/src/ApplicationEditPage.js:345-365, web/src/ApplicationEditPage.js:655-675

Certificate and Signature Management

Casdoor utilizes public-key cryptography to sign JWT tokens and handle SAML assertions.

Cryptographic Algorithms

The system supports a wide range of algorithms for different security needs:

• RSA: RS256, RS384, RS512.
• ECDSA: ES256, ES384, ES512.
• RSASSA-PSS: PS256, PS384, PS512.

Proof Key for Code Exchange (PKCE)

For enhanced OAuth 2.0 security, Casdoor implements PKCE helper functions to generate and store code verifiers and challenges. This prevents authorization code injection attacks.

function generateCodeChallenge(verifier) {
  const hash = CryptoJS.SHA256(CryptoJS.enc.Utf8.parse(verifier));
  const base64Hash = CryptoJS.enc.Base64.stringify(hash);
  return base64Hash
    .replace(/\+/g, "-")
    .replace(/\//g, "_")
    .replace(/=/g, "");
}

Sources: web/src/auth/Provider.js:38-46, web/src/CertEditPage.js:150-175

Permission and Access Control

Authorization is managed via the Casbin enforcer, which applies models (ACL, RBAC, ABAC) to resources.

Enforcer Architecture

The Enforcer dynamically loads models and policies based on the specific permission configuration of an organization.

Conclusion

Casdoor's security policy provides a multi-layered defense strategy combining standardized authentication protocols (OAuth 2.1, OIDC, SAML), strong encryption, and flexible MFA enforcement. By leveraging the Casbin library for authorization, it ensures that access control is both scalable and technically robust.

Sources: README.md:1-5, object/permission_enforcer.go:210-230