--
System Architecture (In Scope)
Components
| Component | Runtime/Host | Purpose |
|---|---|---|
| User Browser | User-controlled client | Initiates login/OAuth flows and holds authenticated session context |
| Web App | Next.js on Vercel | Authentication routes, OAuth initiation/callback handling, account settings |
| Supabase Auth + Postgres | Managed auth + database | Session issuance/validation, identity records, OAuth connection persistence |
| Google OAuth Endpoints | Google APIs | OAuth authorization code grant and token issuance |
In-Scope Data Stores
| Store | Purpose |
|---|---|
| Supabase | Auth identities, session context, OAuth connection records, profile identity data |
Trust Boundaries (Web Auth)
| ID | Boundary | Authentication | Transport |
|---|---|---|---|
| WB1 | Internet client to Web app | Supabase session tokens/JWT after login | TLS |
| WB2 | Web app to Supabase | Server-side trusted credentials + user session context | TLS |
| WB3 | Web app to Google OAuth | OAuth client credentials + PKCE/state controls | TLS |
| WB4 | Google OAuth callback to Web app | Signed OAuth response artifacts + state verification | TLS |
Data Classification (Web Auth)
| Classification | Examples | Storage | Encryption |
|---|---|---|---|
| Critical | OAuth access/refresh tokens, session tokens, auth secrets | Supabase + server-side secret storage | AES-256-GCM at rest for token fields, TLS in transit |
| Sensitive | User identity/profile attributes, OAuth connection metadata, granted scopes | Supabase | TLS in transit, ownership controls via RLS |
| Internal | Auth operational metadata and security event telemetry | Operational logging systems | TLS in transit |
STRIDE Analysis (Web Auth)
1. Spoofing
| Threat | Attack Vector | Impact | Mitigation | Status |
|---|---|---|---|---|
| User session spoofing | Forged/stolen session token | Unauthorized account access | Session validation on protected routes; short-lived access token model | Mitigated |
| OAuth callback spoofing | Forged OAuth callback parameters | Account linking hijack | Signed/validated OAuth state and callback verification controls | Mitigated |
2. Tampering
| Threat | Attack Vector | Impact | Mitigation | Status |
|---|---|---|---|---|
| OAuth token tampering at rest | Database record tampering | Unauthorized API access | Encrypted token storage (AES-256-GCM) with integrity properties | Mitigated |
| Auth request tampering | Modified request body/headers | Unauthorized auth behavior | Server-side validation, strict route handling, and TLS transport | Mitigated |
3. Repudiation
| Threat | Attack Vector | Impact | Mitigation | Status |
|---|---|---|---|---|
| User denies account-link action | Dispute over OAuth connection actions | Audit/compliance gap | Auth event logging with user/session attribution | Mitigated |
4. Information Disclosure
| Threat | Attack Vector | Impact | Mitigation | Status |
|---|---|---|---|---|
| Credential leakage in logs | Tokens/secrets exposed in logs/errors | Credential compromise | Secret redaction and policy of not logging credentials | Mitigated |
| Cross-user data disclosure | Broken authz or ownership checks | PII leakage | RLS ownership policies and server-side access enforcement | Mitigated |
5. Denial of Service
| Threat | Attack Vector | Impact | Mitigation | Status |
|---|---|---|---|---|
| Auth endpoint abuse | Brute force / request flooding | Login degradation or lockout abuse | Rate-limiting and anti-automation controls on auth-sensitive routes | Mitigated |
6. Elevation of Privilege
| Threat | Attack Vector | Impact | Mitigation | Status |
|---|---|---|---|---|
| Privilege escalation through auth context manipulation | Tampered user context | Unauthorized privileged actions | Trusted server-side context derivation and validation of auth attributes | Mitigated |
| Service credential compromise | Exposure of privileged server-side key | Broad data access | Secrets stored server-side only, operational rotation procedures | Mitigated |
| Weak password policy bypass | Low-strength credential acceptance | Account takeover risk | Minimum password length and secure password-change controls | Mitigated |