Security Documentation

RBAC v2

Policies in WafAuthorizationPolicies. Legacy roles (Admin, Operator, Viewer) remain as aliases during transition.

SOC analysts cannot create/edit rules or IP lists. Backup and user management require SuperAdmin.

CSRF policy

All browser-authenticated POST, PUT, PATCH, and DELETE actions on the management portal use [ValidateAntiForgeryToken] with ASP.NET Core Identity cookie auth.

Razor forms and AJAX must send RequestVerificationToken header or __RequestVerificationToken field. POST without token from an authenticated session returns 400 Bad Request.

Read-only JSON GET endpoints and anonymous /health are exempt. Machine integrations must use dedicated API keys — not cookie exemptions.

Secrets at rest

TOTP seeds and PFX passwords encrypted via IWafSecretProtector → ASP.NET Core Data Protection (purpose NestEnterpriseWaf.Secrets.v1).

• Ciphertext prefix: wafenc:v1:
• Key ring: App_Data/DataProtectionKeys (configure XML encryptor in production)
• Production bootstrap passwords from environment / secret store — not committed config

Tenant isolation

Single-tenant: Waf:DefaultTenantId. Multi-tenant SaaS: Waf:MultiTenant=true with EF global filters on scoped entities and ownership checks on mutations.

Edge & upstream

• TLS termination at WAF; optional upstream SSL to backends
• Backend target guard (SSRF protection on upstream URLs)
• Standard X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto to backends
• Static file upload blocklist for executable/server-side extensions
• Admin portal: optional dedicated domain + IP allowlist (AdminPortalAllowedCidrs)