security-patterns

Security Patterns for Web Applications

Security patterns and practices for building secure ABP Framework applications.

When to Use

• Conducting security audits
• Implementing authentication/authorization
• Creating threat models (STRIDE)
• Reviewing code for OWASP Top 10 vulnerabilities
• Designing permission systems
• Validating input and sanitizing output

STRIDE Threat Model

Framework

Category	Threat	Question	Mitigation
Spoofing	Identity theft	Can attacker impersonate user?	Authentication, tokens
Tampering	Data modification	Can attacker modify data?	Integrity checks, signing
Repudiation	Denial of actions	Can user deny their actions?	Audit logging
Information Disclosure	Data exposure	Can attacker access sensitive data?	Encryption, access control
Denial of Service	Availability attack	Can attacker disrupt service?	Rate limiting, scaling
Elevation of Privilege	Unauthorized access	Can attacker gain higher privileges?	Authorization, least privilege

Threat Model Template

## Threat Model: [Feature Name]

**Date**: YYYY-MM-DD
**Reviewer**: [Name]

### Assets
| Asset | Sensitivity | Description |
|-------|-------------|-------------|
| Patient Data | HIGH | PII including medical records |
| User Credentials | CRITICAL | Passwords, tokens |
| Appointment Data | MEDIUM | Scheduling information |

### Threat Analysis
| ID | Category | Threat | Likelihood | Impact | Risk | Mitigation |
|----|----------|--------|------------|--------|------|------------|
| T1 | Spoofing | Attacker impersonates patient | Medium | High | HIGH | OAuth 2.0, MFA |
| T2 | Tampering | Attacker modifies appointment | Low | Medium | LOW | Authorization checks |
| T3 | Info Disclosure | Unauthorized patient data access | Medium | Critical | CRITICAL | Row-level security |
| T4 | Elevation | Receptionist gains admin access | Low | Critical | HIGH | Permission validation |

### Mitigations
| ID | Threat | Control | Status |
|----|--------|---------|--------|
| M1 | T1 | Implement OAuth 2.0 with OpenIddict | Implemented |
| M2 | T3 | Add row-level authorization in AppService | Pending |