threat-modeling

Threat Modeling with STRIDE

Core Principle

Threat modeling is a structured way to think about what can go wrong with a system's security before an attacker finds out. Do it during design, not after launch. The STRIDE framework gives you six categories of threats to systematically evaluate.

---

When to Threat Model

• Before building any new service or feature that handles user data.
• When adding a new external integration or API.
• When changing authentication or authorization logic.
• When introducing a new data store or data flow.
• During design document review (see the design-documents skill).
• At least annually for existing critical services.

---

The STRIDE Framework

S -- Spoofing (Pretending to Be Someone Else)

Question to ask: "Can an attacker pretend to be another user, service, or component?"

What to verify:

• All API endpoints require authentication (no accidental public endpoints).
• Authentication tokens are validated on every request, not just at login.
• Service-to-service calls use mutual TLS or signed tokens, not shared secrets.
• Email/SMS-based verification prevents account takeover.
• OAuth redirect URIs are strictly validated (no open redirects).
• API keys are scoped to specific permissions, not full access.

Common mitigations:

• Use strong authentication (OAuth 2.0 + PKCE, SAML, or WebAuthn).
• Implement multi-factor authentication for sensitive operations.
• Use short-lived tokens (15 min access tokens, longer refresh tokens).
• Validate the aud (audience) claim in JWTs to prevent token reuse across services.
• Rotate API keys and credentials on a schedule.

// Verify JWT on every request -- not just presence but validity
function authenticateRequest(req: Request): User {
  const token = req.headers['authorization']?.replace('Bearer ', '');
  if (!token) throw new AuthError('Missing authentication token');

  const payload = jwt.verify(token, publicKey, {
    algorithms: ['RS256'],
    audience: 'api.myservice.com',     // Prevent token reuse from other services
    issuer: 'auth.mycompany.com',      // Verify who issued the token
  });

  return { id: payload.sub, roles: payload.roles };
}