Security Notes

The Provision Portal UI is a thin browser client. Most security controls (authentication, authorization, session management, data validation) are enforced by the Provision Portal backend; the UI must not be the only line of defence.

Transport

  • Enable HTTPS in production and provide a CA-issued certificate. The shipped Nginx config always listens on 443 and requires friendly.crt + friendly.key. See Installation & Deployment — TLS Certificate.

  • Redirect or firewall plain HTTP if required by your environment.

Backend trust boundary

  • The browser never calls the backend directly: it uses the same-origin /prov-api/ path, which Nginx proxies to FT_PROV_API_URL. This avoids CORS and keeps the backend address out of the browser.

  • FT_PROV_API_URL must point at a backend reachable from the container. Do not expose the raw backend to the public internet if it is meant to sit behind the UI proxy.

Session and token handling

  • On login, AuthService stores the auth token in sessionStorage (token). AuthInterceptor attaches it as Authorization: Bearer <token> to outgoing requests. sessionStorage is cleared on logout.

  • Tokens in sessionStorage are readable by any script running on the origin; keep the app free of untrusted third-party scripts and XSS sinks.

Client-side considerations

  • Rely on Angular’s built-in template sanitization; avoid rendering untrusted HTML (no unsanitized [innerHTML]).

  • Keep dependencies patched; run a dependency vulnerability scan (npm audit) in CI.

  • Do not log secrets or tokens.

Related pages