Security Configuration

JWT Secrets

JWT signing keys are used for Micronaut Security integration. In production, set them via environment variables:

export JWT_SECRET="your-64-char-secret-key-here"
export JWT_REFRESH_SECRET="your-64-char-refresh-secret-key-here"

Warning

Never commit real secret values. The defaults in application.yml are for development only.

Token Configuration

Property	Default	Description
`micronaut.security.token.name`	`Authorization`	Header name
`micronaut.security.token.jwt.signatures.secret.default.secret`	`${JWT_SECRET:...}`	Signing secret
`micronaut.security.token.jwt.generator.refresh-token.secret`	`${JWT_REFRESH_SECRET:...}`	Refresh token secret

CORS Configuration

micronaut:
  server:
    cors:
      enabled: true
      configurations:
        web:
          allowed-origins-regex: .*       # Restrict in production
          allowed-methods: [POST, PUT, GET, DELETE, OPTIONS]
          allowed-headers: [Content-Type, Authorization, X-Requested-With]
          expose-headers: [Content-Type, Authorization]
          allow-credentials: false

Note

The current CORS configuration (.* origin regex) is permissive and intended for local development only. For production, restrict allowed-origins-regex to your domain.

Security Headers

security-headers:
  content-security-policy: "default-src 'self'"
  x-content-type-options: nosniff
  x-frame-options: DENY
  strict-transport-security: "max-age=31536000; includeSubDomains"

Header	Value	Purpose
Content-Security-Policy	`default-src 'self'`	Prevent XSS
X-Content-Type-Options	`nosniff`	Prevent MIME sniffing
X-Frame-Options	`DENY`	Prevent clickjacking
Strict-Transport-Security	`max-age=31536000`	Force HTTPS

Rate Limiting

rate-limit:
  enabled: true
  max-requests-per-window: 100
  window-ms: 60000

Sliding window rate limiting per IP address. Exceeding the limit returns HTTP 429.

Password Hashing

Passwords are hashed using PBKDF2 with SHA-256. The system supports automatic upgrade of legacy hash formats when a user successfully logs in.

Production Checklist

Set JWT_SECRET and JWT_REFRESH_SECRET via environment variables
Restrict allowed-origins-regex to your domain
Set DB_URL, DB_USERNAME, DB_PASSWORD via environment variables
Disable H2 web console (h2.web-console: false)
Enable HTTPS via reverse proxy (nginx, Caddy, etc.)
Review rate limiting settings for your traffic patterns

#Security Configuration

#JWT Secrets

#Token Configuration

#CORS Configuration

#Security Headers

#Rate Limiting

#Password Hashing

#Production Checklist