Skip to content

SECURITY_OPERATIONS_GUIDE.md

Latest commit

 

History

History
196 lines (153 loc) · 6.61 KB

SECURITY_OPERATIONS_GUIDE.md

File metadata and controls

196 lines (153 loc) · 6.61 KB
Raw

🔒 Security & Operations Guide - RaJA Ticketing System

🚨 CRITICAL - Pre-Event Security Checklist

1. Environment Variables Verification

# Check all required environment variables are set
curl https://qhpnjpjotcehjabfdovp.supabase.co/functions/v1/health_check

Required Variables:

  • ✅ SUPABASE_URL - Database connection
  • ✅ SUPABASE_SERVICE_ROLE_KEY - Database admin access
  • ✅ ENTRY_JWT_SECRET - Token signing (keep secret!)
  • ✅ ENTRY_ADMIN_PIN - Check-in PIN (6 digits recommended)
  • ✅ RESEND_API_KEY - Email service
  • ✅ ALLOWED_FROM - Email sender validation
  • ✅ PUBLIC_APP_URL - Frontend URL for links

2. Security Features Implemented

Input Validation & Sanitization

  • ✅ JWT token format validation (3-part base64url)
  • ✅ Email format validation (RFC 5321 compliant)
  • ✅ PIN format validation (6 digits only)
  • ✅ Row hash validation (alphanumeric, 10-128 chars)
  • ✅ URL validation (HTTPS/HTTP only)
  • ✅ Request size limits (10KB max)

Rate Limiting & Abuse Prevention

  • ✅ General rate limiting: 100 requests/minute per IP
  • ✅ PIN rate limiting: 5 attempts per IP/token combo
  • ✅ Account lockout: 15-minute lockout after failed PIN attempts
  • ✅ Bot detection: Basic user-agent filtering
  • ✅ Request size limits: Prevents DoS via large payloads

Authentication & Authorization

  • ✅ Admin endpoints: Require valid user authentication
  • ✅ Public endpoints: Only entry pass resolution
  • ✅ Service role: Database access with proper permissions
  • ✅ CORS protection: Configurable origin whitelist

Secure Logging & Monitoring

  • ✅ Production logging: No sensitive data exposure
  • ✅ Security events: Failed PIN attempts, rate limits
  • ✅ Error handling: Generic errors in production
  • ✅ Audit trail: Partial IP logging for check-ins

🎯 Day-of-Event Operations

1. Pre-Event Setup (2 hours before)

System Health Check

# 1. Verify all systems are healthy
curl https://qhpnjpjotcehjabfdovp.supabase.co/functions/v1/health_check

# 2. Test entry pass generation
# (Use admin panel to generate a test pass)

# 3. Test entry pass resolution
# (Click the test pass link)

# 4. Test check-in functionality
# (Use the admin PIN to check in the test pass)

Load Testing (Optional but Recommended)

# Test with multiple concurrent requests
for i in {1..10}; do
  curl -X POST https://qhpnjpjotcehjabfdovp.supabase.co/functions/v1/entry_pass \
    -H "Content-Type: application/json" \
    -H "apikey: YOUR_ANON_KEY" \
    -d '{"action": "resolve", "token": "TEST_TOKEN"}' &
done
wait

2. During Event Operations

Real-time Monitoring

  • 🔍 Health check endpoint: GET /functions/v1/health_check
  • 📊 Supabase Dashboard: Monitor function invocations and errors
  • 📱 Check-in dashboard: Monitor real-time attendance

Common Issues & Solutions

Issue Symptoms Solution
Rate limiting triggered 429 errors Wait 1 minute, or contact admin to reset
PIN lockout "Account locked" message Wait 15 minutes or reset via admin
Database connection issues 500 errors in health check Check Supabase status
Email delivery issues No entry pass emails Check Resend service status

Emergency Procedures

If Entry Pass System Fails:

  1. Backup check-in method: Use participant list CSV export
  2. Manual verification: Cross-reference names with registration data
  3. Emergency PIN reset: Update ENTRY_ADMIN_PIN environment variable

If Database is Down:

  1. Check Supabase status page
  2. Use exported participant lists as backup
  3. Record manual check-ins for later sync

3. Security Incident Response

Suspicious Activity Indicators

  • Multiple failed PIN attempts from same IP
  • High rate of requests from single IP
  • Unusual geographic access patterns
  • Requests with malformed tokens

Incident Response Steps

  1. Identify: Monitor logs for security events
  2. Contain: Rate limiting will auto-block suspicious IPs
  3. Investigate: Check function logs in Supabase dashboard
  4. Respond: Update security settings if needed
  5. Document: Record incidents for post-event review

🛡️ Security Best Practices

Environment Security

  • ✅ All secrets stored in Supabase environment variables
  • ✅ No hardcoded credentials in code
  • ✅ Service role key has minimal required permissions
  • ✅ JWT secret is cryptographically strong

Network Security

  • ✅ HTTPS enforced for all communications
  • ✅ CORS properly configured
  • ✅ No sensitive data in URLs or logs

Data Protection

  • ✅ Minimal data collection and storage
  • ✅ Participant data access restricted to admins
  • ✅ Check-in records include timestamp and partial IP
  • ✅ No payment information stored

📊 Performance & Scalability

Current Capacity

  • Concurrent users: 700+ supported
  • Rate limits: 100 requests/minute per IP
  • Database: Supabase handles high concurrent reads
  • Email delivery: Resend API handles bulk sending

Scaling Considerations

  • If >1000 concurrent users: Increase rate limits
  • If email delivery slow: Implement queue system
  • If database slow: Add read replicas (Supabase Pro)

🔧 Maintenance & Updates

Regular Maintenance

  • Weekly: Check health endpoint status
  • Monthly: Review security logs for patterns
  • Quarterly: Update dependencies and review security

Emergency Updates

# Deploy security fix
supabase functions deploy entry_pass

# Update environment variable
supabase secrets set VARIABLE_NAME="new_value"

📞 Emergency Contacts & Resources

Service Status Pages

Key URLs

✅ Security Hardening Completed

Your entry pass system is now production-ready with:

  • 🔒 Comprehensive input validation
  • 🛡️ Multi-layer rate limiting
  • 🚫 Attack prevention measures
  • 📊 Real-time monitoring
  • 🔍 Security audit logging
  • 🚨 Emergency procedures

The system is ready for 700+ participants! 🎉