---
title: Application security and authorization
summary: Authentication, role-based authorization, per-handler anti-forgery posture and package-enforced security behavior of NDReimbursementWebApp.
status: generated
owner: SAIF Case Management
last_reviewed: 2026-10-20
---

# Application security and authorization

## Authentication

The application runs in-process under IIS. The only checked-in web-server authentication setting is the local launch profile in `Properties/launchSettings.json` (Windows authentication on, anonymous authentication off, IIS Express); it describes local development only. `web.config` carries no production authentication settings, so production hosting authentication, including whether the external-facing site permits anonymous access at the web server, is not confirmed by this repository**. The application relies on the inherited OIDC start-up chain from `SAIF.NetCore.ServiceExtensions` †. A user is treated as external when the domain of the identity name is not `SAIF` ([INH-004](business-rules.md#inh-004)) †. The application declares no authentication scheme of its own; the scheme configuration lives in the inherited start-up chain**.

## Authorization model

Authorization has three layers.

| Layer | Mechanism | Enforced by |
| --- | --- | --- |
| Page gate | `[SecurityApiAuthorize]` with four roles, OR semantics ([BR-APP-001](business-rules.md#br-app-001), [INH-009](business-rules.md#inh-009)) † | Package, remote Security API |
| Capability flags | Flags derived per request ([BR-APP-003](business-rules.md#br-app-003)) | Application, UI only |
| Policy access | `AccessAllowed` from the base page model ([INH-002](business-rules.md#inh-002)) † | View condition ([BR-SCR-011](business-rules.md#br-scr-011)) |

### Roles

| Role | Effect |
| --- | --- |
| `NonDisReimbViewResource` | Internal read-only |
| `NonDisReimbUpdateResource` | Internal updater |
| `NonDisReimbViewExtResource` | External read-only |
| `NonDisReimbUpdateExtResource` | External updater (cannot change policy context, [BR-APP-004](business-rules.md#br-app-004)) |
| `Information Technology Div`, `IT CSI Contractors` | Internal IT flag, used for developer-access options |
| `DocCoreApiUserResource` | `CanPrint` flag, not enforced (TD-APP-004) |

### Handler matrix

| Handler | Server-side role check | Anti-forgery | UI visibility |
| --- | --- | --- | --- |
| Update reimbursements | Page gate only | Disabled | External updaters (`IsPolicyHolder`, set from `IsExternalUpdater`), on editable claims |
| Pay online | Page gate only | Disabled | External updaters (`HasReimburableClaims`: editable claims and `IsPolicyHolder`) |
| Pay by mail | Page gate only | Disabled | External updaters (`HasReimburableClaims`: editable claims and `IsPolicyHolder`) |
| Download statement | Page gate only (`CanPrint` not checked) | Disabled | Any user who can see the statement view (the view does not check `CanPrint`) |
| Reimburse all | Page gate only | Disabled | External updaters when reimbursable claims exist (`HasReimburableClaims`, [BR-SCR-006](business-rules.md#br-scr-006)) |
| Due date | Page gate only | Disabled | Internal updaters |
| Delete statement | Page gate only | Disabled | Internal updaters |
| Reload context, policy number, statement | Page gate only | Disabled | Users who may change context ([BR-APP-004](business-rules.md#br-app-004)) |
| Developer access | Page gate only | Disabled | Form commented out ([BR-APP-005](business-rules.md#br-app-005)) |

## Anti-forgery posture

Anti-forgery validation is disabled on every POST handler by `[IgnoreAntiforgeryToken]` ([BR-APP-006](business-rules.md#br-app-006)), so all eight state-changing handlers are exposed to cross-site request forgery. The screen scripts send no anti-forgery token (TD-APP-001).

## Package-enforced security behavior

- Role evaluation runs through a remote Security API; a failed response throws ([INH-011](business-rules.md#inh-011)) † and Windows users always evaluate remotely ([INH-012](business-rules.md#inh-012)) †. The domain is stripped before the call ([INH-010](business-rules.md#inh-010)) †.
- External users see only associated policies ([INH-005](business-rules.md#inh-005)) †.
- The `BolContext` cookie lasts ten seconds and has no `Secure` or `SameSite` attribute ([INH-008](business-rules.md#inh-008)) †.
- Policy access is a soft check that handlers do not honor ([INH-002](business-rules.md#inh-002)) †.

## Input handling

The application reads raw form values, validates nothing through `ModelState` (TD-APP-012) and trusts client-supplied `UserName`, `maxAmount` and `policyNum` (TD-APP-005, TD-APP-006). Cross-origin headers in `web.config` allow credentials for `http://localhost` (TD-APP-011). No secrets are committed.

## Security findings

The security findings are listed in [Tech debt](tech-debt.md): TD-APP-001 to TD-APP-006 and TD-APP-011.

> **Note:** Statements marked with `†` are derived from dependency library
> documentation via the Legends CLI. Statements marked with `**` could
> not be confirmed; treat as unknown until verified.

## Related documentation
- [Application index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Data model](data-model.md)
- [Hosted endpoints](hosted-endpoints.md)
- [Tech debt](tech-debt.md)

## Sources
- src/NDReimbursementWebApp/Pages/NDReimbursement.cshtml.cs
- src/NDReimbursementWebApp/Pages/NDReimbursement.cshtml
- src/NDReimbursementWebApp/Startup.cs
- src/NDReimbursementWebApp/web.config
- src/NDReimbursementWebApp/Properties/launchSettings.json