Application security and authorization¶
Authentication¶
The application runs in-process under IIS. The only checked-in web-server authentication setting is the local launch profile in Properties/launchSettings.json (Windows authentication on, anonymous authentication off, IIS Express); it describes local development only. web.config carries no production authentication settings, so production hosting authentication, including whether the external-facing site permits anonymous access at the web server, is not confirmed by this repository. The application relies on the inherited OIDC start-up chain from SAIF.NetCore.ServiceExtensions †. A user is treated as external when the domain of the identity name is not SAIF (INH-004) †. The application declares no authentication scheme of its own; the scheme configuration lives in the inherited start-up chain.
Authorization model¶
Authorization has three layers.
| Layer | Mechanism | Enforced by |
|---|---|---|
| Page gate | [SecurityApiAuthorize] with four roles, OR semantics (BR-APP-001, INH-009) † |
Package, remote Security API |
| Capability flags | Flags derived per request (BR-APP-003) | Application, UI only |
| Policy access | AccessAllowed from the base page model (INH-002) † |
View condition (BR-SCR-011) |
Roles¶
| Role | Effect |
|---|---|
NonDisReimbViewResource |
Internal read-only |
NonDisReimbUpdateResource |
Internal updater |
NonDisReimbViewExtResource |
External read-only |
NonDisReimbUpdateExtResource |
External updater (cannot change policy context, BR-APP-004) |
Information Technology Div, IT CSI Contractors |
Internal IT flag, used for developer-access options |
DocCoreApiUserResource |
CanPrint flag, not enforced (TD-APP-004) |
Handler matrix¶
| Handler | Server-side role check | Anti-forgery | UI visibility |
|---|---|---|---|
| Update reimbursements | Page gate only | Disabled | External updaters (IsPolicyHolder, set from IsExternalUpdater), on editable claims |
| Pay online | Page gate only | Disabled | External updaters (HasReimburableClaims: editable claims and IsPolicyHolder) |
| Pay by mail | Page gate only | Disabled | External updaters (HasReimburableClaims: editable claims and IsPolicyHolder) |
| Download statement | Page gate only (CanPrint not checked) |
Disabled | Any user who can see the statement view (the view does not check CanPrint) |
| Reimburse all | Page gate only | Disabled | External updaters when reimbursable claims exist (HasReimburableClaims, BR-SCR-006) |
| Due date | Page gate only | Disabled | Internal updaters |
| Delete statement | Page gate only | Disabled | Internal updaters |
| Reload context, policy number, statement | Page gate only | Disabled | Users who may change context (BR-APP-004) |
| Developer access | Page gate only | Disabled | Form commented out (BR-APP-005) |
Anti-forgery posture¶
Anti-forgery validation is disabled on every POST handler by [IgnoreAntiforgeryToken] (BR-APP-006), so all eight state-changing handlers are exposed to cross-site request forgery. The screen scripts send no anti-forgery token (TD-APP-001).
Package-enforced security behavior¶
- Role evaluation runs through a remote Security API; a failed response throws (INH-011) † and Windows users always evaluate remotely (INH-012) †. The domain is stripped before the call (INH-010) †.
- External users see only associated policies (INH-005) †.
- The
BolContextcookie lasts ten seconds and has noSecureorSameSiteattribute (INH-008) †. - Policy access is a soft check that handlers do not honor (INH-002) †.
Input handling¶
The application reads raw form values, validates nothing through ModelState (TD-APP-012) and trusts client-supplied UserName, maxAmount and policyNum (TD-APP-005, TD-APP-006). Cross-origin headers in web.config allow credentials for http://localhost (TD-APP-011). No secrets are committed.
Security findings¶
The security findings are listed in Tech debt: TD-APP-001 to TD-APP-006 and TD-APP-011.
Note: Statements marked with
†are derived from dependency library documentation via the Legends CLI. Statements marked with**could not be confirmed; treat as unknown until verified.
Related documentation¶
- Application index
- Overview
- Architecture
- Dependencies
- Configuration
- Operations and processes
- Business rules
- Data model
- Hosted endpoints
- Tech debt
Sources¶
- src/NDReimbursementWebApp/Pages/NDReimbursement.cshtml.cs
- src/NDReimbursementWebApp/Pages/NDReimbursement.cshtml
- src/NDReimbursementWebApp/Startup.cs
- src/NDReimbursementWebApp/web.config
- src/NDReimbursementWebApp/Properties/launchSettings.json