Security
Security in Next SaaS is layered across ASP.NET Core Identity, ServiceStack request validation, organization context, role/capability policy, entitlements, quotas, audit, and deployment checks.
Guides
| Area | Guide |
|---|---|
| Login, confirmation, 2FA, invitations, and account lifecycle | Authentication and accounts |
| Organization and platform permissions | Authorization and roles |
| Preventing cross-customer access | Tenant isolation |
| API keys, scopes, quotas, and rate limiting | API credentials and abuse controls |
| Signed provider events and safe replay | Stripe webhook security |
| Time-limited operator access | Support access |
| Protected keys, logs, audit, export, and deletion | Data protection and privacy |
| Browser, request, upload, and response boundaries | Web and input security |
| Final threat-led release review | Production security review |
Security invariants
- The browser is never an authorization boundary.
- Every customer-owned lookup is constrained by resolved organization context.
- Organization roles and platform roles are separate.
- Stripe and SMTP secrets never enter the frontend bundle.
- Published plan state and local subscription projections drive access without live provider calls.
- Raw credentials and customer content do not belong in logs or audit metadata.
- Retried external and background work preserves its original idempotency boundary.
- Production readiness checks are a baseline, not a complete security assessment.
Perform a product-specific threat model before launch. Authentication methods, data sensitivity, compliance obligations, integrations, and hosting architecture can materially change the required controls.
Troubleshooting
Start with the customer-visible error, X-Request-Id, active organization, authenticated role, release revision, and UTC timestamp. Then correlate structured logs, audit events, product operations, and provider state.
Authentication and accounts
ASP.NET Core Identity owns users, password credentials, confirmation tokens, external-login records, two-factor state, recovery codes, and application cookies.