Web and input security
Treat every browser value, route identifier, file, API header, webhook, and generated link as untrusted until the server validates it in context.
Security · Add a ServiceStack API
Request validation
ServiceStack DTOs use declarative validation for required values, email, ranges, and positive units. Services add domain validation, role/capability checks, tenant predicates, current subscription state, idempotency, and database constraints.
Use allow-lists for enum-like values, currency, file extensions, callback destinations, and provider event types. Keep error codes stable and avoid revealing whether a cross-tenant resource exists.
Parameterize all database access through OrmLite or provider APIs. Never build SQL, filesystem paths, HTML, shell commands, or provider URLs by concatenating untrusted values.
Browser security
React escapes rendered strings by default; avoid dangerouslySetInnerHTML for customer content. Razor encodes output by default. When rendering maintained Markdown, keep the parser/configuration free of arbitrary scripts and review any future raw-HTML support.
ASP.NET Core Razor forms use antiforgery conventions. Cookie-authenticated mutations under /saas additionally require a same-origin Origin or Referer; missing or foreign origins return CsrfValidationFailed. API-key requests are exempt from the browser check and authenticate independently. Configure Security.RequireSameOriginForCookieApi, and verify cookie Secure, HttpOnly, SameSite, lifetime, and sign-out behavior in the deployed environment.
The host enables HTTPS redirection and HSTS in Production. Configure.Security.cs also applies CSP, frame denial, nosniff, strict-origin referrer policy, restricted camera/microphone/geolocation permissions, and cross-origin opener isolation. The compatible default CSP permits inline scripts/styles for the static Next.js and existing UI output; tighten it with hashes/nonces when the derived application can support them. Override Security.ContentSecurityPolicy when adding a deliberate external origin.
ServiceStack's built-in operator UIs are Vue applications that compile templates at runtime with new Function(), which CSP treats as eval. They therefore need 'unsafe-eval', which the customer-facing policy deliberately withholds. Security.ToolingPaths lists the paths that receive the relaxed policy, defaulting to /admin-ui, /ui, and /metadata; every other route keeps the strict policy unchanged. The relaxed policy is derived from Security.ContentSecurityPolicy by adding 'unsafe-eval' to its script-src so the two cannot drift apart, and Security.ToolingContentSecurityPolicy overrides that derivation. Path matching is by segment, so /admin-uix is not treated as /admin-ui.
Do not add 'unsafe-eval' to the main policy to fix an operator UI. That would extend eval to the customer-facing application, which is the surface actually exposed to untrusted content.
Restrict AllowedHosts and CORS origins. Do not use wildcard credentialed CORS. The static Next.js export does not need a separate public Node server in Production.
Upload and download safety
- Enforce request/body and configured file-size limits while streaming.
- Generate opaque object keys; never join user filenames to storage paths.
- Validate content when the product will parse or preview it.
- Scan untrusted files and quarantine pending results.
- Serve downloads with safe content disposition and type handling.
- Run document/PDF/media processors with constrained resources and no implicit network/credential access.
Abuse and availability
Apply layered limits at CDN/proxy, authentication, API credential, organization quota, queue admission, database, and provider boundaries. Set timeouts and maximum result/page sizes. Avoid unbounded exports, searches, fan-out, or background jobs.
Related documentation
Data protection and privacy
Protect customer data across transport, storage, logs, exports, support access, backups, retention, and deletion—not only in the primary database.
Production security review
Use this checklist as the final template-to-product review. It is not a certification and must be adapted to the product's data, jurisdictions, customers, integrations, and hosting model.