Skip to main content

Security Best Practices

Recommendations for securing your SyAuth integration.

Authentication​

Use HTTPS Everywhere​

Always use HTTPS in production:

# Production
NEXT_PUBLIC_SYAUTH_API_URL=https://api.syauth.com
NEXT_PUBLIC_SYAUTH_REDIRECT_URI=https://yourapp.com/auth/callback

Validate Redirect URIs​

Only allow exact redirect URI matches:

  • ✅ https://yourapp.com/auth/callback
  • ❌ https://yourapp.com/*

Use PKCE​

Always use PKCE for authorization code flow:

// The SDK handles this automatically
loginWithRedirect(); // PKCE enabled by default

Token Security​

Never Expose Tokens to Frontend​

// ❌ Wrong - Token in localStorage
localStorage.setItem('token', accessToken);

// ✅ Right - SDK handles secure storage
const { getAccessToken } = useSyAuth();

Validate Tokens Server-Side​

// Validate on every API request
const userInfo = await fetch('https://api.syauth.com/e/v1/oauth/userinfo', {
  headers: { 'Authorization': `Bearer ${accessToken}` }
});

if (!userInfo.ok) {
  // Token invalid - reject request
}

Use Short Token Lifetimes​

  • Access tokens: 1 hour (default)
  • Refresh tokens: 30 days
  • Let SDK handle automatic refresh

Credentials Management​

Environment Variables​

# Never commit secrets
echo "SYAUTH_CLIENT_SECRET=..." >> .env.local
echo ".env.local" >> .gitignore

Rotate Secrets Regularly​

  1. Generate new secret in Dashboard
  2. Update your application
  3. Deploy changes
  4. Old secret is immediately invalid

Separate Environments​

Development: client_id_dev, secret_dev
Staging:     client_id_stg, secret_stg
Production:  client_id_prd, secret_prd

API Security​

Use API Keys Server-Side Only​

// ✅ Server-side (API route)
const response = await fetch('https://api.syauth.com/e/v1/developer/users', {
  headers: { 'X-API-Key': process.env.SYAUTH_API_KEY }
});

// ❌ Never in client-side code

Rate Limit Your Own APIs​

// Implement rate limiting on your endpoints
import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100 // limit each IP to 100 requests per windowMs
});

Session Security​

The SDK uses secure cookie defaults:

FlagValuePurpose
HttpOnlytruePrevent JS access
SecuretrueHTTPS only
SameSiteLaxCSRF protection

Implement Idle Timeout​

// Logout after 30 minutes of inactivity
const IDLE_TIMEOUT = 30 * 60 * 1000;

useEffect(() => {
  let timeout = setTimeout(() => logout(), IDLE_TIMEOUT);
  
  const resetTimer = () => {
    clearTimeout(timeout);
    timeout = setTimeout(() => logout(), IDLE_TIMEOUT);
  };
  
  window.addEventListener('mousemove', resetTimer);
  return () => clearTimeout(timeout);
}, []);

Logging & Monitoring​

Monitor Authentication Events​

Watch for:

  • Multiple failed login attempts
  • Logins from unusual locations
  • Rapid token creation
  • Unusual API patterns

Audit Logs​

Review logs regularly in the Dashboard:

  1. Go to Logs
  2. Filter by event type
  3. Look for anomalies

Incident Response​

If Credentials Are Compromised​

  1. Immediately rotate client secret
  2. Revoke all active tokens
  3. Review recent activity logs
  4. Notify affected users if necessary

If Tokens Are Leaked​

  1. Revoke specific tokens via API
  2. Force re-authentication
  3. Review how leak occurred
  4. Implement additional protections

Checklist​

  • HTTPS enabled everywhere
  • PKCE enabled
  • Secrets in environment variables
  • Secrets not in version control
  • API keys server-side only
  • Token validation on every request
  • Logs monitored regularly
  • Incident response plan documented