System Security Standards
Namaskar School utilizes end-to-end security measures, role-based access controls, encrypted token authentication, and SuperAdmin lockout protection.
1. JWT Authentication & Sessions
User sessions are protected using JSON Web Tokens (JWT) stored in HTTP-Only, SameSite cookies to protect against Cross-Site Scripting (XSS) and token theft.
2. Role-Based Access Control (RBAC)
Granular permissions check every route invocation (`staff:read`, `attendance:write`, `school:create`), ensuring users can only interact with authorized modules.
3. Password Hashing & Salts
Passwords are never stored in plain text. We utilize bcrypt salted hashing. Existing hashed user passwords are protected during migrations to prevent double-hashing.
4. Excel File Parser Safeguards
Drag-and-drop Excel files are validated for structural integrity, sanitized against injection vectors, and processed with sequential STF-ID generation.
5. Socket.io Real-Time Security
Real-time WebSocket event emitters (`staff_changed`, `attendance_changed`) run on authenticated handshakes with dynamic CORS origin verification.
6. Idempotent Data Governance
Database migrations and bulk operations are idempotent, preventing duplicate records, data corruption, or accidental admin lockouts.