This document outlines the security architecture implemented in the Work Plan Portal, aligned with OWASP Top 10 (2021), SOC 2 Type II, and UAE Information Assurance Standards (IAS).

The portal supports enterprise Single Sign-On (SSO) via OAuth 2.1 with PKCE (Proof Key for Code Exchange).

Set the following environment variables for SSO integration:

The SSO module is designed to work with:

• Microsoft Entra ID (Azure AD) - Recommended for UAE government entities
• Okta / Auth0 - Enterprise identity platforms
• Keycloak - Open-source identity management
• Custom OIDC - Any OpenID Connect compliant provider

1. User clicks "تسجيل الدخول عبر SSO"
2. PKCE code verifier and challenge are generated client-side
3. Browser redirects to Identity Provider with code challenge
4. User authenticates (with MFA if configured)
5. IdP redirects back with authorization code
6. Client exchanges code + verifier for tokens (no client secret exposed)
7. Access token used for API calls; refresh token for silent renewal
8. Session created with encrypted storage and fingerprinting

Set devMode={true} in AuthProvider (App.tsx) to bypass SSO during development. A demo user with entity_admin role is automatically created.

Implementation: Role-Based Access Control (RBAC) with five roles:

Components:

• ProtectedRoute - Route-level access enforcement
• PermissionGate - Component-level conditional rendering
• useAuth().hasPermission() - Programmatic permission checks

Implementation: AES-256 encryption for sensitive localStorage data via SecureStorage:

• All session data encrypted at rest
• HMAC-SHA256 integrity verification prevents tampering
• Browser fingerprint-derived encryption keys
• No sensitive data in URL parameters

Implementation: Multi-layer input sanitization via InputSanitizer:

• DOMPurify for HTML content sanitization
• Pattern-based XSS detection (15+ attack vectors)
• SQL injection pattern detection
• Input length enforcement
• Null byte and control character stripping
• Arabic text preserved while blocking malicious content

Implementation: Security-by-default architecture:

• All routes protected by default (explicit public routes only)
• Input validation at component level
• Rate limiting on sensitive actions
• Secure defaults for all configuration

Implementation: Content Security Policy (CSP) + Security Headers:

• Content-Security-Policy - Restricts resource loading
• X-Frame-Options: DENY - Prevents clickjacking
• X-Content-Type-Options: nosniff - Prevents MIME sniffing
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy - Disables unused browser APIs

Implementation: Enterprise-grade session management:

• OAuth 2.1 with PKCE (no implicit flow)
• Automatic token refresh before expiry
• 30-minute idle session timeout
• 8-hour absolute session timeout
• Session fingerprinting (anti-hijack)
• Concurrent session detection
• Secure session storage with encryption

Implementation: Data integrity verification:

• HMAC-SHA256 on all stored data
• Tamper detection with automatic invalidation
• Audit trail for all data modifications
• Subresource Integrity (SRI) support for external resources

Implementation: Comprehensive audit logging via SecurityLogger:

• All authentication events logged
• Access control decisions recorded
• Data access/modification tracked
• Security incidents flagged with severity levels
• Log retention policy (90 days)
• Export capability for compliance reporting

client/src/
├── contexts/
│   └── AuthContext.tsx          # SSO authentication + RBAC
├── components/
│   └── security/
│       └── ProtectedRoute.tsx   # Route protection + PermissionGate
└── lib/
    └── security/
        ├── index.ts             # Central exports
        ├── auditLogger.ts       # SOC 2 audit trail
        ├── sessionManager.ts    # Secure session handling
        ├── secureStorage.ts     # Encrypted localStorage
        ├── inputSanitizer.ts    # XSS/SQLi prevention
        └── cspConfig.ts         # CSP + security headers

1. Set devMode={false} in AuthProvider
2. Configure all VITE_SSO_* environment variables
3. Replace CSP 'unsafe-inline' with nonce-based script loading
4. Enable server-side security headers (not just meta tags)
5. Configure CORS whitelist on API server
6. Enable MFA requirement on Identity Provider
7. Set up log forwarding to SIEM (e.g., Splunk, Azure Sentinel)
8. Schedule regular dependency vulnerability scans
9. Configure session timeout values per security policy
10. Enable rate limiting on authentication endpoints

# Run OWASP ZAP scan
docker run -t owasp/zap2docker-stable zap-baseline.py -t https://your-portal-url

# Check CSP headers
curl -I https://your-portal-url | grep -i "content-security"

# Verify security headers
npx is-website-vulnerable https://your-portal-url