Módulo Horario is built with a layered security posture: authentication is enforced at the API boundary with signed JWT tokens, passwords are stored using bcrypt with 12 salt rounds, all input is validated by Pydantic before it reaches business logic, and the database layer uses SQLAlchemy’s parameterized queries throughout. These controls address the most critical attack surfaces—credential theft, injection, and cross-site scripting—while a phased roadmap drives the project toward production-grade observability and automated testing.Documentation Index
Fetch the complete documentation index at: https://mintlify.com/Luisanchez0/modulo_Horario/llms.txt
Use this file to discover all available pages before exploring further.
Phase 1 — Implemented
JWT HS256 authentication
Every protected endpoint requires a signed Bearer token. Tokens carry the user’s ID, email, and role, and expire after 24 hours.
bcrypt password hashing
Passwords are hashed with bcrypt at 12 rounds before storage. Plaintext and reversible hashes (MD5, SHA-1) are never used.
Rate limiting on login
The
/auth/login endpoint is capped at 5 requests per minute per IP. Exceeding the limit returns HTTP 429.Pydantic input validation
All request bodies are parsed and validated by Pydantic schemas. Invalid or missing fields are rejected with HTTP 422 before any business logic runs.
SQLAlchemy ORM (SQL injection prevention)
All database queries go through SQLAlchemy’s ORM. Parameters are never string-interpolated into SQL, so injection payloads are treated as literal values.
React XSS auto-escaping
The React frontend escapes all dynamic content by default. Special characters like
< and > are rendered as HTML entities, not executable markup.Restricted CORS origins
The CORS middleware explicitly lists allowed origins. Wildcards (
*) are never used in production.Secrets outside the repository
.env files are in .gitignore. Secrets are generated locally with bash setup-secrets.sh and managed in AWS Secrets Manager for production deployments.Phase 2 — In progress
These controls are actively being built and are not yet enforced in all environments.
- 80% test coverage — unit and integration tests covering authentication flows, validation edge cases, and authorization checks.
- Structured logging — JSON-formatted log output with user IDs and IP addresses, never passwords or tokens. Designed for ingestion by ELK Stack or similar.
- Database indexes — indexes on frequently queried columns to support efficient audit queries and reduce exposure to slow-query denial-of-service.
Phase 3 — Roadmap
- HTTPS enforcement — mandatory TLS in production via Let’s Encrypt and Nginx, with HTTP-to-HTTPS redirects and HSTS headers.
- Refresh tokens — short-lived access tokens paired with longer-lived refresh tokens to reduce the blast radius of token leakage.
- Prometheus monitoring — metrics collection for failed logins, rate-limit hits, and request latency to support alerting and incident response.
- CI/CD security gates — automated dependency audits and secret-scanning checks on every pull request.
Learn more
Authenticate requests with JWT tokens
How to log in, pass your token on API requests, and understand role-based access errors.
Security best practices and production checklist
Required steps before going live: secrets rotation, HTTPS setup, CORS restrictions, and the pre-deployment checklist.