skynet/claude-foundations
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add security architecture best practice: server boundary rule

Browse Source 
No server-side credential may cross the server boundary to the client.
The only credentials that cross are the client's own identity (MFA, OIDC, etc.).

Covers: proxy + identity mapping pattern, defense in depth layers,
anti-patterns (browser tokens, shared service accounts, embedded keys),
presigned URL exception for direct uploads, CMS real-world example.

Extracted from hugo-accelerator M4 where this principle drove the
CMS proxy architecture (Authelia + per-user Gitea tokens server-side).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Paul O'Reilly
2026-03-27 14:32:41 +13:00
parent e78bf5a936
commit d4eafeb38e
2 changed files with 80 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
BESTPRACTICES.md
View File

@@ -9,6 +9,7 @@ Generalised best practices extracted from real project work. Each topic file is
## Topics
- [Validation & Deployment](best-practices/validation.md) — Validate locally, deploy once; full-chain testing; pre-flight checks
- [Security Architecture](best-practices/security-architecture.md) — Server boundary rule: no credential crosses to the client; proxy + identity mapping pattern; defense in depth; anti-patterns
- [Secrets Management](best-practices/secrets-management.md) — SOPS + age, credential handling, file naming, encryption gotchas
- [Git & Source Control](best-practices/git-source-control.md) — Commit practices, GitOps workflows, remote conventions
- [Kubernetes Patterns](best-practices/kubernetes.md) — Volume mounts, deployment strategies, naming, bootstrap ordering