Security

Security Overview

A map of CWIST's security features and where they are documented.

Concern	Feature	Page
Transport encryption	TLS 1.2/1.3 on BoringSSL; hybrid post-quantum key exchange (X25519MLKEM768) with cwist_app_use_pqc_layer()	HTTPS and TLS
Browser hardening	cwist_http_response_add_security_headers() (CSP, X-Frame-Options, Referrer-Policy, ...) and cwist_http_response_add_hsts()	Requests and Responses
Authentication	HS256 JWT signing and verification; Bearer middleware	JWT, Middleware
Sessions	HMAC-signed cookie sessions	Sessions and Flash
CSRF	double-submit cookie middleware	CSRF and WAF
Input screening	WAF-lite signature filter, HTML escaping	CSRF and WAF
Input validation	struct binding with rules, strict schema validation	Validation
Abuse limits	per-IP rate limiting, body and header limits, request timeouts	Middleware, Requests and Responses
HTTP/2 attacks	rapid-reset token bucket, CONTINUATION flood rejection, stream limits	HTTP/2
QUIC 0-RTT	off by default; idempotent-method replay guard when enabled	HTTP/3 and QUIC
Data at rest	AES-256 envelope encryption of SQLite images (db_crypt)	Database
Message integrity	HMAC-authenticated sequenced fragments with replay windows	Sequenced Messages
Hash flooding	SipHash with random per-map seeds for query, header and cookie maps	Query Maps
Memory safety	ASan/UBSan CI on every push, -Werror, allocation audit gate, stack protector and RELRO on Linux	Contributing

Points to know

• Request header injection is blocked: cwist_http_header_add() rejects keys and values containing CR or LF, and HTTP/3 lowercases response header names.
• Middleware does not run on route misses (see Middleware), so headers added by security middleware are absent from 404 responses.
• The session cookie is signed but not encrypted, and is not marked Secure; serve sessions over HTTPS.
• TLS session-ticket keys live for the lifetime of the process (shared by all workers, not rotated). Restart regularly if that window matters, or disable tickets.
• cwist_app_use_ech() currently does nothing with the bundled BoringSSL.
• The ORM escapes values from cJSON data but inserts raw SQL arguments (where_clause, columns, sql) verbatim; never build them from user input. See ORM.
• The in-process SQL socket from cwist_db_transfer_sqlite_to_socket() gives full database access to whoever holds the descriptor; keep it inside the process.
• Redis AUTH credentials travel in clear text over RESP; use loopback, a private network or a TLS tunnel. See Redis.

Reporting a vulnerability

Open an issue titled [CVE/<component>] with the affected file and line, a reproduction and, if possible, a suggested fix, or contact the maintainers on Discord.