Production Checklist

Before deploying AllSafe Fast to production, verify that every item on this checklist is complete. Each item addresses a specific security or operational concern that could compromise your application if overlooked.

Secret Key

The secret key is used to sign JWTs. If it is compromised, an attacker can forge valid tokens for any user.

• Secret key is not the default value — The default key ("change-me-please-...") is rejected by the production guard. Generate a unique key with allsafe secret or openssl rand -hex 32.
• Secret key is at least 32 characters — Use a long, random, high-entropy key. Short keys are vulnerable to brute-force attacks.
• Secret key is stored securely — Use a secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.) or environment variable. Never commit it to source control.
• Secret key rotation plan exists — Plan how to rotate the key if compromised. Rotating invalidates all existing tokens, requiring users to sign in again.

# Generate a secure secret key

terminal

# Using the AllSafe CLI
allsafe secret

# Or using openssl
openssl rand -hex 32

# Set as environment variable
export ALLSAFE_SECRET_KEY="generated-secret-key-here"

Cookie Security

Cookies carry access and refresh tokens. Insecure cookie settings can lead to token theft via XSS or man-in-the-middle attacks.

• ALLSAFE_COOKIE_SECURE=true — Cookies are only sent over HTTPS. This is enforced by the production guard.
• ALLSAFE_COOKIE_HTTP_ONLY=true — Cookies are not accessible via JavaScript, preventing XSS-based token theft.
• ALLSAFE_COOKIE_SAME_SITE=lax or strict — Prevents CSRF attacks. Do not use none in production unless you have a specific cross-site use case with Secure enabled.

# Cookie configuration for production
# ALLSAFE_COOKIE_SECURE=true
# ALLSAFE_COOKIE_HTTP_ONLY=true
# ALLSAFE_COOKIE_SAME_SITE=lax

config = AuthConfig(
    secret_key="your-secure-secret-key",
    env="production",
    cookie_secure=True,        # HTTPS only
    cookie_http_only=True,      # No JavaScript access
    cookie_same_site="lax",     # CSRF protection
)

HTTPS

All authentication traffic must be encrypted in transit. Without HTTPS, cookies and tokens can be intercepted.

• HTTPS is enforced for all routes — Use a reverse proxy (Nginx, Caddy, AWS ALB) with TLS termination, or serve HTTPS directly.
• HTTP requests redirect to HTTPS — Configure a 301 redirect from HTTP to HTTPS.
• TLS certificate is valid and not expiring — Use Let's Encrypt with auto-renewal or a managed certificate service.
• HSTS header is set — Add Strict-Transport-Security header to prevent protocol downgrade attacks.

Database Configuration

The database stores user accounts, sessions, and verification tokens. Proper configuration ensures data integrity and performance.

• ALLSAFE_DATABASE_URL is set to a PostgreSQL connection string — Format: postgresql+asyncpg://user:pass@host:port/dbname.
• Migrations have been applied — Run allsafe db migrate to create all required tables and indexes.
• Database connection uses SSL — Add ?ssl=require to the connection URL for encrypted database connections.
• Connection pool is configured — Set appropriate pool size and max overflow for your expected load.
• Database backups are configured — Set up automated backups of your PostgreSQL database.

Redis Configuration

Redis powers the distributed rate limiter. Without Redis, rate limiting is per-process and ineffective in multi-worker deployments.

• ALLSAFE_REDIS_URL is set — Format: redis://host:port/db or rediss:// for TLS.
• Redis is accessible from all application servers — Verify connectivity from each worker process.
• Redis persistence is configured if needed — Rate limit data is ephemeral, but consider persistence for session data if using Redis for sessions.
• Redis has authentication enabled — Set a Redis password and configure it in the URL: redis://:password@host:port/db.

Email Service Configuration

Email is used for verification tokens, password resets, and magic links. In development, AllSafe Fast can print emails to the console, but production requires a real email service.

• Email service is configured (not console) — Use a transactional email service (SendGrid, SES, Postmark, etc.) instead of console output.
• From address is set and verified — Use a verified sender domain to avoid spam filters.
• Email templates are customized — Brand your verification and reset emails with your application name and styling.
• Verification links use HTTPS URLs — Ensure all links in emails point to your HTTPS production domain.

Rate Limiting

Rate limiting protects against brute force attacks, OTP flooding, and reset email spam.

• ALLSAFE_RATE_LIMIT is set appropriately — Default is 5 requests per window. Adjust based on your security requirements.
• ALLSAFE_RATE_LIMIT_WINDOW is set appropriately — Default is 900 seconds (15 minutes). Adjust based on your security requirements.
• Redis backend is used (not in-memory) — In-memory rate limiting does not work across multiple worker processes.
• Stricter limits are set for OTP and reset endpoints — Use 3 requests per hour for OTP and reset endpoints.
• 429 responses include Retry-After header — This helps clients implement backoff correctly.

CORS Configuration

Cross-Origin Resource Sharing (CORS) controls which origins can access your API. Misconfigured CORS can expose your API to unauthorized origins.

• CORS origins are explicitly set — Do not use * in production. List your specific allowed origins.
• CORS credentials are allowed only for specific origins — If using cookie-based auth, allow_credentials=True requires explicit origins (not *).
• Allowed methods are restricted — Only allow the HTTP methods your application needs.
• Allowed headers are restricted — Only allow the headers your application needs.

from fastapi.middleware.cors import CORSMiddleware

app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://yourapp.com", "https://www.yourapp.com"],
    allow_credentials=True,  # Required for cookies
    allow_methods=["GET", "POST", "PUT", "DELETE"],
    allow_headers=["Authorization", "Content-Type"],
)

Trusted Hosts

Trusted host validation prevents HTTP host header attacks, which can be used for cache poisoning or password reset link manipulation.

• Trusted hosts are configured — Use FastAPI's TrustedHostMiddleware to reject requests with unexpected Host headers.
• Host header is validated — Ensure only your production domains are accepted.

from starlette.middleware.trustedhost import TrustedHostMiddleware

app.add_middleware(
    TrustedHostMiddleware,
    allowed_hosts=["yourapp.com", "www.yourapp.com"],
)

Logging Configuration

Proper logging helps detect security incidents, debug issues, and audit authentication events.

• Logging level is set appropriately — Use INFO or WARNING in production. Avoid DEBUG (may log sensitive data).
• Logs are sent to a centralized logging system — Use structured logging (JSON) and ship to a log aggregation service.
• Authentication events are logged — Sign-in, sign-out, password reset, and verification events should be logged for audit.
• Sensitive data is not logged — Passwords, tokens, and secret keys must never appear in logs.
• Log retention policy is set — Configure appropriate retention for compliance and storage management.

import logging
import json

# Structured JSON logging for production
class JSONFormatter(logging.Formatter):
    def format(self, record):
        log_data = {
            "timestamp": self.formatTime(record),
            "level": record.levelname,
            "message": record.getMessage(),
            "module": record.module,
        }
        return json.dumps(log_data)

logging.basicConfig(level=logging.INFO)
for handler in logging.getLogger().handlers:
    handler.setFormatter(JSONFormatter())

Session Cleanup

Expired sessions and verification tokens accumulate in the database over time. Regular cleanup prevents table bloat and ensures expired tokens cannot be used.

• Periodic session cleanup is scheduled — Run a background task to delete expired sessions from allsafe_sessions.
• Periodic verification token cleanup is scheduled — Delete expired tokens from allsafe_verifications.
• Cleanup frequency is appropriate — Run cleanup hourly or daily, depending on your token volume.
• Cleanup uses the indexed expires_at column — The expires_at index makes deletion efficient.

import asyncio
from datetime import datetime, timezone

# Background task for session and token cleanup
async def cleanup_task(auth):
    while True:
        await asyncio.sleep(3600)  # Run every hour
        try:
            await auth.storage.sessions.delete_expired()
            await auth.storage.verifications.delete_expired()
            logging.info("Session and token cleanup completed")
        except Exception as e:
            logging.error(f"Cleanup failed: {e}")

# Start cleanup task on application startup
@app.on_event("startup")
async def start_cleanup():
    asyncio.create_task(cleanup_task(auth))

Final Verification

After completing all items above, run the AllSafe Fast doctor command to verify your configuration: