Security

Cherrycake structure has been modeled from the ground up with security in mind. Let's explore its most important security features.

Request security

All requests are predefined with a specification of parameters, their expected types and validation methods. This makes for a strong first security layer that blocks anything that doesn't looks like a request our app would expect.

Injection prevention

SQL injection and XSS attack vectors are monitored from the very moment a user-provided data enters the App, to the moment it is stored on the database.

CSRF detection

Cherrycake implements a CSRF threat detection mechanism automatically integrated into all sensible requests.

Threat logging and blocking

Cherrycake can log all attacks and keep track of suspicious IPs, automatically blacklisting clients that have passed a configured threshold.

Secure user authentication and session tracking

Cherrycake provides a secure user authentication and session tracking mechanisms using modern password encryption and server-based session data storage.

Scalability

Thanks to a thorough lifecycle and its modular structure, Cherrycake allows for the easy implementation of new security mechanisms and the improvement of the existing attack detection routines. We encourage you to contribute your suggestions, ideas and security improvements through the official GitHub repository.