Skip to content

Security

Security, SSO & Passkeys

WebAuthn, OIDC Single Sign-On, TOTP 2FA, brute-force lockout, and AES-256 key rotation.

NineDeploy follows a defense-in-depth security model built into every layer.

Authentication Options

  • Passkeys (WebAuthn): Biometric and hardware FIDO2 key login without passwords.
  • OIDC Single Sign-On: Turnkey integration for Google, GitHub, Okta, Keycloak, and generic OpenID Connect.
  • Two-Factor Authentication (TOTP): RFC 6238 time-based one-time passwords for password logins.
  • Argon2id password hashing with hardened parameters.

Secrets & Key Rotation

  • Environment secrets and database passwords are encrypted with AES-256-GCM in versioned envelopes.
  • Zero-downtime key rotation: configure NINEDEPLOY_MASTER_KEYS=0:old_key,1:new_key to seamlessly re-encrypt secrets.
  • Account lockout: 5 failed consecutive login attempts lock the account for 15 minutes.
  • Session revocation: password resets immediately invalidate all active JWT tokens and sessions.

The canonical guides live in the repository's docs folder.