HTTP security and access
Authentication and permissions
Portal sessions and API keys have different purposes. The server checks company membership, role, wallet and policies. Content access follows ownership and assignments rather than menu visibility alone.
OTP enrollment is optional. Once enabled, it remains required with Google sign-in. See Account and sign-in for codes and recovery.
HTTP protection
Public protection combines text-pattern checks, IP reputation, separate traffic-class limits and authenticated gateway quotas. Review reputation feeds, manual blocks and rate-limit parameters in Sistema e sicurezza.
Login, API and portal traffic use separate limits. Concurrency counts simultaneous requests; tokens or events inside a stream are not new requests. HTTP 429 indicates waiting time through Retry-After.
Investigate a false positive
- Record time, host, operation and HTTP status, using synthetic values to reproduce the issue.
- Distinguish an application refusal from HTTP protection.
- Review feeds and manual rules.
- Apply a targeted correction through the authorized catalog and renderer.
- Verify the legitimate case and relevant attack regressions.
Do not disable all text filtering to resolve one false positive. Public-feed exceptions must not bypass manual blocks, signatures or rate limits.
IP reputation
Supported public sources include Spamhaus DROP IPv4/IPv6 and IPsum level 3. Periodic refreshes are validated. Failures retain the last valid copy only within the configured bound. Feed health is visible to administrators.
Only the trusted proxy may supply the real client IP. Public X-Forwarded-For or X-Real-IP headers must not bypass reputation or rate limits.
Sensitive exceptions
The Stripe webhook skips only CRS body inspection at its designated path and retains application HMAC authentication. OAuth exceptions must stay limited to the required callback. Changes need specific workflow verification.
Diagnostic information
Collect necessary operational data only: time, status, parameterized route and available request/trace identifiers. Do not log prompts, credentials, cookies, OAuth codes/state or full callback URLs. Telemetry and audit are not conversation-content archives.