Skip to content

Security

Jump to bottom
Aorux01 edited this page Jan 31, 2026 · 1 revision

Security

Neodyme includes multiple layers of security to protect the server and player data.

Authentication

Password Security

  • Passwords hashed with bcrypt (configurable work factor, default 12 rounds)
  • Minimum password length enforcement (default 8 characters)
  • Timing-safe authentication responses (configurable delay 50-200ms) to prevent timing attacks
bcryptWorkFactor=12
passwordMinLength=8
authTimingDelayMin=50
authTimingDelayMax=200

Token System

Neodyme uses multiple token types:

Token Type Default Expiry Purpose
Access Token 8 hours API authentication
Exchange Token 5 minutes Token swapping between services
Refresh Token 30 days Obtain new access tokens
Web Access Token 8 hours Web interface authentication
Web Refresh Token 30 days Web interface session renewal
CSRF Token 60 minutes Cross-site request forgery protection 
accessTokenExpiryHours=8
exchangeTokenExpiryMinutes=5
refreshTokenExpiryDays=30
webAccessTokenExpiryHours=8
webRefreshTokenExpiryDays=30
csrfTokenExpiryMinutes=60

Token Encryption

Tokens can be encrypted at rest in JSON storage:

tokenEncryptionEnabled=false

CSRF Protection

All web interface forms are protected with CSRF tokens:

csrfTokenExpiryMinutes=60
csrfSessionExpiryHours=24
csrfCleanupIntervalMinutes=60

Rate Limiting

Three tiers of rate limiting protect against abuse:

Global Rate Limiting

Applies to all API endpoints:

rateLimiting=true
maxRequestsPerMinute=125
rateLimitWindowMinutes=1

Authentication Rate Limiting

Stricter limits on login and registration:

authMaxAttempts=5
authWindowMinutes=15
authSkipSuccessfulRequests=false

This means: maximum 5 login attempts per IP address within a 15-minute window.

Expensive Operations Rate Limiting

For resource-intensive endpoints (search, bulk operations):

expensiveMaxRequests=10
expensiveWindowMinutes=5

HTTP Security

Helmet

Security headers that protect against common web vulnerabilities (XSS, clickjacking, MIME sniffing):

helmetEnable=true

CORS

Cross-Origin Resource Sharing control:

corsEnable=true

Compression

Response compression to reduce bandwidth:

compressionEnable=true

Request Size Limits

Prevent memory exhaustion attacks:

limitBodySize=50mb       # File uploads
limitRequestSize=1mb     # Regular API calls

Reverse Proxy

When running behind nginx, Apache, or Cloudflare:

trustProxy=true

HTTPS / SSL

Configuration

protocol=https
sslCertPath=config/ssl/cert.pem
sslKeyPath=config/ssl/key.pem

How It Works

  1. Set protocol=https in server.properties
  2. Place your SSL certificate and private key in config/ssl/
  3. Restart the server
  4. The server creates an HTTPS server and automatically enables secure cookies

Secure Cookies

When HTTPS is enabled, cookies are automatically configured with secure: true, meaning they are only sent over encrypted connections:

secureCookies=false    # Auto-enabled when protocol=https

Certificate Requirements

  • PEM format files
  • Certificate file: cert.pem
  • Private key file: key.pem
  • If files are missing or invalid, the server will exit with a clear error message

Audit Logging

All administrative actions are logged to the audit system:

Logged Actions

Action Description
ban_user User banned
unban_user User unbanned
change_role User role changed
close_ticket Ticket closed
delete_ticket Ticket deleted
assign_ticket Ticket assigned
approve_code Creator code approved
reject_code Creator code rejected
delete_code Creator code deleted
toggle_code Creator code status toggled
update_config Configuration value changed
update_config_file Configuration file updated
force_shop_rotation Manual shop rotation
toggle_maintenance Maintenance mode toggled

Audit Log Details

Each log entry contains:

  • Action type
  • Who performed the action (account ID + display name)
  • Target type and ID
  • Detailed changes (old/new values)
  • Timestamp
  • IP address

Viewing Audit Logs

  • Web Interface: Admin Panel > Audit Log
  • API: GET /api/admin/audit-log
  • Supports filtering by action, user, date range, and search

Ban System

Temporary Bans

/ban add "PlayerName" "Reason" "7d"    # 7-day ban
/ban add "PlayerName" "Reason" "24h"   # 24-hour ban

Permanent Bans

/ban add "PlayerName" "Reason"         # No duration = permanent

Duration Formats

  • h - Hours (e.g., 2h, 24h)
  • d - Days (e.g., 7d, 30d)
  • m - Months (e.g., 1m, 6m)

Ban Management

/ban info "PlayerName"    # View ban details
/ban remove "PlayerName"  # Unban player
/ban list                 # List all bans

Bans can also be managed through the web interface (Moderator Panel > Player Management).

Role-Based Access Control

Role Hierarchy

Role Level Permissions
Player 0 Basic gameplay and web dashboard
Founder 1 Same as Player + founder badge
Helper 4 Same as Player + helper badge
Moderator 3 Player management, bans, tickets, creator codes
Admin 2 All moderator + user roles, audit log, advanced settings
Developer 5 Full access to all features including configuration

Setting Roles

/admin set "PlayerName" admin        # Set as Admin
/admin set "PlayerName" moderator    # Set as Moderator
/admin set "PlayerName" helper       # Set as Helper
/admin set "PlayerName" founder      # Set as Founder
/admin set "PlayerName" 0            # Remove role (regular player)

Best Practices

  1. Change default secrets: Always change jwtSecret and gameServerSecret in production
  2. Enable HTTPS: Use protocol=https with valid SSL certificates
  3. Use rate limiting: Keep rateLimiting=true to prevent abuse
  4. Keep bcrypt factor high: 12-14 rounds provides good security
  5. Enable Helmet: Keep helmetEnable=true for security headers
  6. Regular backups: Enable automatic backups with databaseBackup=true
  7. Review audit logs: Regularly check the audit log for suspicious activity
  8. Minimal permissions: Only give users the minimum role they need

Clone this wiki locally