Skip to content

[FEATURE] Implement Authentication and RBAC for Multi-User DeploymentsΒ #373

@Somil450

Description

@Somil450

✨ Feature Description

Add JWT-based authentication and Role-Based Access Control (RBAC) to secure SecuScan deployments in multi-user environments.


πŸ€” Problem It Solves

Currently, SecuScan operates without authentication. If deployed on a shared lab server or cloud VM, any user with access to the port can execute intrusive scans or view sensitive reports.

This creates major security risks for teams and enterprise environments.


πŸ’‘ Proposed Solution

Backend

  • Implement JWT-based authentication using FastAPI
  • Add secure login/logout endpoints
  • Add password hashing and token validation

RBAC Roles

Admin

  • Run scans
  • Manage plugins
  • Manage users
  • View reports/history

Viewer

  • View reports/history only
  • No scan execution permissions

Frontend

  • Add login page
  • Add protected routes
  • Add role-based UI rendering

πŸ”„ Alternatives Considered

  • API-key authentication
  • Reverse proxy authentication
  • Local-only deployments

However, JWT + RBAC provides proper scalability and secure access isolation.


πŸ“Έ Mockups / Examples

Similar Platforms

  • GitLab RBAC
  • Grafana Authentication
  • SonarQube Role Management

βœ… Acceptance Criteria

Authentication

  • JWT authentication implemented
  • Login/logout flow works
  • Password hashing added
  • Token validation middleware added

RBAC

  • Admin role implemented
  • Viewer role implemented
  • Permission checks enforced
  • Unauthorized access blocked

Frontend

  • Login UI added
  • Route guards implemented
  • Protected pages secured
  • Session persistence works

πŸ“‹ Additional Context

This feature is essential before deploying SecuScan in shared lab or cloud environments where multiple users may access the platform.


🌱 Contributor Checklist

  • I am participating via GSSoC
  • I have read the contribution guidelines
  • I checked for existing issues before creating this

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions