Aether takes security seriously and provides built-in mechanisms to protect your application.

Use the passkey-first identity platform for people, organizations, CLI device authorization, service identities and federation. It uses organization-scoped roles and capabilities; password authentication, identity JWT fallback and global groups/permissions are not supported. Generic aether-core authentication remains separate for unrelated application protocols.

Generic aether-core applications can install CsrfMiddleware:

pipeline.installCsrfProtection()

Aether Identity instead validates an exact allowed Origin and a session-bound CSRF header token on state-changing browser requests. Query-string and form-body CSRF tokens are rejected. Follow the Identity CSRF policy when mounting /identity/v1.

For enhanced security, use the SecurityHeaders middleware. It sets:

• Content-Security-Policy
• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• Strict-Transport-Security (HSTS)

pipeline.installSecurityHeaders()

Aether supports HTTPS out of the box on the JVM.

You can configure SSL keys in your VertxServerConfig.

val config = VertxServerConfig(
    ssl = SslConfig(
        enabled = true,
        keyPath = "path/to/key.pem",
        certPath = "path/to/cert.pem"
    )
)

For development, you can enable self-signed certificates:

val config = VertxServerConfig(
    ssl = SslConfig(
        enabled = true,
        selfSigned = true
    )
)

The aether-db ORM uses parameterized queries internally, which protects against SQL injection attacks by default. Always use the ORM methods rather than raw SQL strings when handling user input.

When using aether-ui (Composable DOM), output is escaped by default, mitigating Cross-Site Scripting (XSS) risks. If you are rendering raw HTML strings, ensure you sanitize user input manually.