Nucleus Security Features

Introduction

Nucleus is a web application framework and content management system. Nucleus delivers a flexible and extensible foundation for building and managing dynamic websites and applications. Designed with modularity and developer productivity in mind, Nucleus integrates robust role-based access controls, extensible authentication options including OAuth and SAML, and configurable security headers to help safeguard applications against common web threats. This white paper explores Nucleus's security architecture, its built-in safeguards, and best practices for deploying and maintaining secure Nucleus instances in diverse operational environments, ensuring strong protection for mission-critical content.

Authentication

Authentication is the process of verifying the identity of a user or system. Nucleus implements several security features to ensure robust authentication mechanisms.

Password Hashing and Salting

When a user creates or updates their password, Nucleus employs a hashing algorithm combined with salting to securely store password one-way hashes that can't be reversed. This approach ensures that even if the password database is compromised, the actual passwords remain protected against common attacks.

Password Complexity Rules

Nucleus enforces password complexity requirements to enhance security. By default, passwords must contain at least one upper case character, at least one lower case character, at least one number, at least one symbol and must be at least 8 characters long.

Password Complexity rules can be configured. Refer to Configuration Reference: Password Complexity Rules for more information.

Nucleus includes a login module that provides an interface for users to authenticate themselves.

When a user enters an invalid user name and/or password, the login module displays a generic error message without specifying which part of the credentials was incorrect. This approach helps prevent information leakage that could aid attackers in guessing valid usernames or passwords.
When a user enters an invalid user name and/or password, the server pauses for 10 seconds before responding. This delay helps mitigate brute-force attacks by slowing down the rate at which an attacker can attempt to guess credentials.
Nucleus core authentication functions implement automatic account lockout.

Account Lockout

Nucleus implements an automatic account lockout mechanism to protect against "brute-force" attacks. After a configurable number of failed login attempts (default: 3), the user account is temporarily locked for a specified duration (default: 15 minutes).

Locked accounts are automatically unlocked after the lockout duration expires. Site administrators can also manually unlock accounts if needed. The default lockout duration is 15 minutes.

Password options can be configured. Refer to the Configuration Reference: Password options for more information.

User Approval

When the site administrator enables "Require approval" in the site editor, new user registrations require manual approval before they can access pages and modules which are restricted to specific roles. This feature helps prevent unauthorized access and ensures that only legitimate users can sign up.

User Verification

When the site administrator enables "Require Email Verification" in the site editor, new user registrations must verify their email address by clicking a link sent to their email. This feature helps ensure that users provide valid email addresses and reduces the risk of fake or spam accounts.

No Default Accounts

The Nucleus installation process requires the creation of a system administrator and site administrator account. No default accounts with preset usernames or passwords are created. This approach helps reduce the risk of unauthorized access by avoiding shared or predictable administrative credentials.

External identity provider support (OAuth and SAML Support)

Site administrators can install and use optional Extensions to enable authentication via external identity providers using OAuth2 or SAML.

File Integrity Checker

The file integrity checker middleware is built in to Nucleus. It verifies the integrity of all file uploads by checking their file extension and signatures against known valid values. The file integrity checker helps to prevent the upload of malicious files that could compromise the security of the system.

The file integrity checker validates that:

The file extension is one of the accepted file types.
The file signature (first few bytes) matches the expected signature for the file type.
If the file type is marked as "Restricted", checks that the current user is a Site Administrator or System Administrator.

Administrators can specify additional allowed file types and signatures. Refer to Configuration Reference: Allowed File Types for more information.

Uploaded files can only be stored by a File System Provider. Most File System Providers are cloud storage providers, so uploaded files are not stored on the web server. If you use the Local File System Provider, you must ensure that the upload directory is not in the same directory as your web application, to prevent uploaded files from being accessible via a public URL, and to prevent a variety of attacks. In Windows, the default upload directory is within C:\ProgramData\Nucleus\Content, which is outside of the web application directory.

ASP.NET implements additional security features for uploaded files, including file upload size limits.

Multi-Factor Authentication (MFA)

In Nucleus version 3.5, an extensible multi-factor authentication (MFA) framework was introduced. Site administrators can install and use optional Extensions to enable multi-factor authentication for user logins.

When MFA is enabled, users are required to provide an additional form of verification (such as a code from an authenticator app or a hardware token).

A default installation of Nucleus uses a login page with a user name and password, and generates a cookie to maintain an authenticated session. The following security measures are implemented for the authentication cookie:

The cookie does not contain any user information - it contains a unique session identifier that is randomly generated.
The cookie used for authentication, the Secure flag is used to ensure that the cookie is only transmitted over HTTPS connections.
When the https scheme is in use, the HttpOnly flag is used to ensure that the cookie cannot be accessed by client-side scripts.
The cookie is scoped to a specific domain to prevent it from being sent to unintended recipients.
The SameSite attribute is set to Lax to help mitigate the risk of cross-site request forgery (CSRF) attacks.
When the user logs out, the authentication cookie is invalidated and cannot be reused.
By default, the cookie has an expiration time to limit the duration of its validity (with sliding expiration). If the site administrator enables the "Allow Remember Me" option, users can choose to extend the expiration time of the cookie to persist their login across browser sessions. The long expiry duration is configurable, the default value is 30 days.

Authorization

Authorization is the process of determining whether a user has permission to access a specific resource or perform a specific action.

Role-Based Access Control (RBAC)

Site administrators can define roles and assign users to those roles. Permissions can then be assigned to roles, allowing or denying access to specific pages and modules. Extensions can also implement their own role-based access control checks.

Site Editors can assign permissions to roles for Pages, and for Modules.

Extensions

Extension Signing is a new feature in Nucleus 3.5 that allows extension developers to sign their extensions with a digital signature. This signature verifies the authenticity and integrity of the extension, ensuring that it has not been tampered with or altered in any way since it was signed.

When an extension is signed, Nucleus verifies the digital signature during installation or update. If the signature is valid, the extension is installed or updated as usual.

If the package is not signed, Nucleus will display a warning message to the site administrator, indicating that the extension may not be trustworthy.

If the package is signed but the signature is invalid (for example, if the package has been tampered with), Nucleus will prevent the installation or update of the extension, and display an error message to the site administrator.

Other

Request Validation

ASP.NET Anti-forgery tokens ASP.NET antiforgery are enabled by default.

Security Headers

Nucleus includes middleware to add security headers to HTTP responses, including:

X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: no-referrer-when-downgrade
X-Permitted-Cross-Domain-Policies: none
Content-Security-Policy (CSP) (see below)

Security headers middleware can be configured. Refer to Configuration Reference: Security Headers for more information.

Content Security Policy (CSP)

Nucleus version 3.5 and later generates and adds a Content Security Policy (CSP) header to HTTP responses. CSP is a security feature that helps prevent cross-site scripting (XSS) attacks and other code injection attacks by specifying which sources of content are allowed to be loaded by the browser.

The default CSP directives generated by Nucleus restrict scripts, styles, images, fonts, and other resources loading to the same origin as your site, and allow resources to be loaded from your File System Providers. Extensions can add allowed sources as needed.

CSP directives can be configured. Refer to Configuration Reference: Content Security Policy

HTML Editor

The default HTML editor in Nucleus is TinyMCE. TinyMCE implements various security features to help prevent XSS attacks and other vulnerabilities, refer to TinyMCE Security guide for details.

The TinyMCE editor is configured to allow text-only pasting, and to remove potentially dangerous elements and attributes. It is also configured to use CSS classes for styling instead of inline styles, because the default Content Security Policy does not allow inline styles.

API Keys, Request Signing

Nucleus includes an API Key manager that allows site administrators to create and manage API keys which are used by calling applications to access APIs hosted by Nucleus.

API keys include a "secret" which is used by callers to generate a request signature. The request signature consists of an API Key ID and a HMAC hash. Together these values identify the caller, and ensure the integrity of the request.

API keys can be assigned roles to control access to resources by including a role: directive in the Scope (for example: role:Registered Users).