Security

Authentication

• Admin Account: On the first run, RUSEON Core automatically generates an admin account and logs the credentials.
• Passwords: All passwords are hashed using bcrypt (DefaultCost).
• JWT: User sessions are secured using JWT (HS256 signature). Tokens have a standard 1-hour expiration.
• Stream Tokens: Ephemeral viewing tokens for camera streams are valid for only 60 seconds and are cryptographically tied to a specific camera ID.

Network Security

• CORS: Cross-Origin Resource Sharing is controlled via the cors_allowed_origins configuration. Restrict this to your frontend domain.
• gRPC TLS: For secure AI/Edge integrations, gRPC endpoints must be secured with TLS using the server TLS certificates.
• pprof Isolation: The profiling server runs on a dedicated port bound exclusively to localhost to prevent external access.

Checklist

1. Change the auto-generated admin password immediately after logging in.
2. Put the API behind an HTTPS reverse proxy.
3. Ensure the pprof_port is unreachable from outside the host machine.