Security Architecture

ForsetiDesk is built with a defense-in-depth approach. Every HTTP request passes through multiple security layers before reaching route handlers:

1. Helmet.js — sets HTTP security headers (CSP, HSTS, X-Frame-Options, X-XSS-Protection)
2. CORS — whitelist-only origin policy; rejects cross-origin requests from unlisted domains
3. Rate limiting — 200 requests/minute globally; 5 login attempts/15 minutes per IP+email
4. JWT authentication — Bearer token required on all /api/* routes except login and setup
5. Active user check — every authenticated request verifies the user account is still active in the database (deactivated accounts are rejected immediately even with a valid token)
6. Role enforcement — requireRole() on every protected route; CLIENT role is isolated to their own tickets only
7. Feature enforcement — enforceProFeature() on all Pro/Business/Enterprise endpoints

HTTPS / TLS Setup

ForsetiDesk includes a built-in TLS manager that can generate self-signed certificates or obtain trusted certificates from Let's Encrypt. Navigate to Admin → Security → TLS / Certificates.

Self-Signed Certificate (LAN Use)

1. Click the Self-Signed tab.
2. Select the IP addresses and hostnames to include in the Subject Alternative Name (SAN) list. The system auto-detects local IPs.
3. Add any additional domains or public IPs as needed.
4. Click Generate Certificate. ForsetiDesk creates a CA certificate and a server certificate signed by that CA.
5. Enable HTTPS via the toggle. The service restarts on HTTPS; HTTP on the old port issues a redirect.
6. Click Download CA Certificate and distribute it to all client machines and mobile devices that will access the server. Install the CA in the OS trusted certificate store.

Custom Certificate Upload

If you have a certificate from an internal CA or a commercial CA, click Replace Certificate and upload the PEM-format certificate and private key files. ForsetiDesk will use your certificate instead of generating one.

Let's Encrypt (Public Domain)

For servers accessible on the internet with a registered domain, Let's Encrypt provides free, automatically-renewed, publicly-trusted certificates.

Prerequisites

• A registered domain name (e.g., desk.yourcompany.com) with an A record pointing to your server's public IP
• Port 80 accessible from the internet (needed only during certificate issuance/renewal)
• Port 443 accessible from the internet (for ongoing HTTPS access)

Setup

1. Click the Let's Encrypt tab in Admin → Security → TLS / Certificates.
2. Enter your domain (e.g., desk.yourcompany.com) and a contact email for expiry notices.
3. Click Request Certificate. ForsetiDesk starts a temporary HTTP server on port 80 to complete the ACME HTTP-01 challenge.
4. Once issued, HTTPS is enabled automatically. The certificate is valid for 90 days and auto-renews at 3am daily (when it is within 30 days of expiry).

Configurable Session Timeout

Control how long authenticated sessions remain valid before users must log in again. Navigate to Admin → Security → Session.

Available timeout values: 10, 15, 30, 45, 60 (default), 90, 120, 180, and 240 minutes.

Warning Banners

ForsetiDesk warns users before their session expires:

• 5 minutes remaining — blue informational banner with a Refresh Session button
• 1 minute remaining — amber urgent banner
• Session expired — automatic logout and redirect to the login page with an expiry message

Users can extend their session by clicking Refresh Session without re-entering their password.

Password Policy

All user passwords must meet these requirements:

• Minimum 12 characters
• At least one uppercase letter
• At least one lowercase letter
• At least one number
• At least one special character (!@#$%^&* etc.)

Passwords are hashed with bcrypt (10 rounds) before storage. Plaintext passwords are never stored, logged, or transmitted after the initial API call.

Account Lockout

After 5 failed login attempts within 15 minutes from the same IP address, ForsetiDesk returns a rate-limit response. The lockout is automatic and self-resolves after 15 minutes. Admins can reset the rate limiter by restarting the service.

Rate Limiting

LDAP / Active Directory SSO

Enterprise licenses can integrate ForsetiDesk with an LDAP directory (Active Directory, OpenLDAP, etc.) for single sign-on authentication.

Configuration

1. Go to Admin → Security → LDAP / AD.
2. Enter your LDAP server details:

3. Click Test Connection to verify the bind account can reach the LDAP server.
4. Click Test Authentication and enter a test user's credentials to verify end-to-end authentication.
5. Click Save. LDAP auth is now active alongside local auth.

How LDAP Auth Works

• When a user logs in, ForsetiDesk first checks if an active local account with that email exists and has authSource = LDAP.
• If found, credentials are validated against the LDAP server using a simple bind.
• If no account exists but LDAP auth succeeds, ForsetiDesk auto-provisions an account with the TECH role. An admin can then upgrade the role as needed.
• ADMIN accounts always fall back to local authentication regardless of LDAP config — this prevents lockout if the LDAP server becomes unavailable.

User Audit Log

The User Audit Log records all admin-initiated user modifications for compliance and forensics. This is an Enterprise feature.

Navigate to Admin → Users → Audit Log to view a chronological list of all actions with the actor, target user, action type, and timestamp.

Logged actions include: user created, user updated (with which fields changed), user deactivated, user reactivated, role changed, password reset, mobile access revoked, and user deleted.

Backup & Restore

ForsetiDesk uses PostgreSQL's pg_dump for backups. This is a Pro feature.

Creating a Backup

1. Go to Admin → Database → Backup.
2. Click Create Backup Now. A timestamped SQL dump is written to the backup directory (default: C:\Program Files (x86)\ForsetiDesk\backups\).
3. The backup appears in the list with size and creation time. Click Download to save a copy off-server.

Restoring a Backup

1. In the Backup panel, select a backup file from the list.
2. Click Restore and confirm. This will drop and recreate the database using the selected backup file.
3. The service restarts automatically after a successful restore.

Configuring the Backup Path

Set a custom backup storage directory in Admin → Database → Backup → Settings. This is useful for pointing backups to a network share or external drive.

BYODB — External Database

Enterprise licenses can connect ForsetiDesk to an external PostgreSQL server (14+) instead of the bundled local instance. This enables use of managed database services, HA clusters, or centralized database administration.

1. Go to Admin → Database → Configuration.
2. Enter the external database URL (e.g., postgresql://user:[email protected]:5432/forsetidb?sslmode=require).
3. Click Test Connection to verify connectivity.
4. Click Apply. ForsetiDesk runs a schema push (prisma db push) against the external database to create all required tables.
5. The service restarts and now uses the external database.

To revert to the local bundled database, click Revert to Local.

JWT Secrets & Configuration

ForsetiDesk uses RSA-signed JWTs for session tokens and a separate symmetric secret for general JWT signing. These are stored in C:\Program Files (x86)\ForsetiDesk\config\secrets.cfg.

To rotate the JWT secret, update the JWT_SECRET value in secrets.cfg and restart the service. All existing sessions will be invalidated — users will need to log in again.

Security Hardening Checklist

• ☐ Change the default admin password immediately after installation
• ☐ Enable HTTPS — use Let's Encrypt for internet-facing servers, self-signed for LAN-only
• ☐ Set an appropriate session timeout for your environment (Admin → Security → Session)
• ☐ Configure SMTP notifications so security-relevant events (SLA breach, QA rejection) are emailed to the right people
• ☐ Enable User Audit Log (Enterprise) for compliance requirements
• ☐ Schedule regular backups and test restores periodically
• ☐ Restrict Windows Firewall to only expose ports 443 (HTTPS) and briefly 80 (Let's Encrypt renewal)
• ☐ Run ForsetiDesk as a dedicated limited-privilege Windows service account (not LocalSystem)
• ☐ Keep ForsetiDesk updated — each release includes security fixes; review the changelog before upgrading
• ☐ If using LDAP, use LDAPS (port 636 with TLS) — never plain LDAP in production
• ☐ Store the secrets.cfg backup in a secrets manager, not in source control
• ☐ Periodically review the User Audit Log for unexpected user creation or role escalations