Security

VeloSim is not intended to be a public-facing application. The expectation is that VeloSim will be self-hosted on our stakeholder's private network.

Our stakeholder has indicated that they only want simple username/password login support (no SSO required), so that different users of VeloSim can maintain their own scenarios and preferences.

We will implement this by implementing a login endpoint for the front-end app to call, which can exchange a username/password combination for a short-lived API token, along with account creation/password change functions. The API token will be used for subsequent REST and WebSockets operations.

We will implement standard controls like password hashing. If VeloSim were to be made accessible over the public internet in the future, we would rely on a proxy like Cloudflare or Microsoft Entra Application Proxy to implement rate-limiting and to limit access to corporate employees only using their existing corporate SSO/MFA methods. VeloSim is not intended for use outside of a single company.