Security

Auth and cookies

• Argon2id password hashing
• Database sessions; cookie meetcast_session httpOnly, SameSite=Lax, Secure in production
• Guest cookie meetcast_guest HMAC-signed with AUTH_SECRET
• Session revoke from settings; admin can revoke user sessions
• Password reset / verify tokens stored as hashes only

CSRF / origin

Server Actions rely on Next.js Origin vs Host checks plus SameSite cookies. Cookie-authenticated JSON APIs (/api/livekit/token, moderation, member role) also check Origin/Referer for same-origin requests.

Authorization

• Room visibility + allowlist before token mint
• LiveKit identities never taken from client body
• roomAdmin grant only for the host; moderators use server RoomService
• Admin panel gated by user.role === "admin"
• Order amounts from plan/order rows, never from the client

Rate limiting

Sliding windows in Postgres table rate_limit_events (hashed bucket keys). Approximate budgets:

Headers

next.config.ts sets CSP, nosniff, Referrer-Policy, X-Frame-Options / frame-ancestors, Permissions-Policy for camera/mic/display-capture, and HSTS in production. Set LIVEKIT_URL at build time so production CSP connect-src can include the LiveKit origin.

Repo checklist

Longer operational notes live in the repository markdown file docs/production-security.md (not this in-app route).