---
title: "Security"
slug: "security"
updated: 2025-12-05T07:52:00Z
published: 2025-12-10T14:08:19Z
canonical: "docs.grassfish.com/security"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.grassfish.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

Security and information security are ensured in the Grassfish system in several ways:

****Transport and perimeter****

Transport and perimeter includes the following measures:

- **HTTPS**: The platform operates exclusively over HTTPS. Unencrypted HTTP is disabled.
- **TLS and load balancing**: The Application Gateway handles TLS termination and load balancing. A Web Application Firewall (WAF) can be enabled with standard and custom rule sets, such as Azure Bot Manager rule sets.
- **DDoS protection**: An Azure DDoS protection plan can be added.
- **Network security groups**: Network security groups separate subnets (nodes, pods, SQL, AppGW) according to Azure best practices. Internal services are only accessible via defined APIs.

****API security and integrations****

**System-to-system integrations**: System-to-system integrations authenticate themselves via the following methods, depending on the scenario:

- Session ID
- API keys
- JWT tokens
- OAuth2 client credentials (for modern integrations)

**Rate limiting**: Rate limiting is primarily implemented via infrastructure components (Application Gateway or API management). It is intentionally kept lean within the core product to maintain integration flexibility.

****Secure SDLC and third-party packages****

Secure software development life cycle (SDLC) and third-party packages are handled as follows:

- **Third-party checks**: Third-party dependencies (NuGet, npm) are regularly checked and updated.
- **GitHub scans**: GitHub scans support dependency checks and static code analysis. Container images can also be scanned.

****CIA triad****

The CIA triad relies on three key factors:

**Confidentiality**

- Access only via SSO or authenticated logins
- Fine-grained role and permissions model
- Encryption of all connections via TLS

**Integrity**

- Transactions for critical write operations
- Checksums for media files, retransmission in case of errors
- Input filtering and validation in the backend
- Versioned deployments to reproduce defined system states

**Availability**

- Redundant instances, automatic recovery of pods or nodes
- Backups and a DR corridor (RTO/RPO in the minutes to hours range, project-dependent)
- Monitoring and alerting
- Local player cache for content

HTTP stands for Hypertext Transfer Protocol. This is a standardized protocol for transmitting data between clients and servers on the internet. The client sends an HTTP request to the server using a standard set of methods such as GET to specify the action it wants to perform on a specific resource.