You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@fineract.apache.org by "KRYSTALM7 (via GitHub)" <gi...@apache.org> on 2026/08/11 17:39:08 UTC
[PR] FINERACT-2442 security hardening input validation, tenant isolation, rate limiting, XSS protection, and security headers [fineract-loan-origination]
KRYSTALM7 opened a new pull request, #78:
URL: https://github.com/apache/fineract-loan-origination/pull/78
## Summary
Implements comprehensive security hardening for the LOS backend.
Addresses input validation gaps, tenant isolation enforcement, brute-force
protection, XSS defense-in-depth, and security header hygiene across both
Spring Security filter chains.
---
JIRA: [FINERACT-2442](https://issues.apache.org/jira/browse/FINERACT-2442)
## Changes
### Input Validation
- `CreateLoanApplicationRequest` — added `@NotNull`, `@Positive`,
`@Size`, and `@Pattern` constraints on `requestedAmount`, `currency`
(ISO 4217), `loanPurpose`, `fullName`, `nationalId`, `employmentStatus`
- `ApprovalDecisionRequest` — `@Size(min=10, max=2000)` on `comments`
to prevent DoS via unbounded input and enforce meaningful audit entries
- `@ValidApplicationRef` — custom annotation enforcing
`LOS-YYYY-NNNNN` format; applied to all `@PathVariable applicationRef`
across `ApprovalController`, `LoanApplicationController`,
`CustomerLoanApplicationController`, `DisbursementController`
### Tenant Isolation
- `JwtAuthFilter` — validates `tenantId` JWT claim against
`X-Fineract-Platform-TenantId` request header; returns HTTP 403
on mismatch; adds `tenantId` to MDC for audit logging
- `CustomerPrincipal` — extended with `tenantId` field populated
from JWT claims
### Rate Limiting
- `RateLimitFilter` — Bucket4j token bucket algorithm with per-IP
tracking via Caffeine in-memory cache
- Auth endpoints: 5 req / 15 min (brute-force protection)
- Admin endpoints: 20 req / min (privileged operation cap)
- General endpoints: 100 req / min (fair usage)
- Returns `429 Too Many Requests` with `Retry-After` header
### XSS Protection
- `XssSanitizer` — OWASP Encoder-based utility; exposes
`sanitizeHtml()`, `sanitizeHtmlAttribute()`, `sanitizeJavaScript()`,
`sanitizeUrl()` for use at service layer before persistence
### Security Headers (both filter chains)
- `X-Content-Type-Options: nosniff`
- `X-Frame-Options: DENY`
- `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`
- `Content-Security-Policy` — restricts resource origins, blocks
`frame-ancestors`, scopes `form-action` to self
- `Referrer-Policy: strict-origin-when-cross-origin`
- `Permissions-Policy` — disables geolocation, microphone, camera,
payment APIs
- Note: `X-XSS-Protection` removed — deprecated by modern browsers;
CSP provides equivalent protection and avoids the Spring Security 6.x
`XXssProtectionHeaderWriter` API incompatibility
### Mock Service & Profile Fixes
- `MockCustomerIdentityService` — restricted to `@Profile({"dev","test"})`;
was unconditionally active including in production
- `MockFineractAdapter` — removed `"default"` from `@Profile`; was
silently swallowing disbursements in non-prod deployments
### Tests
- `InputValidationTest` — 23 test cases covering all new constraints:
11 for `CreateLoanApplicationRequest`, 5 for `ApprovalDecisionRequest`,
7 for `@ValidApplicationRef`
### Dependencies Added (`pom.xml`)
- `bucket4j-core:8.10.1`
- `caffeine` (managed version)
- `owasp-java-encoder:1.2.3`
---
## SQL Injection Status
No changes required. All existing queries use JPA/Hibernate with
parameterized `@Query` named parameters. No raw SQL string
concatenation found in codebase.
---
## What Is NOT in This PR
- Staff Login Endpoint
---
## Testing
```bash
# Compile
.\mvnw.cmd clean compile -DskipTests
# Validation tests only
.\mvnw.cmd test -Dtest=InputValidationTest
# Full test suite
.\mvnw.cmd test
```
---
## Checklist
- [x] `.\mvnw.cmd clean compile -DskipTests` passes
- [x] `.\mvnw.cmd test -Dtest=InputValidationTest` — 23/23 pass
- [x] `.\mvnw.cmd apache-rat:check` passes
- [x] `.\mvnw.cmd spotless:apply` run before final commit
- [x] Security headers verified against both filter chains
- [x] Mock service profile restrictions confirmed in local dev run
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2442 security hardening input validation, tenant isolation, rate limiting, XSS protection, and security headers [fineract-loan-origination]
Posted by "KRYSTALM7 (via GitHub)" <gi...@apache.org>.
KRYSTALM7 commented on PR #78:
URL: https://github.com/apache/fineract-loan-origination/pull/78#issuecomment-5270233444
Hi @Aman-Mittal, I rebased it, and all tests are passing locally.
However, #79 is still throwing a lot of conflicts and errors. I tried resolving them, but the rebase ended up involving around 500 minor changes and was taking a lot of time to untangle. I’ll try opening a new PR from a fresh branch based on the latest `main` instead, which should give us a cleaner diff and avoid carrying over the conflicts.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2442 security hardening input validation, tenant isolation, rate limiting, XSS protection, and security headers [fineract-loan-origination]
Posted by "Aman-Mittal (via GitHub)" <gi...@apache.org>.
Aman-Mittal commented on PR #78:
URL: https://github.com/apache/fineract-loan-origination/pull/78#issuecomment-5262822197
@KRYSTALM7 Pls rebase
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2442 security hardening input validation, tenant isolation, rate limiting, XSS protection, and security headers [fineract-loan-origination]
Posted by "KRYSTALM7 (via GitHub)" <gi...@apache.org>.
KRYSTALM7 commented on PR #78:
URL: https://github.com/apache/fineract-loan-origination/pull/78#issuecomment-5302322225
I updated the Spring Security configuration to use the current replacement API for `permissionsPolicy()` and removed the deprecated usage. All tests passing locally.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2442 security hardening input validation, tenant isolation, rate limiting, XSS protection, and security headers [fineract-loan-origination]
Posted by "Aman-Mittal (via GitHub)" <gi...@apache.org>.
Aman-Mittal merged PR #78:
URL: https://github.com/apache/fineract-loan-origination/pull/78
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-2442 security hardening input validation, tenant isolation, rate limiting, XSS protection, and security headers [fineract-loan-origination]
Posted by "KRYSTALM7 (via GitHub)" <gi...@apache.org>.
KRYSTALM7 commented on PR #78:
URL: https://github.com/apache/fineract-loan-origination/pull/78#issuecomment-5256376724
Hey Aman, will need a rebase once #66 is merged, as the frontend CI job introduced there will cause lint failures on my branch. I'll rebase and fix the frontend lint issues right after it lands.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org