Security policy

t6 security policy

t6 implement various level of security:

• JWT and signed token (Token lifetime can be setup in configuration file, but suggested to be short);
• POSTing to timeseries endpoints allows signed payloads (with a shared secret) to check and verify sender;
• POSTing to timeseries endpoints allows encrypted payloads (aes-256-cbc only yet; with a shared secret, no public key yet);
• POSTing to timeseries allows both signed then encrypted payloads;
• Optionally, signature and/or encryption can be required from a Flow;
• Rule based events can send data to Mqtt using encryption;
• User passwords are bcrypt-hashed in databased; at least not in clear;
• User passwords recovery process is secured, but still can be improved when the User set it's own password and Post data;