📄️ Authentication
Shesha's authentication framework provides a secure and flexible way to manage how users log in to an application. Out of the box it authenticates users with a username and password over JWT bearer tokens, backs that up with one-time-password (OTP) verification for password resets and mobile login, and gives you an extension point for plugging in your own external identity provider.
📄️ Access Control
Access control is a fundamental aspect of system security, ensuring that users can only access resources and perform actions they are authorized for. In the context of Shesha, access control is implemented through a combination of Role-Based Access Control (RBAC) and Scoped RBAC. These mechanisms allow administrators to define roles, assign permissions, and enforce security policies based on user roles and their associated scopes.
📄️ Security Classes and Interfaces
Shesha's security model is built from a small set of classes and interfaces that work together: one manages roles, one checks whether the current user holds a permission, and one ties a permission check to a specific protected endpoint, form, or other object. Understanding how these fit together helps when you need to check permissions from custom code, rather than relying on the built-in [SheshaAuthorize] attribute or the Permissions setting in the form designer.
📄️ Permission Based Security Model
Shesha adopts a permission-based model, meaning users can only perform restricted actions if they have been granted that specific permission. Think of it like having different keys for different doors in a building - you can only enter the rooms you are authorized to access.
📄️ Endpoint Permissions
Every API endpoint in a Shesha application has a permission level that controls who can call it. By default, Shesha scans your application on startup and registers all endpoints in a central store called Permissioned Objects. From there, you can control access through code attributes, a system-wide default setting, or the Permissioned Objects configuration UI. Understanding how these three mechanisms interact - and which one takes priority - is essential for building secure APIs.
📄️ User Registration
Shesha gives users a way to create their own account through a public registration form, as an alternative to an administrator creating accounts for them (see User Management for the admin-created flow). You control whether self-registration is available at all, which method users register with, and whether they need to complete extra information before their account is fully active.