System Security

Created 11 April 2026

Comprehensive security measures and best practices for the ecommerce plugin

Security First: The plugin implements multiple layers of security including authentication, authorization, input validation, and data protection measures.

Permission System

Access Control

Enable Permission: All ecommerce endpoints require the “Enable” permission
Custom Validation: ensureEcommercePermission utility function
User Isolation: Users can only access their own data
Admin-Only: Content management endpoints restricted to administrators

Authentication Security

JWT Tokens: Secure token-based authentication
Token Validation: Automatic expiry and signature verification
OTP Security: Time-limited one-time passwords
Session Management: Secure session handling and cleanup

Input Validation & Sanitization

Field Validation

Required Fields: Comprehensive validation for all required fields
Email Format: RFC-compliant email validation
Phone Numbers: International format support and validation
Unique Constraints: Username, email, and phone uniqueness
Data Types: Strict type checking for all inputs
Length Limits: Maximum length validation for text fields

Security Measures

XSS Protection: Input sanitization and encoding
SQL Injection: Parameterized queries and ORM protection
Rate Limiting: Protection against brute force attacks
CORS Policy: Configurable origin validation
Request Size Limits: Protection against payload attacks
Error Handling: Secure error messages without data leakage

Origin & Domain Validation

CORS Configuration

Configure allowed frontend domains in the plugin settings to prevent unauthorized access:

Settings → WebbyCommerce → Configure Tab

{ “allowedFrontendDomains”: [ “https://yourstore.com”, “https://www.yourstore.com”, “http://localhost:3000” ] }

Important: Only add trusted domains to prevent unauthorized API access.

Security Checklist

HTTPS enabled in production
JWT tokens stored securely
Strong password policies
Rate limiting configured
Regular security audits

Data Protection

Privacy & Encryption

Sensitive Data Handling:

Passwords: Bcrypt hashing with salt rounds
Payment Data: Tokenization and PCI compliance
Personal Information: GDPR-compliant data handling
API Keys: Encrypted storage and secure transmission
Logs: Sanitized logging without sensitive data

Data Access Control

User Data Isolation:

Profile Data: Users can only access their own profiles
Orders: Order history restricted to order owner
Addresses: Address management limited to user ownership
Cart: Shopping cart data isolated per user
Wishlist: Personal wishlist privacy protection

Frontend Security Best Practices

Authentication Handling

// Secure JWT token storage
const setToken = (token) => {
  localStorage.setItem('jwt', token);
  // Set secure httpOnly cookie for additional security
  document.cookie = `jwt=${token}; secure; samesite=strict`;
};

const getToken = () => {
  return localStorage.getItem('jwt');
};

const clearToken = () => {
  localStorage.removeItem('jwt');
  document.cookie = 'jwt=; expires=Thu, 01 Jan 1970 00:00:00 GMT';
};

API Request Security

// Secure API request with error handling
const secureApiCall = async (endpoint, options = {}) => {
  const token = getToken();

  try {
    const response = await fetch(`/api/webbycommerce${endpoint}`, {
      ...options,
      headers: {
        'Authorization': `Bearer ${token}`,
        'Content-Type': 'application/json',
        ...options.headers
      }
    });

    if (response.status === 401) {
      // Token expired, redirect to login
      clearToken();
      window.location.href = '/login';
      return;
    }

    if (!response.ok) {
      throw new Error(`API Error: ${response.status}`);
    }

    return await response.json();
  } catch (error) {
    console.error('API call failed:', error);
    throw error;
  }
};

Security Monitoring & Auditing

Security Monitoring

Authentication Events:

Login attempts (success/failure)
OTP generation and verification
Password change events
Account lockouts

Security Events:

Failed authentication attempts
Suspicious API access patterns
Rate limit violations
Data access violations

Compliance

Standards:

OWASP: Security best practices
GDPR: Data protection compliance
PCI DSS: Payment security
JWT RFC: Token standards
CORS: Cross-origin policies

Security Notice: Always keep your Strapi installation and dependencies updated. Regularly review security logs and implement additional security measures for production environments.

Popular Searches