Admin Authentication

Cryptographic Security Design

This portfolio demonstrates enterprise-grade security engineering through multiple layers of cryptographic protection, session management, and leak detection. Every aspect is designed to be auditable, traceable, and secure by default.

1. Cryptographic Invite System
SHA-256 hashing with ECDSA digital signatures

How It Works:

  1. Server generates invite hash: SHA-256(email + timestamp + nonce)
  2. Invite hash is signed with server's private key using ECDSA (secp256k1 curve)
  3. User receives invite hash and signature
  4. On access, server verifies signature using public key before granting entry
Algorithm: ECDSA with SHA-256
Curve: secp256k1
Hash: SHA-256 (64-character hex)
2. Session Fingerprinting
Unique cryptographic session identifiers

Fingerprint Generation:

Each session creates a unique SHA-256 fingerprint combining multiple factors:

fingerprint = SHA-256(IP + User-Agent + Invite-Hash + Timestamp)

Purpose:

  • Uniquely identify each session for audit trails
  • Enable leak tracking by tying assets to specific sessions
  • Detect session hijacking attempts
  • Provide transparency (visible in footer and console)
3. IP Binding
Hardware-level access control

Implementation:

  1. On first use of an invite, the client's IP address is recorded
  2. IP binding hash is created: SHA-256(invite-hash + IP)
  3. All subsequent requests must originate from the same IP
  4. Requests from different IPs are automatically denied with audit logging

IP binding prevents invite sharing. Once bound, the invite cannot be used from any other location.

4. Admin Signature Authentication
Zero-password challenge-response system

Challenge-Response Flow:

  1. Admin requests access and receives a random nonce (challenge)
  2. Admin signs the nonce with their private key offline
  3. Admin submits signature and public key to server
  4. Server verifies signature matches the challenge using the public key
  5. Server checks if public key is authorized in database or environment
  6. If valid, admin session is created (2-hour expiry)
Security Benefits:
  • No passwords to steal or crack
  • Private key never transmitted
  • Challenge expires in 5 minutes
  • Each authentication uses unique nonce
5. Watermarking & Leak Tracking
Canary tokens and forensic tracing

Multi-Layer Tracking:

  • Visual Watermarks: Semi-transparent session ID and timestamp overlay on every page
  • Tracking Pixels: 1x1 invisible images with unique signatures on each page load
  • Asset Signatures: All URLs include session-specific canary tokens
  • Database Logging: Every asset access is logged with IP, user-agent, and timestamp

Leak Detection:

If content is leaked (screenshot, shared link, etc.), the watermark or signature can be traced back to the exact session, invite, and user who accessed it. All tracking data is available in the admin panel.

6. Comprehensive Audit Logging
Full security event tracking

Logged Events:

Invite verification attempts
Session creation/resumption
IP binding creation
IP mismatch violations
Admin authentication
Asset access tracking

All logs include timestamp, IP address, user-agent, and contextual details. Logs are immutable and stored in PostgreSQL for forensic analysis.

Technical Stack

Frontend:
  • Next.js 15 (App Router)
  • TypeScript
  • React Server Components
  • Tailwind CSS
Backend:
  • Next.js API Routes
  • Node.js Crypto Module
  • PostgreSQL (Neon)
  • Edge Runtime Compatible
Cryptography:
  • ECDSA (secp256k1)
  • SHA-256 Hashing
  • Cryptographically Secure RNG
Deployment:
  • Docker Compose
  • GitHub Codespaces Ready
  • Environment Variables

Security Architecture Documentation