Security Model

Strata v0 uses one shared secret. The secret grants access to all documents and the admin page.

Authentication

Set STRATA_TOKEN to a strong value. An application sends the value in the WebSocket URL:

wss://example.com/socket/websocket?token=<STRATA_TOKEN>

The server compares the token in constant time. It returns HTTP 403 before the WebSocket opens when the token is missing or incorrect.

Access scope

Strata v0 has no user accounts, roles, document permissions, tenant separation, or token revocation. A person who has the token can:

• join and change any document;
• create and delete child documents;
• read all document ids in the admin page;
• read presence names and colors.

Use one Strata deployment for one trust boundary. Give separate trust boundaries separate tokens and data directories. A document prefix such as tenant-a: is a naming convention, not an access rule. A token holder can join another prefix or send its document IDs in mutation frames.

The server does not verify JWT signatures or claims. It treats the token as an opaque shared secret, even if the value has JWT syntax. JWT verification and server-enforced tenant isolation remain post-1.0 work in #3.

Protect the token

Use TLS and wss outside local development. Query values can appear in browser history, reverse-proxy logs, access logs, and monitoring data. Configure those systems to remove the token query value.

The admin page reads the token from its own URL. Strata cannot use a separate admin credential in v0.

To rotate a token, update the server and all applications as one operation. Existing sockets can remain open until they disconnect. Restart the server if you must close them at once.

Origin policy

STRATA_ALLOWED_ORIGINS limits browser origins that can open a WebSocket. It does not replace authentication. Non-browser software can set an Origin header or omit it.

Reverse proxy

Use a reverse proxy for TLS, request logs, per-IP rate limits, and network access rules. Strata applies message limits to each socket, not to each IP address.