casdoor

Casdoor Security Hardening Guide

Least-privilege permissions

• Limit agent access scope: Each agent should only request the minimum identity permissions it needs—if an agent only checks "is user logged in?", don't give it access to read user email or phone numbers.
• Rotate service credentials regularly: Casdoor itself needs credentials (passwords, API keys) to connect to your systems; change these at least every 90 days and immediately if anyone leaves your team.
• Separate admin from user roles: Only 1–2 designated people should have admin access to Casdoor settings; everyone else should use read-only or agent-specific accounts.
• Audit external integrations: If Casdoor connects to Google Workspace or Azure AD, grant it only the specific permissions needed (e.g., "read user email" but not "create users").

Network isolation

• Restrict Casdoor IP access: Run Casdoor behind a firewall that only allows your agents, web apps, and trusted admin locations to reach it; block public internet access.
• Use encrypted connections (HTTPS/TLS): All communication to and from Casdoor must be encrypted; never send identity credentials over unencrypted connections.
• Separate from public-facing services: Host Casdoor on an internal network or private cloud, not on the same server as your public website or chatbot.
• Disable unnecessary protocol endpoints: If you only use OAuth, turn off SAML, CAS, and LDAP interfaces to reduce attack surface.

Monitoring

• Log all login attempts and failures: Track who logged in, when, and from where; set alerts for repeated failed attempts (sign of break-in attempt).
• Alert on credential changes: Get notified immediately if admin passwords, API keys, or multi-factor settings are modified.
• Watch for unusual agent behavior: Monitor if an agent suddenly requests permissions it didn't before or tries to access user data outside its normal scope.
• Review external data flows weekly: Check that data flowing from Google Workspace or Azure AD into Casdoor is only what's expected; flag unexpected fields or volume spikes.

Red flags to watch for

• Casdoor project hasn't been updated in 6+ months: Unmaintained open-source projects may have unpatched security holes; verify recent commits and active community before using.
• Authentication errors appear in agent responses to users: If error messages from Casdoor show up in chatbot text, attackers could inject malicious instructions into those errors; always sanitize them.
• Multiple users sharing a single Casdoor account: Each person and system should have their own unique login; shared accounts hide who did what and make it impossible to revoke access from one person without affecting others.
• Data deletion requests ignored from connected systems: If you ask Casdoor to delete user data synced from Google Workspace, verify it actually deleted; lack of audit trails here suggests serious compliance risk.