Security

Latitude is designed to keep access and changes under control.

Authentication

• Authentication uses a server-side session with an HttpOnly cookie.
• Access tokens are not stored in the browser.
• In production, the cookie must travel over HTTPS with Secure enabled.

Roles

The application distinguishes between:

• Administration: manages users, master data, parameters and audit.
• User: accesses and operates on permitted data.

Permissions are enforced on the server, not only in the interface.

Write protection

Operations that modify data require CSRF protection. The client obtains the token and sends it with write requests.

Audit

Relevant operations are recorded with user, method, path, status and duration. The audit is available from administration and has a configurable retention.

Deployment recommendations

1. Use HTTPS and a secure session cookie.
2. Define your own credentials; do not reuse demo ones.
3. Limit administrative access.
4. Review CORS and allowed origins.
5. Keep dependencies and the system updated.

Limits

This documentation describes the product; it does not certify a specific environment. Before using real data, review security and privacy with your team.