Authentication and Security

OpsKnight implements defense-in-depth to protect authentication flows, sessions, and sensitive data.

Security Controls

Risk	Protection	Notes
Brute force	Rate limiting + lockouts	Progressive lockouts after failures
User enumeration	Uniform responses	Same response for valid/invalid users
Session hijacking	Token versioning	Invalidates old sessions immediately
Timing attacks	Constant-time responses	Prevents side-channel leaks
Privilege abuse	Audit logging + admin controls	Sensitive actions logged

Mode	Duration
Standard	7 days
Remember Me	30 days

Sessions can be revoked in Settings → Profile & Preferences → Security.

Authentication events are recorded in audit logs for compliance and investigation.