Threat Modeling

Login with Local User Management

The application manages credentials itself: stores/hashes passwords, handles its own lockout.

Login with External User Management (SSO)

Sign-in is delegated to an external identity provider (e.g. Entra ID, Okta, Keycloak, Google Workspace) via SAML/OIDC.

Server-Side Sessions (Cookies)

Classic, stateful session with a server-side store, referenced via a cookie.

Stateless Tokens (JWT/PASETO)

Stateless, self-contained tokens (e.g. for SPA/API), no server-side session store.

Access Control / Authorization

Who may access which functions, data, or objects.

Registration & Password Recovery

Account creation, verification, password recovery — only relevant with local user management; with external SSO the identity provider handles this.

Multi-Factor / Step-up Authentication

Additional confirmation before sensitive actions (e.g. payment, deletion).

User Profile / Personal Data

Stored personal data (PII) in the user profile.

File Uploads

Users upload files (documents, images, attachments).

Multi-Tenancy

Multiple customers/organizations share the same application/database.

Data Exports / Reports

CSV/PDF exports, reporting features, GDPR data subject access requests.

Payments / Checkout

Shopping cart, checkout flow, pricing/discount logic.

Business Logic / Workflows

State machines, approval workflows, quotas/limits, discount codes.

Public API

Externally reachable API endpoints / web services.

Webhooks / Outbound Integrations

The application calls user-configured external URLs.

Third-Party / OAuth Connections

Connecting to external services via OAuth (Google, Microsoft, Slack, ...).

Email & Notifications

Emails sent by the application (password reset, invoices, alerts).

Chatbot / AI Assistant

LLM-based chat features, potentially with access to internal data (RAG).

Forms & Free-Text Input

Contact forms, comments, rich-text editors.

Search

Full-text search, filters, autocomplete.

Frontend / Client-Side Logic

Code executed in the browser (SPA, DOM manipulation).

Third-Party Scripts / Tags

Analytics, ads, chat widgets — third-party code in the frontend.

Admin / Backoffice Area

Internal area for staff — often the highest-value target.

Background Jobs / Queues

Asynchronous processing, message queues, scheduled tasks.

WebSockets / Server-Sent Events

Persistent connections for real-time data (chat, live updates, notifications).

WebRTC (Video/Voice/Chat)

Peer-to-peer media transmission (video/voice calls), including signaling and ICE/STUN/TURN.

CDN / Cache

Reverse proxy, CDN, or application cache in front of the application.

Development Environment / CI/CD & Source Control

Code repository, CI/CD pipeline, secrets management — a common source of accidentally published API keys and credentials (e.g. on push to GitHub).