Production Hardening & Architecture Security Report

Engineers: Principal Backend Engineer & DevSecOps Lead
Target System: AI Patient Onboarding FastAPI Microservice v1.0.0
Deployment Target: Dockerized Container Deployment / Cloud Infrastructure

1. System Architecture & Component Overview

[ Client / Web / Mobile ]
           │ (HTTPS / TLS 1.3)
           ▼
[ Reverse Proxy / Load Balancer ] (Nginx / Cloud Load Balancer)
           │ (Forwarded headers sanitized)
           ▼
[ FastAPI Application Service ] (Uvicorn / Docker Container)
   ├── Security Headers Middleware (X-Content-Type-Options, X-Frame-Options, Referrer-Policy)
   ├── Request Correlation Middleware (X-Request-ID)
   ├── Rate Limiting Middleware (Token Bucket Rate Limiter)
   ├── Service / Patient Authentication (Bearer / X-API-Key)
   └── IDOR Session Authorization (session.patient_id == auth.patient_id)
           │
     ┌─────┴──────────────────────────────┐
     ▼                                    ▼
[ SQLite Storage ]             [ External AI Services ]
 (onboarding_sessions,          ├── Google Gemini AI (gemini-3.6-flash)
  onboarding_state,             ├── Sarvam AI (Indic ASR & TTS)
  onboarding_messages)          └── OpenAI GPT-4o-mini (Fallback)

2. Implemented Production Hardening Safeguards

A. Environment & Debug Controls

Debug Protection: DEBUG=false enforced in production configuration.
Global Error Handling: Uncaught exceptions are intercepted by a global FastAPI handler in app/main.py, returning a sanitized { "success": false, "error": { "code": "INTERNAL_SERVER_ERROR", "message": "An internal error occurred" } } payload without revealing Python stack traces or file paths.

B. Request Correlation & Traceability

Request ID Tracking: Attached X-Request-ID middleware in app/main.py. Every HTTP request receives a unique tracking correlation ID in logs and headers.

C. CORS & Security Response Headers

Explicit Domain Binding: Replaced wildcard CORS (*) with explicit trusted domains (https://onboarding.skyheal.ai, http://localhost:5173).
HTTP Security Headers: Attached X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and Referrer-Policy: strict-origin-when-cross-origin.

D. Upload Security & Payload Size Limits

Payload & Upload Caps: Enforced 10MB file upload caps (MAX_UPLOAD_SIZE=10485760) in app/api/documents.py.
MIME Type Validation: Restricted document uploads to valid clinical formats (image/jpeg, image/png, image/webp, application/pdf). Executables (.exe, .sh, .bat) are rejected immediately with 400 Bad Request.

E. Containerization & Deployment Configuration

Dockerfile Security: Configured minimal python:3.11-slim base image running under a dedicated non-root user (appuser, UID 999). Docker health checks verify container readiness via /health.

3. Deployment Checklist

Environment template .env.example created.
Global exception handler attached to prevent error disclosure.
X-Request-ID request correlation middleware active.
CORS origins restricted to authorized domains.
Document upload MIME validation and 10MB size limits enforced.
Non-root Dockerfile & .dockerignore created.
Automated production security tests (tests/production/test_production_security.py) verified (5/5 Passed).

3.5 KiB Raw Blame History