Security

Security model

The AJ Smart FHIR Platform implements defence-in-depth across every layer.

Authentication + token security

Control	Implementation	Detail
PKCE S256	requireProofKey(true)	96-byte verifier, S256 challenge — no opt-out
Launch tokens	Atomic SQL UPDATE WHERE used=false	Single-use, 5-minute expiry, race-condition safe
JWT signing	RS256, 2048-bit RSA	JWKS endpoint, automatic key rotation support
id_token	Full Nimbus RS256 verification	RemoteJWKSet — verifies signature, iss, aud, exp, nonce
Token refresh	Rotation enforced	reuseRefreshTokens(false)
Session fixation	changeSessionId()	Spring Security default protection
CSRF	CookieCsrfTokenRepository	httpOnly=false for JS access where required

Data protection

• Bearer tokens are masked in all log output — SmartLaunchContext.toString() redacts access_token
• No PHI in log files — patient IDs logged only at DEBUG level
• Log injection prevented — error parameters sanitised with replaceAll("[\r\n\t]", "_")
• PostgreSQL credentials have no hardcoded defaults — startup fails fast if not set

Network security

• All production endpoints require HTTPS — iss validation rejects HTTP for non-localhost origins
• ISS userinfo@ bypass blocked — URI.getUserInfo() != null check prevents authority parsing attacks
• JWKS endpoint is public (read-only RSA public key) — no authentication required

Persistent RSA key (production requirement)

Without a keystore, a new RSA key pair is generated on every server restart. All existing tokens become invalid.

Generate a persistent keystore for production:

keytool -genkeypair -alias smart-fhir-server \
  -keyalg RSA -keysize 2048 -storetype PKCS12 \
  -keystore smart-fhir-server.p12 -validity 3650

Set KEYSTORE_PATH and KEYSTORE_PASSWORD environment variables.

Vulnerability disclosure

Security vulnerabilities must be reported privately — do not open a public GitHub issue.

Email: security@ajsmart.com

PGP key: Available on request

Response times:

• Acknowledgement: within 24 hours
• Initial assessment: within 72 hours
• Enterprise/Government customers: security patches within 24 hours of confirmed vulnerability

Compliance

Framework	Status	Detail
HIPAA	Supported	Audit trail, access controls, minimum necessary principle
GDPR	Supported	Consent lifecycle, right to withdraw, audit log
HTI-1 / TEFCA	Compliant	SMART App Launch v2.2 as mandated
IHE ATNA	In progress	FHIR AuditEvent logging — v1.1.0
ISO 27001	Roadmap	Security management framework alignment

Penetration testing

Enterprise and Government support customers can request a copy of the most recent security assessment report. Contact support@ajsmart.com.