Authentication
Secure user management and access control. KubeMate uses industry-standard security practices to protect your account and data. All authentication features are designed to prevent unauthorized access while providing a smooth user experience.
What It Does
Authentication is the absolute minimum you need to secure your account:
Secure login and signup with password hashing
Role-based access control (Admin/User)
24-hour session expiration
User banning for security enforcement
that's it!
Password Security
Bcrypt Hashing
Passwords are hashed using bcrypt before storage. This one-way hashing ensures we never see or store your actual password. Bcrypt is a proven, industry-standard algorithm for password security.
Secure Session Management
Sessions use HttpOnly cookies which are not accessible via JavaScript. This protects against XSS (cross-site scripting) attacks where malicious code could steal session tokens.
24-Hour Session Expiration
Sessions automatically expire after 24 hours for security. Users must log in again after this period, reducing the window of opportunity if credentials are compromised.
User Management
Create Users
Admins can create new user accounts with username and initial password. This is useful for onboarding new team members without sharing personal credentials.
Role-Based Access Control (RBAC)
Two roles available: Admin (full access to all features including user and cluster management) and User (limited access to assigned clusters and AI features).
Ban/Unban Users
Admins can ban users to prevent access. Banned users cannot log in even with correct credentials. Unban to restore access when needed.
Session Management
HttpOnly Cookies
Sessions use HttpOnly cookies which are not accessible via JavaScript. This protects against XSS (cross-site scripting) attacks where malicious code could steal session tokens.
24-Hour Expiration
Sessions automatically expire after 24 hours for security. Users must log in again after this period, reducing the window of opportunity if credentials are compromised.
Secure Token Generation
Session tokens are generated using cryptographically secure methods and validated on each request. Tokens are rotated periodically.
Why Users Love It
Simple and secure - Industry-standard bcrypt hashing protects passwords without complexity
Automatic session management - Sessions expire after 24 hours for security
Role-based permissions - Admins have full control, users limited to clusters
Configuration Details
To make things even easier, authentication is handled automatically by the application. You don't need to configure any authentication settings manually. All security features are enabled by default for maximum protection.
So you don't need to do anything more to start securing your account right now, however take your time reading the information below to get a deeper understanding about how these concepts work.