The Security Pipeline

The security pipeline is the heart of B5 Secure. By default it subjects every request to a multi-stage series of checks before the request reaches your business logic. Each stage fails closed: if the required evidence is absent, the request is denied.

The stages

1. Cross-site scripting (XSS) screening. Inbound payloads are inspected for script injection before processing.
2. Authentication. The identity token is validated using the request’s authentication scheme (HMAC, Service-HMAC, AuthCookie or Service-Key), including IP-firewall, origin and sensitive-key checks.
3. Multi-factor (MFA). High-impact actions and identities require step-up verification.
4. Account verification. Unverified or password-expired identities are stopped.
5. Suspension. Suspended users or entities are blocked.
6. Authorization (ADA). The identity must possess an explicit permit for this action and this record.

Configuring the pipeline

Apply [Protect] to opt a controller or service into the full pipeline. Fine-tune behaviour for individual actions with attributes such as [AllowAnonymous], [MFANotRequired], [VerificationNotRequired], [AllowSuspendedUser] and [SkipActivityAuthorization] — each a deliberate, visible exception to the secure default.

[Protect]
// every action runs the pipeline
[AllowAnonymous]  // explicit, auditable exception
public OpResult Health() { ... }

How many checks are enough?

The guiding rule: the greater the impact or privilege, the more checks you enforce. Low-impact actions still run the pipeline; high-impact ones add MFA, IP-firewall and tighter permits on top.