Security for a small system
A small library doesn’t need bank-grade security. But it does need to keep strangers out of the librarian workspace and reader data from leaking. The decisions we made to achieve that.
Small systems are usually broken not by sophisticated hackers but by automated scripts that try passwords and look for common mistakes across thousands of sites. So the main thing is to close the common doors.
Fewer doors
- No self-registration. Only the librarian creates accounts.
- The first-run wizard locks itself permanently once the first librarian account is created. Otherwise, whoever opened a fresh installation before its owner could “set it up” for themselves.
Passwords and login
- Passwords must be at least 12 characters and are stored only as a strong hash. Even if the database leaked, it would contain no passwords.
- A temporary password from the librarian must be changed on first login.
- After five failed attempts, the address-plus-username pair is locked for 15 minutes. The counter is stored in the database rather than server memory, so a restart doesn’t reset it.
- It is the pair that gets locked, not the whole username: otherwise an attacker could deliberately lock the real librarian out.
Protecting every action
All permissions are checked by the server, not by the page in the browser. Every state-changing action carries a security token that only an open tab of the site itself knows. This protects against attacks in which another site tries to press a button on behalf of a logged-in user.
Internal data — for example, custom fields marked “librarian only” — is stripped out on the server and never reaches the reader’s browser.
What we don’t promise
Katlog is an experiment, not a certified product. Before working with real reader data, a library needs its own review — legal and technical.