Security
What is verified, and where it is verified.
An object store's failures tend to return success: a tampered body stored, a corrupt read served, an operation routed to the wrong handler. The server is built so that each of those is refused at a named place instead.
Requests
Every request signed. Every unknown one refused.
- SigV4 in every form: header, presigned URL and
aws-chunkedstreaming with trailers. The implementation reproduces AWS's published examples, and each example altered in one place is refused. - Anonymous requests are refused. There is no public-read mode to forget about.
- Dispatch by name, refuse the rest. Each of the 116 operations of the S3 model is signed, sent and answered in tests; an unknown or misplaced parameter is refused before any operation runs, so an unsupported subresource can never fall through to an overwrite.
- Back-pressure is an answer. Past the in-flight limit a request gets
503 SlowDown, never a queue that grows until the node falls over.
- PUT /media/a.jpgSigV4 ✓ · SHA-256 ✓ · CRC64NVME ✓200 OK
- PUT /media/b.jpgbody differs from its declared hash400 BadDigest
- PUT /media?websiteoperation not implemented501 NotImplemented
- GET /media/a.jpgsignature from another secret403 SignatureDoesNotMatch
Integrity
A checksum accepted is a checksum checked, and kept.
Content-MD5 and the whole x-amz-checksum-* family are validated before a write is acknowledged and stored so a read can return them. Underneath, every 1 MiB block carries a BLAKE3 hash checked on every read; a block that fails is rebuilt from parity and its shard listed for healing.
Between nodes
Mutual TLS, admitted members, nothing else.
The internal shard surface speaks only TLS 1.2 or 1.3 with client certificates. A node whose certificate is issued for another name does not start; a call reaches another node only when that node's certificate is issued for the node dialled and the node is an admitted member. A removed member is refused everywhere within five seconds.
Metadata travels to TessariDB over TLS against a certificate authority you give the server, as an account that can read and write one database and nothing else.
Access
Keys that are sealed, scoped and revocable.
- Users' access-key secrets are sealed with a key derived per space; the metadata never holds one in the clear.
- Grants are per bucket. A revoked key is refused on every node within the five-second resolution window.
- One-key upload credentials write exactly one object, expire on their own, and stop when their issuer loses access.
- The console signs in through OpenID Connect with a required second factor, can be made provider-only, and keeps the root key as a recorded, announced, 15-minute break-glass path.
Record
An action record nobody can edit.
Every console change and download is written with the signed-in identity and the operator's reason before it takes effect; a record that cannot be written refuses the act. It is kept a year in TessariDB, which refuses to change or remove an entry.
Found something? Write to security@tessaridb.com.