Features How It Works Analytics About FAQ Docs Contact
Get Started

Security & Sessions

Engineering data is critical infrastructure. A drill plan handed to a site operator must be exactly what the design engineer approved — no corrupted saves, no mid-session data loss, no unauthorized access. BlastCAD's security architecture is built around this principle.

Authentication

JWT (JSON Web Tokens)

BlastCAD uses JWT (JSON Web Token) authentication for all API communication. On a successful login:

  1. The server issues a signed JWT containing your user identity and expiration timestamp.
  2. The token is stored securely in browser localStorage under the key blastcad_token.
  3. Every subsequent API request attaches the token in the Authorization: Bearer <token> header.
  4. The server validates the signature and expiration on every request — no session state is maintained server-side.

Token lifetime: 1440 minutes (24 hours) from login.

Two-Factor Authentication (2FA)

BlastCAD supports TOTP (Time-based One-Time Password) two-factor authentication, compatible with any standard authenticator app (Google Authenticator, Authy, Microsoft Authenticator, 1Password, etc.).

Enabling 2FA:

  1. Go to User Menu → Profile Settings → Security.
  2. Click Enable 2FA.
  3. Scan the displayed QR code with your authenticator app.
  4. Enter the first 6-digit code to confirm pairing.
  5. Store the backup codes in a secure location.

Once enabled, every login requires both your password and the current TOTP code. Admin accounts are strongly recommended to enable 2FA.

Disabling 2FA:

  • Go to Profile Settings → Security → Disable 2FA.
  • Requires your current TOTP code to confirm.

Rate Limiting

Login attempts are rate-limited to 5 requests per minute per IP address. Exceeding this limit returns 429 Too Many Requests. This prevents brute-force credential attacks.

Registration is rate-limited to 3 requests per hour per IP address.

Registration & Password Delivery

When a new user registers (or is created by an admin), BlastCAD generates a random, strong password and emails it to the user's address. There is no user-chosen password at registration. This design means:

  • The user must have access to their email inbox before they can log in.
  • A correct login with the emailed password implicitly confirms email delivery — no separate verification link is required.
  • If a user forgets their password, they cannot self-reset. They must contact their administrator, who can generate and email a new password from the Admin Panel.

There is no "Forgot Password" link on the login page — this is intentional.

AuthGuard — Session Protection

The most dangerous failure mode in a CAD application is the "ghost login": the server's JWT has expired, but the UI remains fully active. Any save attempt with an expired token results in a 401 Unauthorized response — and potentially hours of unsaved work are lost.

BlastCAD eliminates this risk with AuthGuard — a client-side sentry that sits between every API call and the server.

How AuthGuard Works

Every HTTP response from the backend passes through a centralized Axios interceptor:

Client → API Request → Server
Server → Response → Axios Interceptor
                         ↓
                   HTTP 200? → Process normally
                   HTTP 401? → Trigger AuthGuard lockdown
                   HTTP 403? → Show "Access Denied" message

The Lockdown Sequence

When a 401 Unauthorized response is intercepted:

  1. Global state update: isSessionExpired = true is set in the application store.
  2. Interface freeze: A full-screen, blurred overlay locks the entire workspace. No further user actions or API calls are possible.
  3. Data preservation: The complete current project state (all holes, CAD entities, charges, layers) remains intact in memory — frozen but not lost.
  4. Re-authentication prompt: A modal prompts the user to log back in. The session recovery does not require a page reload.
  5. Seamless resume: Once the new token is issued, the overlay is dismissed and the workspace is exactly as it was before the token expired.

No data loss by design. The AuthGuard lockdown is triggered by any 401 response — including token expiry during a long design session. Engineers can safely work for up to 24 hours before needing to re-authenticate.

Auto-Save & Recovery

Even AuthGuard's lockdown cannot protect against browser crashes or accidental tab closure. BlastCAD mitigates this with IndexedDB auto-save:

  • Every time you save your project (using the Save button in the top bar), a recovery snapshot is written to the browser's local IndexedDB. If BlastCAD crashes before you save, you may lose unsaved changes — save frequently.
  • On next launch, if a recovery snapshot is detected, BlastCAD prompts: "A previous session was detected. Would you like to recover it?"
  • Accepting restores the full project state including all holes, CAD entities, and charges.

The recovery snapshot is automatically deleted when you explicitly save a .bcp file or clear the project.

Role-Based Access Control

BlastCAD supports two user roles:

Role Capabilities
User Full access to design, import/export, database management, and analytics
Admin All user capabilities + user management and account administration

Admin Panel

Admin accounts can access the Admin Panel from the top bar. It provides user management and account administration capabilities. Contact your administrator if you need access provisioned, your password reset, or your 2FA cleared.

Block Model Import Security

Datamine block models are processed entirely client-side via a Web Worker to avoid uploading potentially confidential geological data to the server. BlastCAD handles authorization with:

  1. HMAC token request: Before completing a model import, the client requests a time-limited HMAC token from the server (POST /api/import/request_model_token).
  2. Timestamp verification: The token contains a timestamp. The server rejects any request with a token older than 5 minutes.
  3. Signature verification: The server validates the HMAC signature and logs the import event, but does not store block model geometry. All block model data remains in the browser session only, consistent with BlastCAD's frontend-only geometry architecture.

This ensures that only authenticated, time-valid sessions can initiate model imports (geometry remains client-side only).

Session Hygiene

On explicit logout:

  1. The JWT token is removed from localStorage.
  2. The IndexedDB recovery snapshot is cleared.
  3. All in-memory project state is reset.
  4. The browser is redirected to the login page.

No sensitive project data persists in the browser after logout. This is particularly important on shared workstations.

Security Best Practices

Recommendation Reason
Enable 2FA on all accounts Prevents credential-only attacks
Use Chrome or Edge in a dedicated browser profile Isolates BlastCAD sessions from other browser tabs
Do not share login credentials Audit logs track actions per user account
Save .bcp files regularly Supplements auto-save with explicit version snapshots
Log out when leaving a shared workstation Prevents unauthorized access to an unlocked session
Keep the browser updated WebGL2 security patches are delivered via browser updates