plugin-api-server-security

Audit Canvas plugin API endpoints by validating mixin usage, access controls, and secret management for SimpleAPI and WebSocket handlers. Apply built-in authentication mixins and document findings via a security checklist to ensure proper authentication and authorization.

Secure WebSocket handlers by applying built-in authentication mixins such as APIKeyAuthMixin to validate credentials and scope access. Review patterns to protect patient data and ensure proper authorization controls are enforced during development and deployment.

APIKeyAuthMixin works by providing a built-in authentication pattern for SimpleAPI handlers to validate API credentials and reduce boilerplate. It improves auditability by enforcing recommended access controls and scoping access to protect patient data.

Using StaffSessionMixin and PatientSessionMixin is recommended to reduce boilerplate and improve auditability when reviewing Canvas plugin security. These built-in authentication mixins validate credentials, scope access, and ensure proper authorization for API endpoints.

Check for missing or incorrect mixin usage, unvalidated credentials, improperly scoped access controls, and unmanaged secrets during a Canvas plugin security review. Document these common vulnerabilities using a practical security checklist to ensure remediation before deployment.