Contents
1. OAuth 2.0 & PKCE Authentication Protocol
Suloro Single Sign-On (SSO) implements industry-standard OAuth 2.0 with Proof Key for Code Exchange (PKCE - RFC 7636). This prevents authorization code interception attacks and ensures that access tokens can only be exchanged by verified client applications possessing the dynamic cryptographic code verifier.
Cryptographic Code Verifier
High-entropy SHA-256 code challenges ensure dynamic validation of authorization codes during client handshakes.
Granular Delegated Scopes
Applications only receive access to specific user-approved claims (Name, Email, Date of Birth) with least-privilege scoping.
2. Cryptography & Password Protection
Passwords are never stored in plaintext or reversible formats. Suloro uses salted memory-hard cryptographic hash algorithms that prevent GPU/ASIC brute-force dictionary attacks:
- Adaptive Exponential Rate Limiting: Exponential cooldowns are enforced after consecutive failed login attempts (30s, 60s, 120s, 300s, up to 900s) to neutralize automated credential stuffing.
- TLS 1.3 Transport Security: All endpoints enforce HTTPS with HSTS and Perfect Forward Secrecy.
- Token Lifecycle Management: Short-lived access tokens combined with secure refresh token rotation prevent session replay vulnerabilities.
3. Multi-Session & Device Sandboxing
Suloro Accounts support seamless multi-account switching on a single browser without session interference. Each account maintains isolated token sandboxes. Users can review active sessions in their dashboard and perform an instant global sign-out that invalidates refresh tokens across all connected devices simultaneously.
4. Modern Client-Side Storage & IndexedDB
To eliminate sluggish network roundtrips and enable lightning-fast account chooser transitions, Suloro leverages client-side IndexedDB caching. Stored local metadata is restricted to non-sensitive profile information and cryptographically signed session tokens. We do not use third-party tracking cookies or advertising pixels.
5. Zero Third-Party Advertising Telemetry
Unlike conventional platforms, Suloro contains zero third-party advertising SDKs, tracking pixels, or cross-site fingerprinting scripts. We do not monetize user attention or sell telemetry data.
6. Global Edge Reliability & DDoS Shielding
Suloro services are deployed across global Anycast edge networks with automated DDoS mitigation, origin cloaking, and sub-50ms response times worldwide, ensuring resilient 99.9% uptime.