# Security Best Practices for Backend Architects in the architect-awesome Repository

> Find backend security best practices for architects in xingshaocheng/architect-awesome. Explore web, server, and data security guides including TLS, crypto, hardening, and key management.

- Repository: [xingshaocheng/architect-awesome](https://github.com/xingshaocheng/architect-awesome)
- Tags: best-practices
- Published: 2026-03-05

---

**The xingshaocheng/architect-awesome repository consolidates backend security best practices in the "安全" (Security) section of README.md, covering Web Security, Server Security, and Data Security with specific guidance on TLS configuration, cryptographic standards, Linux hardening, and encryption key management.**

Backend architects designing distributed systems must address security at every layer. The xingshaocheng/architect-awesome repository provides a comprehensive security reference in its README.md file, organizing critical protections into three distinct domains. This guide examines the specific file locations, implementation details, and practical code examples that backend architects can apply immediately.

## Locating the Security Section in README.md

The primary security guidance resides in the [`README.md`](https://github.com/xingshaocheng/architect-awesome/blob/main/README.md) file at the repository root. Within this document, the **"安全"** (Security) section aggregates backend-focused security recommendations across three specialized subsections.

The three subsections include:

- **Web 安全** (Web Security): Covers HTTP service protection, TLS/HTTPS implementation, secure cookie configurations, and cryptographic algorithm selection.
- **服务器安全** (Server Security): Details Linux server hardening procedures, firewall configurations, SSH key management, and privilege separation strategies.
- **数据安全** (Data Security): Addresses encryption for data at rest and in transit, key lifecycle management, database access controls, and safe deployment practices including gray-release strategies.

Each subsection contains specific line references and implementation patterns that architects can trace directly in the source documentation.

## Web Security Best Practices for Backend Systems

### Cryptographic Standards and TLS Configuration

The repository explicitly deprecates weak cryptographic algorithms. According to line 1615 of [`README.md`](https://github.com/xingshaocheng/architect-awesome/blob/main/README.md), backend systems must **avoid MD5 and SHA-1** for any security-sensitive operations. Instead, the documentation recommends migrating to **SHA-256** or stronger hashing algorithms.

For public-key cryptography, line 1624 specifies the use of **ECC (Elliptic Curve Cryptography) with 256-bit keys**, providing equivalent security to traditional RSA keys with significantly smaller key sizes and improved performance.

Transport Layer Security implementation guidance appears around lines 1304-1306, emphasizing:

- Enforcement of TLS 1.2 or higher
- Use of certificates from trusted Certificate Authorities
- Proper configuration to prevent man-in-the-middle attacks

### Secure Authentication and Session Management

Lines 1269-1270 address authentication protocol security, recommending secure token transmission and protocol conversion mechanisms. Backend architects should implement:

- **Signed JWTs** or OAuth2 flows for stateless authentication
- **HttpOnly, Secure, and SameSite=Strict** cookie attributes to prevent XSS and CSRF attacks
- Session timeout mechanisms and secure token storage

## Server Security Hardening Strategies

### Linux Server Hardening Methodology

Line 1630 references a comprehensive **15-step Linux hardening guide** that backend architects should apply to production servers. Key steps include:

1. Disabling unused services and removing unnecessary packages
2. Enabling host-based firewalls (`iptables` or `firewalld`)
3. Configuring automatic security updates
4. Implementing intrusion detection systems

### SSH and Access Control Configuration

The server security subsection emphasizes SSH key-based authentication over password-based methods. The recommended configuration in `/etc/ssh/sshd_config` includes:

```bash
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin prohibit-password

```

Additional recommendations include:

- Implementing **privilege separation** to limit blast radius of compromised accounts
- Regular rotation of SSH keys and certificates
- Monitoring authentication logs for brute-force attempts

## Data Security and Protection Mechanisms

### Encryption for Data at Rest and In Transit

The data security section (around lines 1629-1632) mandates encryption strategies for both storage and transmission. Backend architects should:

- Apply **AES-256-GCM** or equivalent for encrypting sensitive database fields
- Implement **TLS 1.3** for all data transmission between services
- Use hardware security modules (HSMs) or cloud KMS for key storage when possible

### Key Lifecycle and Database Access Control

Effective key management requires:

- Regular key rotation schedules (automated where possible)
- Separation of encryption keys from encrypted data
- Database accounts with **principle-of-least-privilege** permissions
- Audit logging for all data access operations

### Safe Deployment with Gray-Release Strategies

Line 1765 references **gray-release** (canary deployment) practices to minimize security risks during updates. Implementation involves:

- Routing small percentages of traffic to new versions
- Automated rollback triggers based on error rates or security alerts
- Feature flags to disable risky functionality without full redeployment

## Practical Implementation Examples

The following code snippets demonstrate the security patterns documented in the architect-awesome repository.

### Spring Boot TLS Configuration

To enforce TLS 1.2+ in a Java backend service:

```yaml

# src/main/resources/application.yml

server:
  port: 8443
  ssl:
    enabled: true
    key-store: classpath:keystore.p12
    key-store-password: ${KEYSTORE_PASSWORD}
    key-store-type: PKCS12
    protocol: TLS

```

This configuration aligns with the repository's guidance on using trusted CA certificates and modern TLS protocols (lines 1304-1306).

### Secure Password Hashing with BCrypt

For Node.js applications, replace deprecated MD5/SHA-1 with adaptive hashing:

```javascript
const bcrypt = require('bcrypt');
const SALT_ROUNDS = 12;

async function hashPassword(plain) {
  return await bcrypt.hash(plain, SALT_ROUNDS);
}

async function verifyPassword(plain, hash) {
  return await bcrypt.compare(plain, hash);
}

```

This implements the repository's recommendation to avoid weak hash algorithms (line 1615) and use modern cryptographic standards.

### Hardened Cookie Configuration in Express

Prevent XSS and CSRF attacks using secure cookie attributes:

```javascript
app.use((req, res, next) => {
  res.cookie('sessionId', token, {
    httpOnly: true,
    secure: true,
    sameSite: 'strict',
    maxAge: 60 * 60 * 1000
  });
  next();
});

```

This applies the authentication security guidance found in lines 1269-1270.

### SSH Server Hardening

Implement key-based authentication by modifying `/etc/ssh/sshd_config`:

```bash
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin prohibit-password

```

This configuration supports the 15-step Linux hardening methodology referenced at line 1630.

### Database Field-Level Encryption

For PostgreSQL, implement encryption at rest using the `pgcrypto` extension:

```sql
-- Enable extension
CREATE EXTENSION IF NOT EXISTS pgcrypto;

-- Add encrypted column
ALTER TABLE users
  ADD COLUMN ssn_encrypted BYTEA;

-- Encrypt existing data
UPDATE users
SET ssn_encrypted = pgp_sym_encrypt(ssn::text, 'my_secret_key');

-- Decrypt query
SELECT pgp_sym_decrypt(ssn_encrypted, 'my_secret_key')::text AS ssn 
FROM users;

```

This demonstrates the data security encryption strategies documented in lines 1629-1632.

## Summary

- The **xingshaocheng/architect-awesome** repository organizes backend security guidance in the **"安全"** (Security) section of [`README.md`](https://github.com/xingshaocheng/architect-awesome/blob/main/README.md), divided into Web Security, Server Security, and Data Security.
- **Cryptographic standards** require abandoning MD5/SHA-1 (line 1615) in favor of SHA-256 and ECC 256-bit keys (line 1624), with TLS 1.2+ enforcement for all transport layers.
- **Server hardening** follows a documented 15-step Linux methodology (line 1630) emphasizing SSH key-based authentication, firewall configuration, and privilege separation.
- **Data protection** strategies include field-level encryption, secure key lifecycle management, and gray-release deployment patterns (line 1765) to minimize security risks during updates.

## Frequently Asked Questions

### Where exactly is the security section located in the architect-awesome repository?

The security best practices are located in the [`README.md`](https://github.com/xingshaocheng/architect-awesome/blob/main/README.md) file at the root of the xingshaocheng/architect-awesome repository, specifically under the **"安全"** (Security) heading. This section begins around line 1269 and spans multiple subsections covering Web Security, Server Security, and Data Security with specific line references to implementation details.

### What specific cryptographic algorithms does the repository recommend avoiding?

According to line 1615 of the README.md, backend architects must **avoid MD5 and SHA-1** for any security-sensitive operations including password hashing and data integrity verification. The repository explicitly recommends migrating to **SHA-256** for hashing and **ECC (Elliptic Curve Cryptography) with 256-bit keys** (line 1624) for public-key operations, offering equivalent security to RSA with better performance.

### How does the repository suggest securing Linux servers in production?

The architect-awesome repository references a **15-step Linux hardening methodology** (line 1630) that includes disabling unused services, enabling host-based firewalls like `iptables` or `firewalld`, and configuring SSH to use key-based authentication only by setting `PasswordAuthentication no` in `/etc/ssh/sshd_config`. Additional recommendations include implementing privilege separation, regular security updates, and intrusion detection systems to minimize the attack surface.

### What deployment strategy does the repository recommend to minimize security risks during updates?

To limit the blast radius of potentially faulty or insecure updates, the repository advocates for **gray-release** (canary deployment) strategies as documented around line 1765. This approach involves routing a small percentage of production traffic to new versions while monitoring for security anomalies or errors, with automated rollback capabilities triggered by security alerts or elevated error rates. Feature flags complement this strategy by allowing rapid disabling of specific functionality without requiring full redeployment.