Controls implemented by this utility
A technical summary of the protections used for this focused authorization workflow.
Operator access
Management actions require an administrator session, an exact same-origin request, and a CSRF token. Sessions use Secure, HttpOnly, SameSite=Lax host-only cookies with a fixed eight-hour lifetime; logout, administrator access-phrase rotation, and session-version rotation revoke them.
Authorization transaction
Amazon OAuth state has high entropy, a short lifetime, server-side seller/application/session binding and atomic one-time use. Authorization codes are not stored or automatically retried.
Encrypted export
Completed exports use a per-bundle AES-256-GCM envelope protected with RSA-3072 OAEP-SHA256. The browser receives ciphertext only; the private key remains local and separately protected.
Data scope
The utility handles seller identifiers, authorization metadata, temporary session and continuation data, and encrypted authorization bundles. Successful bundles remain available until an administrator explicitly deletes them.
Report a concern: email guyue1592@gmail.com.