System Security Configuration
System Security Configuration governs the platform's own access security (login, passwords, sessions); it is unrelated to the payment-domain Payment Security and Risk Control. Menu path: System Management → System Config → System Security Configuration.
The left side lists six configuration panels; edit and save on the right. Under each panel title sits a persistent summary tag of the current configuration, so the active policy is clear at a glance.
Password Policy
Constrains password complexity and rotation for all users:
| Setting | Description |
|---|---|
| Min / max length | 6~32 characters; a minimum of at least 8 is recommended |
| Complexity requirements | Uppercase letters, lowercase letters, digits and special characters can each be enforced; with special characters checked, the allowed character set can be customized |
| Rotation period (days) | Password validity, 0 = never expires; changes apply to all users at their next login |
| Expiry reminder (days) | Remind on the login page and in the profile N days before expiry |
| History count | The last N passwords cannot be reused; 0 = no limit |
Works together with "initial passwords"
Random passwords generated when adding users or resetting passwords also follow this policy; expired users are forced to change theirs — see the expiry reminder in Profile.
Login Security
Defenses against failed logins:
- Failure lockout: once consecutive failures reach the threshold (1~10), the account is locked for a period (in minutes); the failure counter resets when no new failure occurs within the counting window.
- CAPTCHA trigger: once failures reach the threshold (no greater than the lockout threshold), the login page requires a CAPTCHA first, blunting brute-force attempts.
Lock and unlock records are in "Login Lockout" under Logs and Monitoring.
Session Management
Controls the duration and concurrency of login sessions:
| Setting | Description |
|---|---|
| Max online duration | Maximum lifetime of a single session (hours) |
| Max active duration | How long a session survives without activity; 0 = no limit |
| Max concurrent sessions | Number of sessions an account can hold simultaneously (1~10) |
| Concurrency scope | Global shared (one quota across all clients) or per client (admin panel and merchant panel counted separately) |
| Over-limit policy | Allow new session / kick the earliest session / reject the new session |
Kicked sessions can be seen as "offline" on the Online Users page.
Two-Factor Authentication (2FA)
- When the switch is on, users can bind TOTP one-time codes themselves in Profile (Google Authenticator and similar authenticator apps).
- Configurable: the issuer name shown in authenticator apps and the number of backup codes (10~20).
- When the platform leaves it off, the binding entry is hidden on the user side; whether already-bound users are affected by turning it off follows the login page's actual behavior (once turned off, login no longer verifies the dynamic code).
Passkeys
Lets users log in passwordless with fingerprint / face / PIN; once bound, login is exempt from two-step verification:
| Setting | Description |
|---|---|
| Site domain | Bare domain the passkeys are bound to (e.g. admin.example.com; localhost for local debugging), without protocol or port |
| Display name | Site name shown in the system dialog |
| Allowed origins | Full addresses (protocol + domain + port) allowed to use passkeys; multiple entries allowed. When both the admin panel and the merchant panel enable passkeys, add both addresses |
The cost of changing the domain
Changing the site domain invalidates every bound passkey; users must re-bind. The system asks for confirmation again on save. Passkeys require the page to be HTTPS (local localhost excepted).
Anti-Replay Verification
Prevents intercepted request messages of sensitive operations (login, registration, password change, etc.) from being replayed:
- Nonce validity (seconds): how long the platform-issued one-time random value stays valid;
- Timestamp tolerance (seconds): maximum allowed deviation between the request time and the server time.
Disabling it strips the protection
When disabled, every sensitive endpoint marked for replay protection skips verification. Turn it off only temporarily — while troubleshooting integration problems or in isolated intranet environments — and restore it immediately after verification.
Related Links
- Profile: user-side password change, 2FA binding and passkey management
- Logs and Monitoring: login lockout, online users and login logs