DOC TYPE: operations_policy·Version 1.0 · Effective 16 October 2026

OASIS — Platform Operations, Backup & Cookie Policy

Operational specifications, strictly necessary cookie schedules, server rate limits, and ClamAV antivirus file security standards for the OASIS infrastructure.

Strict Zero-Tracking Commitment

OASIS uses only strictly necessary first-party cookies required to securely authenticate your session and prevent CSRF forgery. We do not use third-party advertising cookies, cross-site tracking pixels, or marketing analytics scripts, and we never store session credentials in browser localStorage.

§ 1Complete Schedule of Cookies & Storage

oasis_sidFirst-Party Cookie

Attributes: HttpOnly, Secure (prod), SameSite=Lax

Lifespan: 24 hours sliding; 7 days absolute maximum

Purpose: Stores an opaque 32-byte session token (hashed with SHA-256 in database) to authenticate REST (/api/v1) and WebSocket (/ws) sessions.

CSRF Token CookieFirst-Party Cookie

Attributes: Readable by same-origin JS, Secure (prod), SameSite=Lax

Lifespan: Session lifetime (refreshed automatically on 403 csrf)

Purpose: Double-submit token verified against the X-CSRF-Token HTTP header on all state-changing API operations.

OAuth State & PKCEFirst-Party Cookie

Attributes: Signed, HttpOnly, Secure (prod), SameSite=Lax

Lifespan: 10 minutes (cleared immediately on callback)

Purpose: Secures state parameter and PKCE code_verifier during Google Sign-In (/api/v1/auth/google).

Registration DraftsessionStorage

Attributes: Same-origin tab storage (non-sensitive fields only)

Lifespan: Cleared on registration submit or tab close

Purpose: Preserves multi-step onboarding wizard progress so applicants do not lose input on page refresh.

Theme PreferencelocalStorage

Attributes: Same-origin UI preference (light / dark)

Lifespan: Persistent until cleared by user

Purpose: Remembers your visual theme choice (Light Ivory or Dark Navy).

§ 2Server-Side Rate Limits (HTTP 429 Protection)

To protect the community against brute-force attacks, directory scraping, and API abuse, OASIS enforces automated rate limits returning HTTP 429 Too Many Requests:

Login (POST /auth/login)

5 attempts per 15 min

Per IP + Email

Registration (POST /auth/register)

3 attempts per hour

Per IP address

Password Reset / Resend Email

3 requests per hour

Per Email + IP

Phone Verification OTP

3 per hour / 10 per day

Per authenticated user (5 wrong attempts lock)

Mentor Connection Requests

10 requests per 24 hours

Per member; 14-day expiry; 7-day cooldown

Global Directory Search (/search)

60 requests per minute

Per authenticated member (anti-scraping alerts)

Public Endpoints (/legal, /config)

30 requests per minute

Per IP address

Support / Grievance (/support/contact)

5 requests per hour

Per authenticated user / IP

§ 3File Upload & Antivirus Security Standards

Every file uploaded to OASIS is validated against MIME types and binary magic bytes, scanned by ClamAV antivirus, and stored in private S3 buckets with server-side encryption (AES256):

Profile PhotosMax 2 MB

JPEG or PNG only; processed in memory to strip EXIF metadata.

Achievement ImagesMax 5 MB

JPEG or PNG only; reviewed by moderators before live display.

Evidence AttachmentsMax 10 MB

PDF, JPEG, or PNG; accessible only to reviewing admins via signed URLs.