Security Architecture: Zero Trust Principles

Traditional perimeter security:
  Internet ────► Firewall ────► Internal network (trusted)
                                  All services trust each other

Zero Trust:
  Internet ────► API Gateway (authenticate + authorise every request)
                  │
                  â–¼ Every service-to-service call also authenticated
              Service A ──mTLS──► Service B
              Service B ──mTLS──► Database
              Service A ──mTLS──► Service C

Standard TLS:
  Client ──────► Server (presents certificate)
  "I trust this server"

mTLS:
  Client (presents certificate) ◄──► Server (presents certificate)
  "I trust this server AND the server trusts me"

# Enable strict mTLS for the entire namespace
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT    # Reject any non-mTLS connections

# Allow only specific services to call the payment service
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: payment-service-policy
  namespace: production
spec:
  selector:
    matchLabels:
      app: payment-service
  action: ALLOW
  rules:
    - from:
        - source:
            principals:
              - "cluster.local/ns/production/sa/order-service"
              - "cluster.local/ns/production/sa/checkout-service"
      to:
        - operation:
            methods: ["POST"]
            paths: ["/charges", "/refunds"]

// Node.js HTTPS server with client certificate validation
import https from 'https';
import fs from 'fs';

const server = https.createServer({
  cert: fs.readFileSync('./certs/server.crt'),
  key: fs.readFileSync('./certs/server.key'),
  ca: fs.readFileSync('./certs/ca.crt'),      // CA that signs client certs
  requestCert: true,                          // Require client certificate
  rejectUnauthorized: true                    // Reject uncertified clients
}, (req, res) => {
  const clientCert = req.socket.getPeerCertificate();

  // Verify the service identity from the certificate
  if (clientCert.subject.CN !== 'order-service') {
    res.writeHead(403);
    res.end('Forbidden: untrusted service');
    return;
  }

  res.writeHead(200);
  res.end('Authorised');
});

OAuth2 / OIDC flow:
1. User clicks "Sign in with Google"
2. Browser redirects to Google's authorisation server
3. User authenticates with Google (your app never sees the password)
4. Google redirects back with an authorisation code
5. Your server exchanges the code for tokens
6. Google returns:
   - access_token: short-lived, used to call APIs
   - id_token: JWT containing user identity (email, name, sub)
   - refresh_token: long-lived, used to get new access tokens

// Express middleware: validate Google OIDC token
import { OAuth2Client } from 'google-auth-library';

const oauthClient = new OAuth2Client(process.env.GOOGLE_CLIENT_ID);

async function authenticateUser(req: Request, res: Response, next: NextFunction) {
  const authHeader = req.headers.authorization;
  if (!authHeader?.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'Missing authorization header' });
  }

  const idToken = authHeader.substring(7);

  try {
    const ticket = await oauthClient.verifyIdToken({
      idToken,
      audience: process.env.GOOGLE_CLIENT_ID
    });

    const payload = ticket.getPayload();
    if (!payload?.email_verified) {
      return res.status(401).json({ error: 'Email not verified' });
    }

    req.user = {
      id: payload.sub,
      email: payload.email!,
      name: payload.name
    };

    next();
  } catch (err) {
    return res.status(401).json({ error: 'Invalid token' });
  }
}

JWT structure:
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9   ← Header (base64)
.eyJzdWIiOiIxMjMiLCJlbWFpbCI6ImFsaWNlQGV4YW1wbGUuY29tIiwiZXhwIjoxNzE0MDAwMDAwfQ   ← Payload (base64)
.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c   ← Signature

Decoded payload:
{
  "sub": "123",
  "email": "alice@example.com",
  "role": "admin",
  "exp": 1714000000   ← Unix timestamp expiry
}

import jwt from 'jsonwebtoken';
import { readFileSync } from 'fs';

// Use asymmetric keys (RS256) for production — private key signs, public key verifies
const privateKey = readFileSync('./keys/jwt-private.pem');
const publicKey = readFileSync('./keys/jwt-public.pem');

function issueToken(userId: string, role: string): { accessToken: string; refreshToken: string } {
  const accessToken = jwt.sign(
    { sub: userId, role },
    privateKey,
    {
      algorithm: 'RS256',
      expiresIn: '15m',      // Short-lived access token
      issuer: 'api.example.com',
      audience: 'app.example.com'
    }
  );

  const refreshToken = jwt.sign(
    { sub: userId, type: 'refresh' },
    privateKey,
    {
      algorithm: 'RS256',
      expiresIn: '7d',       // Longer-lived refresh token
      issuer: 'api.example.com'
    }
  );

  return { accessToken, refreshToken };
}

function verifyToken(token: string): jwt.JwtPayload {
  return jwt.verify(token, publicKey, {
    algorithms: ['RS256'],   // Explicitly specify — prevents 'alg: none' attacks
    issuer: 'api.example.com',
    audience: 'app.example.com'
  }) as jwt.JwtPayload;
}

// ❌ Using HS256 with a weak secret
jwt.sign({ sub: userId }, 'password123', { algorithm: 'HS256' });
// Anyone who obtains the secret can forge tokens

// ❌ Not validating algorithm
jwt.verify(token, publicKey);  // Without { algorithms: ['RS256'] }
// Vulnerable to "alg: none" attack where a malicious token skips verification

// ❌ Long-lived access tokens
jwt.sign({ sub: userId }, key, { expiresIn: '30d' });
// Stolen token is valid for 30 days — no way to revoke it

// ✓ Short-lived access tokens + refresh token rotation
// Access token: 15 minutes
// Refresh token: 7 days, stored in HTTP-only cookie, single-use
// On refresh: issue new access token AND new refresh token, invalidate old refresh token

async function refreshAccessToken(refreshToken: string, res: Response) {
  const payload = verifyToken(refreshToken);

  // Check if refresh token has been used (token rotation)
  const tokenRecord = await db.refreshTokens.findOne({ token: refreshToken });
  if (!tokenRecord || tokenRecord.used) {
    // Possible token theft — invalidate all sessions for this user
    await db.refreshTokens.deleteMany({ userId: payload.sub });
    throw new Error('Refresh token reuse detected — all sessions invalidated');
  }

  // Mark old token as used
  await db.refreshTokens.update({ token: refreshToken }, { used: true });

  // Issue new token pair
  const { accessToken, refreshToken: newRefresh } = issueToken(payload.sub, payload.role);
  await db.refreshTokens.save({ token: newRefresh, userId: payload.sub, used: false });

  // Set new refresh token in HTTP-only cookie
  res.cookie('refresh_token', newRefresh, {
    httpOnly: true,      // JavaScript cannot read this
    secure: true,        // HTTPS only
    sameSite: 'strict',  // Prevents CSRF
    maxAge: 7 * 24 * 60 * 60 * 1000
  });

  return accessToken;
}

import { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';

const client = new SecretsManagerClient({ region: 'us-east-1' });

async function getSecret(secretName: string): Promise<Record<string, string>> {
  const response = await client.send(new GetSecretValueCommand({
    SecretId: secretName,
    VersionStage: 'AWSCURRENT'
  }));

  return JSON.parse(response.SecretString ?? '{}');
}

// Application startup — fetch all needed secrets
const dbSecrets = await getSecret('production/database');
const apiSecrets = await getSecret('production/third-party-apis');

const pool = new Pool({
  host: dbSecrets.DB_HOST,
  password: dbSecrets.DB_PASSWORD,   // Never in environment variables or code
  database: 'production'
});

# vault-policy.hcl
path "secret/data/production/database" {
  capabilities = ["read"]
}

path "database/creds/app-role" {
  capabilities = ["read"]
}

// Vault dynamic secrets — credentials are generated on-demand and expire
import vault from 'node-vault';

const vaultClient = vault({
  apiVersion: 'v1',
  endpoint: process.env.VAULT_ADDR,
  token: process.env.VAULT_TOKEN
});

async function getDatabaseCredentials() {
  // Vault generates a unique username/password for this request
  // Credentials expire automatically after the lease duration (1 hour)
  const creds = await vaultClient.read('database/creds/app-role');

  return {
    username: creds.data.username,  // e.g., v-app-role-xKj3mN
    password: creds.data.password
  };
}

Layer 1: Edge (WAF, DDoS protection)
  - Cloudflare WAF: blocks OWASP Top 10, SQL injection, XSS
  - Rate limiting: prevents brute force and credential stuffing
  - Bot detection: blocks automated scanning

Layer 2: API Gateway (authentication, authorisation)
  - Validates all tokens before forwarding to services
  - Enforces rate limits per user/API key
  - Logs all requests for audit trail

Layer 3: Service mesh (mTLS, service authorisation)
  - Every service-to-service call authenticated
  - Fine-grained access control per endpoint

Layer 4: Application (input validation, output encoding)
  - Validate all user input: SQL injection, XSS prevention
  - Parameterised queries, not string concatenation
  - Content Security Policy headers

Layer 5: Data (encryption at rest, column-level encryption)
  - Encrypted database volumes (TDE)
  - Application-level encryption for PII (credit card numbers, SSNs)
  - Field-level encryption for sensitive columns

// ❌ SQL injection vulnerability
const user = await db.query(`SELECT * FROM users WHERE email = '${email}'`);

// ✓ Parameterised query — safe
const user = await db.query('SELECT * FROM users WHERE email = $1', [email]);

// ✓ ORM (Prisma, TypeORM) — parameterises automatically
const user = await prisma.user.findFirst({ where: { email } });