Zero-Trust API Security in Modern Backends: Mutual TLS, Distributed Rate Limiting & JWT Hardening

The Death of Perimeter Security

• Containerized Microservices & Cloud-Native Deployments: Workloads run across multi-cloud and edge environments.
• Supply Chain & Insider Threats: A single compromised container or malicious dependency (npm, PyPI) gives attackers unfettered lateral access across your entire cluster.
• Serverless & Distributed Agents: Ephemeral workloads constantly trigger remote procedures across boundaries.

1. Service-to-Service Cryptographic Identity with Mutual TLS (mTLS)

[Service A: Payment Gateway]                    [Service B: Ledger Core]
            │                                               │
            ├──── 1. Client Hello (Supported Ciphers) ─────►│
            │◄─── 2. Server Hello + Server Certificate ─────┤
            ├──── 3. Client Certificate (mTLS Proof) ──────►│
            │◄─── 4. Verify Identity via Common Root CA ────┤
            ├════ 5. Encrypted & Authenticated Session ═════┤

yaml
# Istio PeerAuthentication Policy enforcing strict mTLS
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT  # Rejects any unencrypted or non-mTLS plaintext traffic

2. Hardening JSON Web Tokens (JWT) Against Real-World Attacks

The Attack Vectors:

1. The none Algorithm Exploit: Vulnerable libraries accepting {"alg": "none"} tokens without signature checks.
2. Algorithm Confusion (HMAC vs RSA): Attackers signing HMAC-SHA256 tokens using the server's public RSA key.
3. Stale Revocation: Stolen tokens remaining valid until expiration because backends don't check a revocation list.

Production JWT Hardening Checklist:

python
# secure_jwt.py
import jwt
import redis
from datetime import datetime, timezone

redis_client = redis.Redis(host='localhost', port=6379, db=0)

# Load Public Key (Never verify with symmetric secret when using RS256/EdDSA)
with open("keys/public_key.pem", "rb") as f:
    PUBLIC_KEY = f.read()

def verify_and_decode_token(token: str) -> dict:
    try:
        # 1. Explicitly whitelist algorithms (prevent algorithm confusion)
        payload = jwt.decode(
            token,
            PUBLIC_KEY,
            algorithms=["RS256"],
            options={
                "verify_signature": True,
                "require": ["exp", "iat", "sub", "jti", "iss"],
            },
            issuer="https://auth.rudresh.in",
            audience="api://production-backend"
        )

        # 2. Check Blacklist / Revocation in Redis via Unique JWT ID (jti)
        jti = payload["jti"]
        if redis_client.exists(f"token:revoked:{jti}"):
            raise PermissionError("Token has been revoked by user or security policy.")

        return payload

    except jwt.ExpiredSignatureError:
        raise PermissionError("Token has expired. Re-authenticate via refresh flow.")
    except jwt.InvalidTokenError as e:
        raise PermissionError(f"Cryptographic verification failed: {str(e)}")

3. Distributed Sliding-Window Rate Limiting with Redis

python
# rate_limiter.py
import time
import redis

r = redis.Redis(host='localhost', port=6379, db=1)

def is_rate_limited(api_key: str, max_requests: int = 100, window_seconds: int = 60) -> bool:
    """
    Sliding window rate limiter using Redis sorted sets.
    
    Args:
        api_key: Identifier (API key, user ID, or IP hash)
        max_requests: Max requests allowed in the time window
        window_seconds: Duration of the sliding window in seconds
    """
    key = f"ratelimit:{api_key}"
    current_time_ms = int(time.time() * 1000)
    window_start_ms = current_time_ms - (window_seconds * 1000)

    pipe = r.pipeline()
    # 1. Remove timestamps outside the sliding window
    pipe.zremrangebyscore(key, 0, window_start_ms)
    # 2. Add current request timestamp
    pipe.zadd(key, {str(current_time_ms): current_time_ms})
    # 3. Count remaining requests in the window
    pipe.zcard(key)
    # 4. Set TTL to auto-expire stale keys
    pipe.expire(key, window_seconds + 5)
    
    _, _, request_count, _ = pipe.execute()

    # Block if request count exceeds threshold
    return request_count > max_requests

4. Defending Against OWASP API Top 10 Vulnerabilities

1. Broken Object Level Authorization (BOLA / IDOR):
   • Never trust client-supplied IDs: Never execute UPDATE orders SET status='CANCELLED' WHERE id = :order_id;.
   • Always scope to authenticated user: UPDATE orders SET status='CANCELLED' WHERE id = :order_id AND user_id = :authenticated_user_id;.
2. Mass Assignment Prevention:
   • Explicitly define input schemas using Pydantic or TypeScript interfaces. Never deserialize raw request dictionaries directly into ORM models (user.update(**request.json) allows attackers to inject is_admin: true).
3. Content-Security-Policy & Strict Headers:
   • Always enforce X-Content-Type-Options: nosniff, Strict-Transport-Security: max-age=63072000; includeSubDomains; preload, and minimal CORS origins.

Share this article

Comments