Zero Trust Security: Building Secure Modern Applications

Zero trust security assumes no implicit trust, whether inside or outside the network perimeter. This guide covers implementing zero trust principles in modern applications.

Core Principles#

┌─────────────────────────────────────────────────────┐
│                    ZERO TRUST                        │
├─────────────────────────────────────────────────────┤
│  1. Verify Explicitly                                │
│     Authenticate and authorize every request         │
├─────────────────────────────────────────────────────┤
│  2. Least Privilege Access                           │
│     Grant minimum permissions needed                 │
├─────────────────────────────────────────────────────┤
│  3. Assume Breach                                    │
│     Minimize blast radius, segment access            │
└─────────────────────────────────────────────────────┘

Authentication#

JWT Implementation#

import jwt from 'jsonwebtoken';
import { z } from 'zod';

const tokenPayloadSchema = z.object({
  sub: z.string(),
  email: z.string().email(),
  roles: z.array(z.string()),
  iat: z.number(),
  exp: z.number(),
});

type TokenPayload = z.infer<typeof tokenPayloadSchema>;

class AuthService {
  private accessTokenSecret: string;
  private refreshTokenSecret: string;

  constructor() {
    this.accessTokenSecret = process.env.ACCESS_TOKEN_SECRET!;
    this.refreshTokenSecret = process.env.REFRESH_TOKEN_SECRET!;
  }

  generateTokens(user: User) {
    const payload = {
      sub: user.id,
      email: user.email,
      roles: user.roles,
    };

    const accessToken = jwt.sign(payload, this.accessTokenSecret, {
      expiresIn: '15m',
      issuer: 'my-app',
      audience: 'my-app-users',
    });

    const refreshToken = jwt.sign(
      { sub: user.id },
      this.refreshTokenSecret,
      { expiresIn: '7d' }
    );

    return { accessToken, refreshToken };
  }

  verifyAccessToken(token: string): TokenPayload {
    try {
      const decoded = jwt.verify(token, this.accessTokenSecret, {
        issuer: 'my-app',
        audience: 'my-app-users',
      });

      return tokenPayloadSchema.parse(decoded);
    } catch (error) {
      throw new AuthenticationError('Invalid token');
    }
  }

  async refreshTokens(refreshToken: string) {
    // Verify refresh token
    const decoded = jwt.verify(refreshToken, this.refreshTokenSecret);

    // Check if token is revoked
    const isRevoked = await this.isTokenRevoked(refreshToken);
    if (isRevoked) {
      throw new AuthenticationError('Token revoked');
    }

    // Get fresh user data
    const user = await this.getUserById(decoded.sub);

    // Revoke old refresh token
    await this.revokeToken(refreshToken);

    // Generate new tokens
    return this.generateTokens(user);
  }
}

Multi-Factor Authentication#

import { authenticator } from 'otplib';

class MFAService {
  generateSecret(userEmail: string): { secret: string; uri: string } {
    const secret = authenticator.generateSecret();
    const uri = authenticator.keyuri(userEmail, 'MyApp', secret);

    return { secret, uri };
  }

  verifyToken(secret: string, token: string): boolean {
    return authenticator.verify({ token, secret });
  }

  async setupMFA(userId: string) {
    const user = await db.users.findById(userId);
    const { secret, uri } = this.generateSecret(user.email);

    // Store encrypted secret
    await db.users.update(userId, {
      mfaSecret: encrypt(secret),
      mfaEnabled: false, // Enable after verification
    });

    // Generate QR code URL
    return { uri };
  }

  async verifyAndEnable(userId: string, token: string) {
    const user = await db.users.findById(userId);
    const secret = decrypt(user.mfaSecret);

    if (!this.verifyToken(secret, token)) {
      throw new Error('Invalid MFA token');
    }

    await db.users.update(userId, { mfaEnabled: true });
  }
}

Authorization#

Role-Based Access Control (RBAC)#

type Permission = 'read' | 'write' | 'delete' | 'admin';
type Resource = 'users' | 'orders' | 'products' | 'reports';

interface Role {
  name: string;
  permissions: Map<Resource, Permission[]>;
}

const roles: Record<string, Role> = {
  viewer: {
    name: 'viewer',
    permissions: new Map([
      ['users', ['read']],
      ['orders', ['read']],
      ['products', ['read']],
    ]),
  },
  editor: {
    name: 'editor',
    permissions: new Map([
      ['users', ['read']],
      ['orders', ['read', 'write']],
      ['products', ['read', 'write']],
    ]),
  },
  admin: {
    name: 'admin',
    permissions: new Map([
      ['users', ['read', 'write', 'delete', 'admin']],
      ['orders', ['read', 'write', 'delete', 'admin']],
      ['products', ['read', 'write', 'delete', 'admin']],
      ['reports', ['read', 'write', 'delete', 'admin']],
    ]),
  },
};

class RBACService {
  hasPermission(
    userRoles: string[],
    resource: Resource,
    permission: Permission
  ): boolean {
    return userRoles.some((roleName) => {
      const role = roles[roleName];
      const resourcePermissions = role?.permissions.get(resource);
      return resourcePermissions?.includes(permission);
    });
  }
}

// Middleware
function requirePermission(resource: Resource, permission: Permission) {
  return (req: Request, res: Response, next: NextFunction) => {
    const userRoles = req.user?.roles || [];

    if (!rbacService.hasPermission(userRoles, resource, permission)) {
      return res.status(403).json({ error: 'Forbidden' });
    }

    next();
  };
}

// Usage
app.delete(
  '/api/products/:id',
  authenticate,
  requirePermission('products', 'delete'),
  deleteProduct
);

Attribute-Based Access Control (ABAC)#

interface PolicyContext {
  user: {
    id: string;
    roles: string[];
    department: string;
  };
  resource: {
    type: string;
    ownerId: string;
    sensitivity: 'public' | 'internal' | 'confidential';
  };
  action: string;
  environment: {
    ipAddress: string;
    time: Date;
    location: string;
  };
}

type Policy = (context: PolicyContext) => boolean;

const policies: Policy[] = [
  // Users can read their own resources
  (ctx) =>
    ctx.action === 'read' && ctx.resource.ownerId === ctx.user.id,

  // Admins can do anything
  (ctx) =>
    ctx.user.roles.includes('admin'),

  // Only internal IPs can access confidential resources
  (ctx) =>
    ctx.resource.sensitivity !== 'confidential' ||
    ctx.environment.ipAddress.startsWith('10.'),

  // Department heads can access department resources
  (ctx) =>
    ctx.user.roles.includes('department_head') &&
    ctx.resource.department === ctx.user.department,
];

class ABACService {
  evaluate(context: PolicyContext): boolean {
    return policies.some((policy) => policy(context));
  }
}

API Security#

Request Validation#

import { z } from 'zod';

// Define request schemas
const createUserSchema = z.object({
  email: z.string().email(),
  password: z.string().min(12).regex(/[A-Z]/).regex(/[0-9]/),
  name: z.string().min(2).max(100),
});

// Validation middleware
function validateRequest<T>(schema: z.ZodSchema<T>) {
  return (req: Request, res: Response, next: NextFunction) => {
    try {
      req.body = schema.parse(req.body);
      next();
    } catch (error) {
      if (error instanceof z.ZodError) {
        res.status(400).json({
          error: 'Validation failed',
          details: error.errors,
        });
      } else {
        next(error);
      }
    }
  };
}

app.post('/api/users', validateRequest(createUserSchema), createUser);

Security Headers#

import helmet from 'helmet';

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'unsafe-inline'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", "data:", "https:"],
      connectSrc: ["'self'", "https://api.example.com"],
      frameSrc: ["'none'"],
      objectSrc: ["'none'"],
    },
  },
  hsts: {
    maxAge: 31536000,
    includeSubDomains: true,
    preload: true,
  },
  referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
}));

// Additional custom headers
app.use((req, res, next) => {
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('X-Frame-Options', 'DENY');
  res.setHeader('X-XSS-Protection', '1; mode=block');
  res.setHeader('Permissions-Policy', 'geolocation=(), camera=()');
  next();
});

Service-to-Service Security#

mTLS Authentication#

import https from 'https';
import fs from 'fs';

// Server setup with mTLS
const serverOptions = {
  key: fs.readFileSync('./certs/server-key.pem'),
  cert: fs.readFileSync('./certs/server-cert.pem'),
  ca: fs.readFileSync('./certs/ca-cert.pem'),
  requestCert: true,
  rejectUnauthorized: true,
};

const server = https.createServer(serverOptions, app);

// Client with certificate
const clientOptions = {
  key: fs.readFileSync('./certs/client-key.pem'),
  cert: fs.readFileSync('./certs/client-cert.pem'),
  ca: fs.readFileSync('./certs/ca-cert.pem'),
};

async function callService(url: string) {
  const agent = new https.Agent(clientOptions);
  return fetch(url, { agent });
}

Service Mesh (Istio example)#

# AuthorizationPolicy
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: order-service-policy
spec:
  selector:
    matchLabels:
      app: order-service
  rules:
    - from:
        - source:
            principals: ["cluster.local/ns/default/sa/frontend"]
      to:
        - operation:
            methods: ["GET", "POST"]
            paths: ["/api/orders/*"]

Secrets Management#

import { SecretManagerServiceClient } from '@google-cloud/secret-manager';

class SecretsManager {
  private client: SecretManagerServiceClient;
  private cache: Map<string, { value: string; expiresAt: number }> = new Map();

  constructor() {
    this.client = new SecretManagerServiceClient();
  }

  async getSecret(name: string): Promise<string> {
    const cached = this.cache.get(name);
    if (cached && cached.expiresAt > Date.now()) {
      return cached.value;
    }

    const [version] = await this.client.accessSecretVersion({
      name: `projects/${process.env.PROJECT_ID}/secrets/${name}/versions/latest`,
    });

    const value = version.payload?.data?.toString() || '';

    // Cache for 5 minutes
    this.cache.set(name, {
      value,
      expiresAt: Date.now() + 5 * 60 * 1000,
    });

    return value;
  }
}

Audit Logging#

interface AuditEvent {
  timestamp: Date;
  actor: {
    id: string;
    type: 'user' | 'service' | 'system';
    ip?: string;
  };
  action: string;
  resource: {
    type: string;
    id: string;
  };
  outcome: 'success' | 'failure';
  metadata?: Record<string, unknown>;
}

class AuditLogger {
  async log(event: AuditEvent) {
    // Write to immutable audit log
    await db.auditLogs.create({
      data: {
        ...event,
        timestamp: new Date(),
        hash: this.computeHash(event),
      },
    });
  }

  private computeHash(event: AuditEvent): string {
    const previous = await this.getLastHash();
    return crypto
      .createHash('sha256')
      .update(JSON.stringify(event) + previous)
      .digest('hex');
  }
}

// Usage in middleware
app.use((req, res, next) => {
  res.on('finish', () => {
    auditLogger.log({
      timestamp: new Date(),
      actor: {
        id: req.user?.id || 'anonymous',
        type: 'user',
        ip: req.ip,
      },
      action: `${req.method} ${req.path}`,
      resource: {
        type: 'api',
        id: req.path,
      },
      outcome: res.statusCode < 400 ? 'success' : 'failure',
    });
  });
  next();
});

Best Practices#

Never trust client input: Validate and sanitize everything
Encrypt data at rest and in transit: Use TLS everywhere
Implement defense in depth: Multiple security layers
Log security events: Maintain audit trails
Regular security reviews: Penetration testing, code audits
Principle of least privilege: Minimum necessary permissions
Rotate secrets regularly: Automate credential rotation

Zero trust requires continuous verification at every layer. Start with strong authentication and authorization, secure service-to-service communication, and maintain comprehensive audit logs. Security is not a feature—it's a continuous practice.