Zero Trust Security for Developers

The Core Principle

Traditional security assumes that everything inside the corporate network is trusted. Zero Trust flips this: never trust, always verify. Every request must be authenticated and authorised, regardless of where it originates.

Practical Zero Trust for APIs

1. Short-lived credentials Replace long-lived API keys with short-lived tokens. OAuth 2.0 access tokens expire in minutes; rotate service-to-service credentials frequently.

2. Mutual TLS (mTLS) In mTLS, both client and server present certificates. This ensures you know who is calling your API, not just that the call carries the right secret.

// Cloudflare Workers: enforce mTLS via client certificate
export default {
  fetch(request: Request): Response {
    const cert = request.cf?.tlsClientAuth;
    if (!cert?.certVerified) {
      return new Response("Client certificate required", { status: 401 });
    }
    return new Response("Authenticated");
  }
};

3. Least privilege Issue tokens with the minimum scopes required. A token for reading user profiles should not be able to delete accounts.

4. Continuous verification Do not cache authorisation decisions indefinitely. Re-verify on sensitive operations and establish session timeouts.

Network Segmentation

Even in a Zero Trust model, network segmentation remains valuable as a defence-in-depth measure. Use Cloudflare Tunnel to expose internal services without opening firewall ports.

Audit Logs

Every access decision — allow or deny — should be logged with enough context to reconstruct what happened: principal, resource, action, timestamp, IP.