security-architecture

JWT rotation for stateless APIs involves issuing short-lived access tokens and longer-lived refresh tokens to maintain security without server-side session storage. This Skill details specific patterns to implement secure JWT rotation and manage token lifecycles effectively.

Implementing OAuth2 and OIDC flows for microservices requires delegating authentication to an identity provider and validating tokens at the API gateway. This Skill provides comprehensive guidance on configuring OAuth2 and OIDC flows for secure microservice architectures.

mTLS works for service-to-service authentication by requiring both the client and server to present and verify X.509 certificates, establishing mutual trust. This Skill outlines how to apply mTLS patterns to secure internal communications against unauthorized access.

You need field-level encryption instead of standard at-rest encryption when specific sensitive data fields require individual cryptographic protection independent of the database layer. This Skill explains strategies for at-rest, in-transit, and field-level encryption including key management.

Yes, this covers OWASP Top 10 and Zero Trust architecture principles by providing reference patterns to design systems that mitigate common vulnerabilities and assume a hostile network. It integrates these standards directly into secure software architecture guidance.

Limitations of using Zero Trust architecture include increased latency from continuous verification and complexity in managing granular access policies across internal networks. This Skill details how to balance Zero Trust principles with defense in depth and least privilege.