Zero trust security abandons the perimeter model and assumes every request is potentially hostile. Here is what that means in practice for web application development.
Anay Pandya
1,552 words
Anay Pandya
Founder of ZeriFlow · 10 years fullstack engineering · About the author
Key Takeaways
Zero trust security is the principle that no user, device, or service should be trusted by default — regardless of network location. In the traditional perimeter model, everything inside the firewall was trusted. Zero trust eliminates that assumption: every request must be authenticated, authorized, and continuously validated.
<div class="zf-stat-callout" style="background:#0d1117;border:1px solid rgba(16,185,129,0.25);border-left:3px solid #10b981;border-radius:4px;padding:16px 20px;margin:24px 0"> <p style="margin:0 0 4px;font-size:10px;font-weight:700;text-transform:uppercase;letter-spacing:0.15em;color:#10b981;font-family:monospace">ZeriFlow Data — 12,400+ sites analyzed</p> <p style="margin:0;font-size:13px;color:#e2e8f0;line-height:1.6;font-family:monospace">In ZeriFlow's dataset of 12,400+ scanned sites, the average security score is 52/100 — with 68% failing at least one critical check in categories including TLS configuration, security headers, DNS authentication, and cookie handling.</p> </div>
Keep reading
Is your site actually secure?
Run a free check — 60 seconds
Check your site's [security configuration](https://zeriflow.com/blog/nginx-security-hardening-guide): Free ZeriFlow scan in 60 seconds →
Traditional network security drew a hard boundary: external = untrusted, internal = trusted. Once inside the VPN or corporate network, users and services could communicate freely.
This model collapsed under several pressures: - Remote work moved users outside the perimeter permanently. - Cloud workloads live in networks your firewall does not control. - Insider threats and compromised credentials come from inside. - Lateral movement after a breach exploits excessive internal trust.
The 2020 SolarWinds breach illustrated the failure mode: attackers with valid credentials moved laterally across "trusted" internal networks for months undetected, because internal traffic was not individually authenticated or authorized.
1. Never trust, always verify: every access request requires authentication and authorization, regardless of source. An internal service calling another internal service must authenticate just as a public user does.
2. Least privilege access: each identity (user, service, device) gets only the permissions required for its specific function. No broad "trusted network" grants. No shared admin credentials.
3. Assume breach: design your systems assuming that some component is already compromised. Minimize blast radius through segmentation, encrypt all traffic (including internal), and log everything.
Every request carries an identity. For user traffic, this means:
// Express.js — every route requires authentication
const authenticate = async (req, res, next) => {
const token = req.cookies.session || req.headers.authorization?.split(' ')[1];
if (!token) {
return res.status(401).json({ error: 'Authentication required' });
}
try {
const user = await verifyToken(token);
// Continuous validation — not just at login
if (await isUserSuspended(user.id)) {
return res.status(403).json({ error: 'Account suspended' });
}
if (await isSessionRevoked(user.sessionId)) {
return res.status(401).json({ error: 'Session invalid' });
}
req.user = user;
next();
} catch (err) {
res.status(401).json({ error: 'Invalid session' });
}
};
// Apply globally — no "trusted" routes
app.use(authenticate);For service-to-service communication:
// Service A calling Service B — mutual authentication
const https = require('https');
const fs = require('fs');
const agent = new https.Agent({
cert: fs.readFileSync('/certs/service-a.crt'),
key: fs.readFileSync('/certs/service-a.key'),
ca: fs.readFileSync('/certs/internal-ca.crt'),
rejectUnauthorized: true // validate server cert too
});
// Service B authenticates Service A via client certificate
// No IP-based trust, no VPN trustAuthentication proves who you are. Authorization determines what you can do. In zero trust, authorization is evaluated per request, not cached for a session duration.
# Python — attribute-based access control
from dataclasses import dataclass
from typing import Set
from enum import Enum
class Permission(Enum):
READ_OWN_DATA = "read:own"
READ_ANY_DATA = "read:any"
WRITE_OWN_DATA = "write:own"
WRITE_ANY_DATA = "write:any"
ADMIN = "admin"
@dataclass
class AccessContext:
user_id: str
permissions: Set[Permission]
mfa_verified: bool
risk_score: float # 0.0 = low risk, 1.0 = high risk
device_trusted: bool
def authorize(context: AccessContext, required_permission: Permission,
risk_threshold: float = 0.5) -> bool:
# Permission check
if required_permission not in context.permissions:
return False
# Risk-based step-up: high-risk requests need MFA
if context.risk_score > risk_threshold and not context.mfa_verified:
return False
# Sensitive operations require trusted device
if required_permission in {Permission.ADMIN, Permission.WRITE_ANY_DATA}:
if not context.device_trusted:
return False
return TruePartition your application into segments with explicit access controls between them. In practice, this means:
// Microservice — service identity validation
const ALLOWED_CALLERS = new Set(['order-service', 'inventory-service']);
app.use((req, res, next) => {
const callerIdentity = req.headers['x-service-identity'];
const callerToken = req.headers['authorization'];
if (!ALLOWED_CALLERS.has(callerIdentity)) {
return res.status(403).json({ error: 'Unauthorized caller' });
}
// Verify the token was actually issued to that service
const payload = verifyServiceToken(callerToken);
if (payload.service !== callerIdentity) {
return res.status(403).json({ error: 'Identity mismatch' });
}
next();
});Zero trust treats authorization as dynamic. Signals that should trigger re-authentication or access denial:
async function calculateRiskScore(userId, req) {
let score = 0;
const lastKnownIP = await getLastKnownIP(userId);
if (lastKnownIP && lastKnownIP !== req.ip) {
score += 0.3; // new IP
const locationChange = await detectLocationChange(lastKnownIP, req.ip);
if (locationChange.impossibleTravel) score += 0.5; // physically impossible
}
const deviceFingerprint = computeFingerprint(req);
const knownDevices = await getKnownDevices(userId);
if (!knownDevices.includes(deviceFingerprint)) score += 0.2;
const recentFailures = await getRecentMFAFailures(userId, 300); // last 5 min
if (recentFailures > 2) score += 0.3;
return Math.min(score, 1.0);
}
// In auth middleware
const riskScore = await calculateRiskScore(req.user.id, req);
if (riskScore > 0.7) {
// Step-up authentication required
return res.status(401).json({
error: 'Step-up authentication required',
challenge: 'mfa',
reason: 'high_risk_context'
});
}Headers are the HTTP-level manifestation of zero trust principles. ZeriFlow checks all of them in a single scan: Content-Security-Policy to restrict resource loading, CORS to control which origins can call your API, X-Frame-Options to prevent clickjacking, Strict-Transport-Security to enforce encrypted transport. A zero trust posture on the application layer starts with getting these headers right.
Zero trust without visibility is blind. Every authentication event, authorization decision, and anomalous request must be logged with enough context to investigate incidents.
const logger = require('./logger'); // structured JSON logger
function auditLog(event, req, context = {}) {
logger.info({
event,
userId: req.user?.id,
ip: req.ip,
userAgent: req.headers['user-agent'],
path: req.path,
method: req.method,
timestamp: new Date().toISOString(),
sessionId: req.user?.sessionId,
...context
});
}
// Log every access decision
app.use((req, res, next) => {
res.on('finish', () => {
auditLog('api_request', req, {
statusCode: res.statusCode,
authorized: res.statusCode < 400
});
});
next();
});### Q: Does zero trust mean I do not need a VPN? A: Zero trust replaces VPN-based trust, but not necessarily VPN as a transport. Many organizations use zero trust network access (ZTNA) to replace legacy VPN, providing per-application access rather than full network access. The key shift is that network location no longer grants trust — identity and device posture do.
### Q: Where do I start implementing zero trust? A: Start with identity: enforce MFA for all users and service accounts, implement least-privilege access control, and eliminate shared credentials. This alone closes the majority of attack vectors. Then add device trust, micro-segmentation, and continuous risk evaluation incrementally.
### Q: How does zero trust apply to third-party SaaS tools? A: Use your IdP's SSO integration to centralize identity management. Regularly audit which SaaS tools have access to what data. Revoke access for tools you no longer use. Prefer SaaS tools that support SAML/OIDC so you can enforce MFA and device policies centrally.
### Q: Is zero trust compatible with microservices? A: Zero trust was designed for microservices. Service mesh technologies (Istio, Linkerd) implement mTLS between services automatically, making mutual authentication the default. Combine service mesh with short-lived JWT service tokens for a strong zero trust posture in distributed systems.
### Q: How do I measure progress toward zero trust? A: Track: percentage of users with MFA enabled, percentage of service-to-service calls using mutual authentication, number of excessive privilege grants removed, mean time to detect lateral movement in your environment. Regular ZeriFlow scans give you a baseline of your external-facing security posture.
Zero trust is not a product you buy — it is an architectural philosophy you implement incrementally. Start by verifying every identity for every request. Add least-privilege access controls. Assume every component can be compromised and limit the damage accordingly. Log everything. The result is a system where a single compromised credential or service does not cascade into a total breach.
Run a free ZeriFlow scan → — no credit card required.
<!-- zf-internal-links -->
Related resources
Website Vulnerability Scanner
Run a broader website security audit across headers, TLS, DNS, cookies, SEO, and disclosure checks.
Security Headers Checker
Check CSP, HSTS, X-Frame-Options, and other response headers.
SSL Checker
Review TLS certificate, HTTPS, and transport security signals.
DMARC Checker
Validate email authentication records for domain spoofing protection.
CSP Checker
Review Content-Security-Policy coverage and common gaps.
June 24, 2026
Best Security Tools for AI Startups
Monitor your security score
Schedule recurring scans and catch regressions after deployments.