Map the API
Draw API trust boundaries
Trace identity, data, and authority across clients, gateways, services, queues, databases, caches, and third-party APIs.
8 minute lesson
Internal traffic is not automatically trusted. A compromised service or leaked worker token is still an attacker path.
Mark where authentication changes form, where authorization decisions happen, and where data leaves your control. Record ambient credentials added by platforms and proxies. Validate every boundary according to its own threat model.
A gateway may add X-User-Id after authentication. If the application also accepts that header directly from the internet, a caller can choose another identity.
Document which component may create, replace, or remove every security header. Then the direct-service test can prove the application rejects identity claims outside that trusted network path.
Trace one invoice request from client to database and label who creates each identity value. Bypass the gateway in a test and prove a forged identity header cannot authorize the request.
Lesson completed