Zero trust, by construction
A gateway is the first thing an attacker reaches. Barbacane treats every request, every artifact and every plugin as untrusted until it has been checked, and the checks come from the spec you already maintain.
Requests
Every client is untrusted until the spec, an auth plugin and a policy say otherwise.
Declared operations only
A path or method the spec does not declare gets a 404 or 405. There is no default route.
Schema validation
Path, query, header and cookie parameters and request bodies are validated against their JSON Schemas, formats and patterns included, before any upstream sees them.
Header allowlist
Only a fixed baseline, the declared header parameters and the headers of the applicable security schemes reach the middleware chain. Everything else is dropped at ingress.
Unforgeable identity
The x-auth-* headers belong to the auth plugins: a spec cannot declare them (E1056), and the data plane drops any that a client sends.
Authentication and authorization
JWT, OIDC, OAuth2 introspection, API keys, Basic and LDAP, then consumer ACLs, CEL expressions or Open Policy Agent, per operation.
WAF
An OWASP CRS compatible rule set inspects requests and responses, in scoring or blocking mode, with a per-transaction audit log.
Bounded resources
A connection cap sheds load, header-read and TLS handshake timeouts close slow clients, and rate limits partition on the authenticated identity.
Artifacts
What runs is what you built, and you can prove it.
Checked at build time
Unknown plugins, configs a plugin schema rejects, route conflicts, invalid schemas and plaintext upstream URLs (E1031) fail the compile.
Content hash
One SHA-256 hash covers the specs, routes, plugins, their declared capabilities and the WAF policy. The data plane recomputes it on every load.
Ed25519 signatures
The compiler signs the hash. Pin the public key and the data plane refuses any artifact that is unsigned or signed by anyone else.
Provenance
Each artifact records the Git commit it was built from, and drift detection flags data planes that run anything other than the expected artifact.
Plugins
Extensions are code from someone else. They get a sandbox, not the keys.
WebAssembly sandbox
Plugins cannot touch the host process, its memory or its file system. Memory, fuel and wall-clock limits stop a runaway plugin without stopping the gateway.
Declared capabilities
A plugin lists the host functions it needs in its manifest, and the data plane refuses to load one that imports anything else.
Body access on request
A middleware sees the request body only if its manifest asks for it.
Egress
The gateway is not a pivot into your network.
Internal targets blocked
Plugin HTTP calls, broker and directory connections and WebSocket upstreams to loopback, link-local, private and cloud metadata addresses are refused by default.
No redirects
The plugin HTTP client does not follow redirects, so an allowed host cannot bounce a call to a forbidden one.
TLS everywhere
rustls with AWS-LC, FIPS 140-3 ready, with mTLS to upstreams. No OpenSSL in the process.
Secrets
Credentials never travel inside an artifact.
Resolved at runtime
Secrets are env:// or file:// references, resolved by the data plane when it loads the artifact.
Confined files
file:// references must resolve inside one secrets directory, symbolic links included.
Plaintext flagged
A literal value in a field a plugin marks as secret is reported by the compiler (E1070) and by the vacuum linter.
Control plane
Management is off the request path and closed by default.
Fails closed
The control plane does not start without an admin token, and every management route requires it.
Origin allowlist
Cross-origin access is limited to the origins you configure.
Data planes stand alone
A data plane keeps serving its last verified artifact when the control plane is unreachable.
Supply chain
The binary you run should be as inspectable as the spec you write.
Signed images
Release images are signed keylessly with Sigstore cosign and carry a CycloneDX SBOM attestation.
Minimal runtime
The data plane image is distroless and runs as a non-root user.
Dependency gate
Every change runs cargo-deny for advisories, licenses, banned crates and sources.
Adversarial testing
Fuzz targets cover the spec parser, artifact loader and validator, and an adversarial integration suite attacks the gateway on every change.
Found a weakness?
Please report it privately to security@barbacane.dev rather than in a public issue. Our security policy describes what to include and how we respond.