Smart endpoints, dumb pipes: the zero-trust split
You have a lock, but you don't fully trust it — so you add a lock for the lock, and repeat. That's the core of Zero Trustⓘ: no single layer is trusted on its own, and unlocking one never automatically unlocks the next.
In a microservices architecture, three layers split the security work — the API gatewayⓘ, the service meshⓘ, and your app. What makes it clean: splitting it with zero duplicated code, then letting mTLSⓘ turn the network itself into the un-bypassable second lock.
The one idea
The principle is smart endpoints, dumb pipesⓘ: the pipe (gateway + mesh) only does fast, generic checks — validate the token, rate-limit, mTLS — while the app keeps its business logic. The gateway checks who you are (coarse-grained); the app checks whether this row is yours (fine-grained). Zero overlap, zero redundancy.
Defense in depthⓘ makes it safe: if an attacker picks one lock, they run straight into the next. Pushing all the logic into the pipe is the anti-pattern — the pipe can't see your database, so it can never answer "is this yours?".
The trap, and the fix
Once the app blindly trusts the X-User-Id header, anyone who can reach its port can forge it — that's the "Blind Trust" vulnerability. The fix: make sure nobody can bypass the mesh to talk to the app directly.
This is where mTLS comes in. The mesh's Certificate Authorityⓘ signs every pod's identity, so the app refuses any connection without a signed certificate — dropping the attacker at the TCP layer, before a single header is read. You get Zero Trust isolation without writing one line of crypto code.
See it move
Theory lands fastest when you can move it. In the interactive guide, turn mTLS off and run the attack — the forged header gets through, admin granted. Turn it back on — the connection is dropped instantly. Step through the four-move handshake (ownership then authority), then build the whole chain of trust with five OpenSSL commands.
Sources