GATE — Zero-Trust API Security Gateway

Lightweight, zero-trust reverse proxy worker for APIs. Deploy anywhere on Cloudflare. 100% Standalone & Open Source.

---

GATE is a standalone, lightweight Cloudflare Worker reverse proxy that enforces zero-trust security for Building Management Systems (BMS), PropTech, and general HTTP APIs.

It runs directly at Cloudflare's edge network with zero external dependencies, zero database requirements, and zero vendor lock-in.

---

⚡ Key Features

• 🛡️ 100% Standalone: No external SaaS, database, or proprietary backend required.
• ⚡ Sub-Millisecond Latency: Runs on Cloudflare's global V8 isolate network.
• 🔑 Bearer Token Auth: Enforces API key verification at the edge.
• 📋 Default-Deny Whitelisting: Strict command and parameter schema validation.
• 🧪 Parameter Validation: Type checks, regex patterns, min/max ranges, string length limits, and enum enforcement.
• 🚫 Multi-Layer Threat Filtering: Auto-blocks SQL injection, OS command injection, script injection (XSS), and prompt injection.
• 🪤 Honeypot Mode (Optional): Can return deceptive canary-trap payloads and trigger security alert webhooks to any custom endpoint (SIEM, Slack, Discord).

---

🏗️ How GATE Works

GATE sits between your client application and your upstream destination API:

Client Application ──POST──▶ GATE (Cloudflare Edge Worker) ──▶ Upstream Destination API

                             │ 1. CORS Preflight (OPTIONS -> 200 OK)
                             │ 2. Method Validation (POST only)
                             │ 3. Bearer Token Authentication
                             │ 4. Schema Whitelist & Bounds Check
                             │ 5. Threat Pattern Filtering
                             │ 6. Forward Payload to Target URL

Security Pipeline

1. CORS Preflight: Responds automatically to OPTIONS preflight checks with correct CORS headers.
2. Method Validation: Only accepts POST requests. All other methods receive 405 Method Not Allowed.
3. Authentication: Verifies Authorization: Bearer <key> against your GATE_API_KEY. Unauthenticated requests receive 401 Unauthorized.
4. Schema Enforcement: Validates that incoming command and params match your configured whitelist in gate.config.json. Invalid or unknown parameters receive 403 Forbidden.
5. Threat Detection: Scans request contents for injection attacks. Detected threats receive 403 Forbidden.
6. Clean Proxying: Strips routing metadata and streams sanitized { command, params } payloads directly to target_url.

---

🚀 Quick Start

1. Clone & Install

git clone https://github.com/DentiSystems-HQ/gate.git
cd gate
npm install

2. Configure Local Environment

Create a .dev.vars file in the project root for local testing:

GATE_API_KEY=your-secret-api-key

3. Start Local Server

npm run dev

The gateway will start locally at http://localhost:8787.

---

💻 Example Usage

Sending a Valid Request

curl -X POST http://localhost:8787 \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer your-secret-api-key" \
  -d '{
    "target_url": "https://api.example.com/bms/endpoint",
    "command": "get_property_details",
    "params": {
      "property_id": "prop_101"
    }
  }'

What Happens Behind the Scenes:

1. GATE checks Authorization header.
2. GATE validates that get_property_details is whitelisted.
3. GATE checks that property_id is a string, max length 50, and matches ^[a-zA-Z0-9_-]+$.
4. GATE scans for threat patterns.
5. GATE strips target_url from payload and forwards { "command": "get_property_details", "params": { "property_id": "prop_101" } } to https://api.example.com/bms/endpoint.

---

🛡️ Default-Deny Schema Configuration

Commands and parameter validation rules are defined in gate.config.json:

{
  "version": "1.1.0",
  "security_mode": "STRICT_BLOCK",
  "commands": {
    "update_hvac_setpoint": {
      "description": "Update HVAC temperature setpoint",
      "parameters": {
        "device_id": {
          "type": "string",
          "required": true,
          "max_length": 50,
          "pattern": "^[a-zA-Z0-9_-]+$"
        },
        "temperature_celsius": {
          "type": "number",
          "required": true,
          "min": -50,
          "max": 50
        }
      }
    }
  }
}

Supported Parameter Validation Rules

Rule	Type	Description
type	"string" | "number" | "boolean"	Mandatory JSON data type
required	boolean	Rejects request if parameter is missing
max_length	number	Maximum allowed length for strings
min / max	number	Minimum and maximum limits for numbers
pattern	string	Regex pattern that string values must strictly match
enum	array	Whitelist of exact permitted values

---

🪤 Security Modes

GATE supports two security modes defined in gate.config.json:

1. STRICT_BLOCK (Default)

Directly drops invalid/malicious requests and returns an HTTP status code (401, 403, 405).

2. HONEYPOT_DECEIVE (Optional)

Instead of returning 403 Forbidden, GATE returns a synthetic 200 OK response populated with canary markers (SECURITY_CANARY_...). Optionally dispatches a webhook alert to webhook_alert_url (SIEM, Slack, custom webhook).

---

🧪 Running Tests

GATE includes an automated integration test suite validating all 6 security layers:

# Terminal 1: Run local dev server
npm run dev

# Terminal 2: Execute integration tests
npm run test

---

🚀 Deployment

Deploy GATE to Cloudflare Workers with Wrangler:

# 1. Authenticate with Cloudflare
npx wrangler login

# 2. Set production API key secret
npx wrangler secret put GATE_API_KEY

# 3. Deploy
npm run deploy

---

📄 License

Distributed under the MIT License. See LICENSE for details.

---

Maintained by DentiSystems