Zero Trust Gateway v0.2.0

This release turns the original local reverse-proxy PoC into a bounded,
testable identity and policy-enforcement lab.

Highlights:

strict issuer/audience/bounded-lifetime and kid-selected JWT verification;
local JWK Set rotation without remote key fetching;
bounded direct-peer rate limiting and sanitized failure behavior;
structured audit events that exclude credentials and query strings, with raw
aiohttp access logging disabled;
explicit body limits, upstream timeout, redirect suppression, and trusted
header replacement;
stateless cookie handling that removes inbound Cookie and outbound
Set-Cookie, plus rejection of ambiguous underscore header aliases;
audited fail-closed handling for non-ASCII compact JWT input;
fail-closed encoded request rejection with automatic decompression disabled;
exclusive owner-only, no-overwrite throwaway key creation with a permission
check, and a token example that does not put bearer credentials in process
arguments;
installable Python 3.11–3.14 package with CI, CodeQL, Dependabot, security
policy, MIT license, and architecture documentation.

This remains a loopback-only educational project and does not claim production
readiness or compliance with a specific framework.

Navigation Menu