OAuth2 Audit Gateway
Build a security gateway with ASP.NET Core that sits in front of your internal APIs. Every request must carry an OAuth2 access token (a JWT issued by an identity provider such as Keycloak); the gateway checks the token's signature, expiry, issuer and audience, then applies rules per route (for example, only tokens with the orders:write scope may POST to /orders) before forwarding the request with YARP, Microsoft's reverse proxy library. Every decision, allowed or denied, is recorded as a structured audit event in PostgreSQL, reliably, even when the database is briefly unavailable. You'll learn OAuth2 and JWT validation, policy-based authorization, reverse proxying, designing audit logs, reliable event storage with a buffer and retries, and testing security rules.
- Estimate
- ~16h
- Steps
- 7
- Completed by
- 0
- Proposed by
- codeseed.app
ASP.NET Core · System.Text.Json · PostgreSQL
Project roadmap
- 01
Design the gateway
~2hWrite DESIGN.md: which identity provider issues tokens (run Keycloak in Docker for development), which claims are checked (issuer, audience, expiry, scopes, roles), the route policy file format (path pattern, methods, required scopes or roles), and the audit event (time, request id, user id, client id, route, method, decision, reason, status and latency, never the token itself). Done when: DESIGN.md defines the token checks, policies and audit event.
- 02
Validate tokens
~2.5hCreate an ASP.NET Core project with JWT bearer authentication configured with the provider's authority, so signing keys are fetched and refreshed from its JWKS endpoint automatically. Require a valid issuer, audience and lifetime with a small clock skew. Return 401 with a WWW-Authenticate header for missing, expired or tampered tokens. Done when: a real token from Keycloak is accepted, and expired or modified tokens get 401.
- 03
Apply route policies and forward
~2.5hLoad route policies from configuration and enforce them with authorization policies checking scopes and roles (a scope claim can hold several space-separated values). Forward allowed requests with YARP to the backend services, adding the user id as a header and removing the original Authorization header when the backend doesn't need it. Deny unknown routes by default with 404. Done when: each route accepts and rejects exactly the tokens its policy says.
- 04
Record audit events
~2.5hWrite middleware that creates an audit event for every request after it completes, including denials with their reason, serialized with System.Text.Json. Store events in PostgreSQL in a table indexed by time and user. Never write the token or secrets. Done when: every allowed and denied request appears in the audit table with the right decision and reason.
- 05
Make auditing reliable
~2.5hDon't slow down requests by writing to the database inline: put events on a bounded Channel and write them in batches from a background service. When the database is down, retry with backoff, and when the buffer fills up, write events to a local file to replay later, and log a warning, so no event is lost. On shutdown, flush the buffer. Done when: stopping PostgreSQL for a minute loses no audit events once it's back.
- 06
Add limits and observability
~1.5hAdd rate limiting per client id, request size limits, and health checks for the gateway and the audit writer. Expose metrics: requests by decision, token validation failures by reason, audit buffer size and write failures. Done when: the metrics show denials by reason, and rate limits return 429.
- 07
Test the security rules
~2.5hWrite integration tests with WebApplicationFactory, issuing test tokens signed with a test key: valid tokens, expired tokens, the wrong issuer or audience, a tampered signature, missing scopes, and routes without a policy. Check the audit events for each case, and that audit events are replayed after a simulated database outage. Done when: dotnet test passes.
Ready to build this?
Get a GitHub repo and start building. Your AI reviewer checks each step as you go.
Tech stack