Module security 

Security bounded context: establishing and enforcing caller identity.

Listener/upstream TLS machinery (tls), request authentication (authn), request authorization (authz), OAuth2 client-credentials proxying (oauth2, DW-035), OpenID Connect discovery / introspection / token exchange / auth-code+PKCE (oidc, DW-034), FIPS 140-3 mode enforcement (fips, DW-111), post-quantum TLS hybrid key exchange (pq, DW-105), bot detection hooks (bot_hooks, DW-109), signed URL request authentication (signed_url, DW-109), and upstream TLS certificate pinning (cert_pinning, DW-109). May depend on config, state, and observability.

Modules

acme

ACME / Let’s Encrypt automation (SEC-02).

authn

Request authentication (DW-019, feature analysis section 4.6; pepper and mTLS hardening per #124; HMAC request signing per DW-036).

authz

Request authorization (DW-020, feature analysis sections 4.7 and 4.15).

bot_hooks

Bot detection hooks (DW-109).

cedar

Cedar policy engine integration (DW-060, CFG-07 / #241: hot reload).

cert_pinning

Upstream TLS certificate pinning (DW-109, SEC-04).

fips

FIPS 140-3 mode (DW-111, Enterprise).

geoip

GeoIP lookup for geo-based ACL predicates (DW-050, feature analysis 5-Security “Geo-blocking”).

oauth2

OAuth2 client-credentials proxying (DW-035, feature analysis 4.6).

oidc

OpenID Connect: discovery, token introspection, revocation, token exchange, and the authorization-code + PKCE relying-party flow (DW-034).

pq

Post-quantum TLS (DW-105): X25519+ML-KEM hybrid key exchange.

signed_url

Signed URL request authentication (DW-109).

tls

TLS machinery for listeners (DW-007, feature analysis 4.10 / 4.13).