Day 90 — Phase 3 Review & Architecture Diagram

Review Checklist

Phase 3 Code Audit:
[ ] All HTTP handlers have timeout context
[ ] WAF normalization covers URL + HTML + double-encoding
[ ] Rate limiters clean up expired buckets (no memory leak)
[ ] Auth failures return constant-time responses
[ ] CORS never reflects origin without allowlist check
[ ] PII masking covers all sensitive field names
[ ] Security headers set on all responses (including 4xx/5xx)

Performance Numbers (from Day 88):
[ ] Baseline latency measured
[ ] Per-middleware overhead documented
[ ] WAF overhead acceptable for SLO
[ ] Rate limiter doesn't serialize all requests (use sync.Map not single Mutex)

Tests:
[ ] go test -race ./... passes
[ ] Integration tests cover: valid req, sqli, xss, no auth, rate limit, cors
[ ] Fuzz tests run for 30s minimum, no crashes

Architecture:
[ ] ASCII diagram drawn
[ ] Each component mapped to OWASP control
[ ] Vendor decisions documented: what you'd buy vs build

ASCII Architecture Diagram

Internet
    │
    ▼
┌─────────────────────────────────────────────────────────────────┐
│                    Unified Security Proxy                       │
│                                                                 │
│  L4 Layer (TCP/TLS):                                           │
│    mTLS Termination ──── SNI Routing ──── L4 Rate Limit        │
│    Circuit Breaker ───── Connection Pool ── Health Check        │
│                                                                 │
│  L7 Layer (HTTP):                                               │
│    ┌─────────────────────────────────────────────────────────┐ │
│    │ Middleware Chain (in order)                              │ │
│    │                                                          │ │
│    │  PanicRecoverer → RequestID → CORS                      │ │
│    │     → IP Rate Limit → Bot Check                         │ │
│    │     → Auth (ECDSA Token / API Key / HMAC)               │ │
│    │     → User Rate Limit → ThreatIntel                     │ │
│    │     → WAF (Normalize → SQLi/XSS/Traversal/CmdInj)      │ │
│    │     → Schema Validation → Input Validation              │ │
│    │     → PII Scrubber → Security Headers                   │ │
│    │     → Request Logger → Application Handler              │ │
│    └─────────────────────────────────────────────────────────┘ │
│                                                                 │
│  Observability:                                                 │
│    slog JSON → SIEM │ expvar → Prometheus │ pprof → Profiler   │
│    /health  /stats  /debug/vars  /debug/pprof                  │
│                                                                 │
│  Operations:                                                    │
│    SIGHUP → hot-reload config (WAF mode, rate limits, CORS)    │
│    SIGTERM → 3-stage graceful drain                            │
│    SIGUSR2 → goroutine stack dump                              │
└─────────────────────────────────────────────────────────────────┘
    │              │              │
    ▼              ▼              ▼
Backend A      Backend B      Backend C

Build vs Buy Decision Framework