Zero-Trust API Security in Modern Monorepos: RBAC, Session Cookies & Throttling

### Subdomains Do Not Equal Security Boundaries A common anti-pattern in modern full-stack web applications is assuming that hosting an admin interface on `admin.company.com` and a marketing site on `www.company.com` automatically secures the backend. If your backend API fails to enforce role-based authorization on every protected route handler, a malicious actor can simply query the API directly. ### The HttpOnly Cookie Defense Local storage is inherently vulnerable to cross-site scripting (XSS). If an attacker injects a malicious script via an unsanitized rich-text field, any JWT stored in `localStorage` is instantly compromised. By contrast, using cryptographic session tokens stored exclusively in `HttpOnly`, `Secure`, and `SameSite=Strict` cookies makes token extraction impossible via JavaScript. ```typescript response.cookie('__Host-company_admin_session', sessionToken, { httpOnly: true, secure: true, sameSite: 'strict', path: '/', }); ``` ### Global NestJS Guards Every protected administrative endpoint must enforce a NestJS `AuthGuard` and `RolesGuard` at the controller level: ```typescript @UseGuards(SessionAuthGuard, RolesGuard) @Roles('SUPER_ADMIN') @Get('audit-logs') async getAuditLogs() { return this.auditService.findAll(); } ```