We have a Web server (which also does authentication and authorization) that manages, via an API, one or more servers that contain highly sensitive data. In the below architecture diagram, we manage everything except the end user:
We are looking at using JWTs for token based authentication/authorization. This token is issued from the Web server upon successful authentication. Following that, each request to the API servers would require that the user send their token through the Web server to the API servers.
The reason the token is passed through the Web server is so that we can restrict connections from anything other than the Web server (via IP Address).
Ideally none of the servers, except the Web Server, need to know about all the users.
However, the greatest concern with this is that the Web Server is our single point of security. From my knowledge, if an attacker got full access to the Web Server, they'd be able to issue themselves a valid token and access the protected resources of the other servers.
I was thinking of having maybe an API Key (in conjunction with a username and password) that only the servers know about and not the Web Server. This could be added into the JWT when the token is created but never stored by the Web server. However, I'm not sure this is the best option.
Any help would be much appreciated...