Prove the caller, every single request.
B2 establishes who is calling on every request — never once at login and then trusted forever. It validates identity, origin, and key material across four schemes (HMAC, Service-HMAC, AuthCookie, and Service-Key), so browser, mobile, service, job, and agent callers are all authenticated by the same uniform contract.
1. Why authenticate per request
Session-once, trust-forever is the assumption most breaches are built on. B2 re-establishes the caller on every request, so a stolen cookie, a replayed token, or a hijacked connection does not silently inherit a standing identity. In a Never Trust pipeline, authentication is a property of the request, not of a prior moment.
2. Four schemes, one contract
B5 authenticates browser, mobile, service, job, and agent callers through four schemes — keyed HMAC and Service-HMAC for signed machine and service traffic, AuthCookie for interactive sessions, and Service-Key for trusted backend callers. Each scheme resolves to the same internal identity contract, so authorization downstream never has to care which front door a request used. Heterogeneous clients, one consistent notion of “who.”
3. Identity, origin, and key validation
For each request B2 validates three things together: the asserted identity, the origin the request claims to come from, and the key material backing the assertion. A signature that verifies but carries an unknown key is rejected; an identity asserted from an unexpected origin is rejected. Binding all three closes the gap between “this message is well-formed” and “this caller is who they say they are.”
Signing keys live by reference in a FIPS 140-3 HSM; B2 verifies against them without the application ever holding raw key material.
4. The calling convention
Authentication is declared at the pipeline, and the active scheme is selected per identity rather than per endpoint.
// B2 — per-request authentication across all caller types
services.AddB5SecurityKit(o => {
o.Auth.Schemes = Scheme.Hmac | Scheme.ServiceHmac | Scheme.AuthCookie | Scheme.ServiceKey;
o.Auth.ValidateOrigin = true;
o.Auth.Keys = KeySource.HsmByReference;
o.Auth.OnFailure = FailMode.Closed;
});5. What an attacker actually gets
A replayed request is caught by signature freshness; a forged identity fails key validation; a valid message from a wrong origin is rejected by origin binding. Because authentication runs on every request, none of these survive past a single hop — there is no long-lived trust to inherit.
6. Where this lands in an audit
B2 is the evidence for strong authentication and credential management (NIST CSF PR.AA; SOC 2 CC6.1; ISO 27001 A.5.16–A.5.17, A.8.5). The answer to “how do you know who is calling?” is the same for a browser, a service, and an autonomous agent.
Next: B3 · IP Firewall & MFA — known networks, stepped-up actions →