Asymmetric Protection with Ephemeral X-keys.
End-to-end encryption for every API request between your frontend and backend — transparent, lightweight, and production-ready.
What is APEX?
APEX is an open-source end-to-end encryption protocol designed specifically for web applications. It secures every API request and response between a React frontend and a Spring Boot backend using elliptic curve key exchange (ECDH), AES-256-GCM authenticated encryption, and sequence-based replay protection.
Crucially, APEX sits invisibly between your frontend fetch calls and your backend endpoints — it requires zero changes to your existing controllers, routes, or business logic.
Architecture & layer arrangement
Frontend Interceptor Layer
The APEX client automatically wraps outgoing requests, encrypting the payload and appending sequence numbers before it hits the network.
Transport Layer (TLS)
The payload travels over standard HTTPS. Even if the TLS tunnel is terminated at a load balancer, the APEX payload remains encrypted.
Backend Filter Layer
The ApexFilter intercepts the request before it reaches Spring controllers — verifying the auth tag, checking for replay attacks, decrypting the body, and forwarding the raw request to your business logic.
How it works
The Handshake
A one-time operation per session that establishes shared encryption keys without transmitting them over the network.
- Client and server generate ephemeral ECDH (P-256) key pairs.
- They exchange public keys and random nonces.
- Both independently compute a shared secret using ECDH mathematics.
- HKDF-SHA256 derives the final enc_key (encryption) and mac_key (authentication).
Request Encryption
Every API call from the frontend is wrapped in an APEX envelope.
{
"iv": "base64-12-byte-initialization-vector",
"ciphertext": "base64-aes-256-gcm-encrypted-payload",
"seq": 42
}Server Verification
The ApexFilter intercepts incoming requests and performs four checks before passing data to the controller.
- Session validity check
- Authentication tag validation (AES-GCM built-in)
- Sequence number verification (prevents replay)
- Payload decryption and forwarding
Security properties
Confidentiality
AES-256-GCM encryption ensures nobody can read request or response content.
Integrity
GCM authentication tags detect any modification down to a single bit.
Authentication
HMAC-SHA256 signing ensures requests only come from valid sessions.
Replay Protection
Strict sequence numbering means captured packets cannot be re-sent.
Forward Secrecy
Ephemeral ECDH keys are discarded, protecting past traffic even if a future breach occurs.