I'm designing a microservices-based architecture. The architecture should support multiple devices accessing the API.

In order to secure the internal Resource APIs, I wanted to implement authentication and authorization based on JWTs and Refresh Tokens.

My requirements are:

1. Preventing an attacker from using XSS to steal the user's token
2. Preventing CSRF attacks
3. In-bounds security: even if the attacker can send requests to the internal Resource APIs, he can't do anything without a signed JWT
4. Managing users (Authentication and Permissions) via a single internal Users API
5. The tokens can be revoked at any time
6. Support Multi-Factor Authentication via TOPT

This is what I came with:

Few details:

1. The JWTs are really short-lived (30 seconds)
2. The Internal API Gateway will include an endpoint (login) for converting username, password, and TOPT passcode to a new refresh token via the Users API.

Will this architecture actually work? will it be secure? Thank you very much!