Upgrade to PRO for Only $50/Year—Limited-Time Offer! 🔥
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Keep Your API Secure
Search
Андрей Листочкин (Andrey Listochkin)
November 29, 2014
Programming
1
84
Keep Your API Secure
Kiyv JS November 2014
Андрей Листочкин (Andrey Listochkin)
November 29, 2014
Tweet
Share
More Decks by Андрей Листочкин (Andrey Listochkin)
See All by Андрей Листочкин (Andrey Listochkin)
Everybody Stand Back! I Know Regular Expressions
listochkin
0
200
Command-line scripting with Rust. Wait, what?!
listochkin
0
400
Server Memory - BuildStuff Ukraine 2019
listochkin
0
56
Server Memory - Chernivtsi JS 2019
listochkin
1
150
10 Years Later
listochkin
0
380
Managing Managers - DevTalks iHUB
listochkin
0
67
Time, Numbers, Text
listochkin
1
610
Software Licensing: A Minefield Guide
listochkin
0
160
We Make Bots. For Real
listochkin
0
440
Other Decks in Programming
See All in Programming
AI時代を生き抜く 新卒エンジニアの生きる道
coconala_engineer
1
140
組み合わせ爆発にのまれない - 責務分割 x テスト
halhorn
1
150
なあ兄弟、 余白の意味を考えてから UI実装してくれ!
ktcryomm
11
11k
俺流レスポンシブコーディング 2025
tak_dcxi
14
8.8k
ハイパーメディア駆動アプリケーションとIslandアーキテクチャ: htmxによるWebアプリケーション開発と動的UIの局所的適用
nowaki28
0
420
AIコーディングエージェント(Gemini)
kondai24
0
220
안드로이드 9년차 개발자, 프론트엔드 주니어로 커리어 리셋하기
maryang
1
110
ZOZOにおけるAI活用の現在 ~モバイルアプリ開発でのAI活用状況と事例~
zozotech
PRO
8
5.7k
Go コードベースの構成と AI コンテキスト定義
andpad
0
130
TestingOsaka6_Ozono
o3
0
160
まだ間に合う!Claude Code元年をふりかえる
nogu66
5
830
関数実行の裏側では何が起きているのか?
minop1205
1
700
Featured
See All Featured
Designing for humans not robots
tammielis
254
26k
Music & Morning Musume
bryan
46
7k
Building Adaptive Systems
keathley
44
2.9k
Raft: Consensus for Rubyists
vanstee
141
7.2k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
PRO
196
70k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
marcduiker
35
2.3k
Context Engineering - Making Every Token Count
addyosmani
9
510
How STYLIGHT went responsive
nonsquared
100
6k
Faster Mobile Websites
deanohume
310
31k
The Web Performance Landscape in 2024 [PerfNow 2024]
tammyeverts
12
970
The Psychology of Web Performance [Beyond Tellerrand 2023]
tammyeverts
49
3.2k
Dealing with People You Can't Stand - Big Design 2015
cassininazir
367
27k
Transcript
Keep Your API Secure
None
OSWAP
XSS
SQL Injection
Plugins
Today
Crossite
CSRF
HTTP
Cookies
Secure HttpOnly
Set-Cookie: name=value; domain=.whatever.com; path=/; expires=Tue, 28-Nov-2034 21: 05:44 GMT; secure;
HttpOnly
Cookie: name=value
sessionId=a4d543bc809
Session Management
In Memory
External
None
Client Based
WAT??? нужна картинка
Encrypt
salt
salt+encData
salt+encData
Sign
(salt+encData)+signature
(salt+encData+createdAt+lifetime Duration)+signature
2 keys: encryption key signing key
{user info} => encrypt => sign => cookie
cookie => check signature => decrypt => {User Info}
Too complicated?
But ready-made!
by Mozilla
mozilla/node-client-sessions
Browser sends cookies automatically
CSRF
Roll-your-own-Cookie
Client: custom header / payload Server: middleware
Tokens
JSON Web Token
{user data} => encrypt => sign => token => memory,
localStorage
jsonwebtoken express-jwt
Securing WebSockets
HTTP Upgrade Request 101
Only implicit Auth Cookie or Basic Auth
HTTP: get WS token WS: send token to validate user
Fin
Frontend UA
Frontend UA Angular UA Ember UA Node UA Mobile Frontend
...
None
Gitter
NodeSchool Node Forward Angular UI RobotsConf lxjs
dev-ua
None
https://tinyurl.com/welcome-to-dev-ua frontendua.im angular.im