Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Keep Your API Secure

Avatar for Андрей Листочкин (Andrey Listochkin) Андрей Листочкин (Andrey Listochkin)
November 29, 2014
Programming
1
83

Keep Your API Secure

Kiyv JS November 2014

Avatar for Андрей Листочкин (Andrey Listochkin)

Андрей Листочкин (Andrey Listochkin)

November 29, 2014
Tweet

More Decks by Андрей Листочкин (Andrey Listochkin)

See All by Андрей Листочкин (Andrey Listochkin)
Everybody Stand Back! I Know Regular Expressions
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
0
190
Command-line scripting with Rust. Wait, what?!
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
0
360
Server Memory - BuildStuff Ukraine 2019
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
0
49
Server Memory - Chernivtsi JS 2019
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
1
150
10 Years Later
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
0
370
Managing Managers - DevTalks iHUB
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
0
62
Time, Numbers, Text
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
1
600
Software Licensing: A Minefield Guide
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
0
150
We Make Bots. For Real
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
0
430

Other Decks in Programming

See All in Programming
Introduce Hono CLI
Avatar for Yusuke Wada yusukebe
4
1.7k
理論と実務のギャップを超える
Avatar for kmuto eycjur
0
140
AI Agent 時代的開發者生存指南
Avatar for 高見龍 eddie
2
1.3k
Leading Effective Engineering Teams in the AI Era
Avatar for Addy Osmani addyosmani
6
440
バッチ処理を「状態の記録」から「事実の記録」へ
Avatar for HideyukiKitao panda728
PRO
0
160
Introducing ReActionView: A new ActionView-Compatible ERB Engine @ Kaigi on Rails 2025, Tokyo, Japan
Avatar for Marco Roth marcoroth
3
1k
Foundation Modelsを実装日本語学習アプリを作ってみた！
Avatar for 蛋白（たんぱく・TANPACT） hypebeans
0
110
Domain-centric? Why Hexagonal, Onion, and Clean Architecture Are Answers to the Wrong Question
Avatar for Oliver Drotbohm olivergierke
2
890
ALL CODE BASE ARE BELONG TO STUDY
Avatar for uzulla uzulla
25
6k
Claude Agent SDK を使ってみよう
Avatar for Hayami Shuhei hyshu
0
810
いま中途半端なSwift 6対応をするより、Default ActorやApproachable Concurrencyを有効にしてからでいいんじゃない？
Avatar for yimajo yimajo
2
430
大規模アプリのDIフレームワーク刷新戦略 ～過去最大規模の並行開発を止めずにアプリ全体に導入するまで～
Avatar for GO Inc. dev mot_techtalk
1
450

Featured

See All Featured
Helping Users Find Their Own Way: Creating Modern Search Experiences
Avatar for Dan Newman danielanewman
30
2.9k
GraphQLの誤解/rethinking-graphql
Avatar for sonatard sonatard
73
11k
Navigating Team Friction
Avatar for Lara Hogan lara
190
15k
Statistics for Hackers
Avatar for Jake VanderPlas jakevdp
799
220k
Git: the NoSQL Database
Avatar for Brandon Keepers bkeepers
PRO
431
66k
Connecting the Dots Between Site Speed, User Experience & Your Business [WebExpo 2025]
Avatar for Tammy Everts tammyeverts
9
590
The Cult of Friendly URLs
Avatar for Andy Hume andyhume
79
6.6k
Designing for Performance
Avatar for Lara Hogan lara
610
69k
Visualization
Avatar for Eitan Lees eitanlees
149
16k
Side Projects
Avatar for Sacha Greif sachag
455
43k
The Power of CSS Pseudo Elements
Avatar for Geoffrey Crofte geoffreycrofte
79
6k
GraphQLとの向き合い方2022年版
Avatar for Yosuke Kurami quramy
49
14k

Transcript

  1. Keep Your API Secure

  2. None

  3. OSWAP

  4. XSS

  5. SQL Injection

  6. Plugins

  7. Today

  8. Crossite

  9. CSRF

  10. HTTP

  11. Cookies

  12. Secure HttpOnly

  13. Set-Cookie: name=value; domain=.whatever.com; path=/; expires=Tue, 28-Nov-2034 21: 05:44 GMT; secure;

    HttpOnly

  14. Cookie: name=value

  15. sessionId=a4d543bc809

  16. Session Management

  17. In Memory

  18. External

  19. None

  20. Client Based

  21. WAT??? нужна картинка

  22. Encrypt

  23. salt

  24. salt+encData

  25. salt+encData

  26. Sign

  27. (salt+encData)+signature

  28. (salt+encData+createdAt+lifetime Duration)+signature

  29. 2 keys: encryption key signing key

  30. {user info} => encrypt => sign => cookie

  31. cookie => check signature => decrypt => {User Info}

  32. Too complicated?

  33. But ready-made!

  34. by Mozilla

  35. mozilla/node-client-sessions

  36. Browser sends cookies automatically

  37. CSRF

  38. Roll-your-own-Cookie

  39. Client: custom header / payload Server: middleware

  40. Tokens

  41. JSON Web Token

  42. {user data} => encrypt => sign => token => memory,

    localStorage

  43. jsonwebtoken express-jwt

  44. Securing WebSockets

  45. HTTP Upgrade Request 101

  46. Only implicit Auth Cookie or Basic Auth

  47. HTTP: get WS token WS: send token to validate user

  48. Fin

  49. Frontend UA

  50. Frontend UA Angular UA Ember UA Node UA Mobile Frontend

    ...
  51. None

  52. Gitter

  53. NodeSchool Node Forward Angular UI RobotsConf lxjs

  54. dev-ua

  55. None

  56. https://tinyurl.com/welcome-to-dev-ua frontendua.im angular.im