Keep Your API Secure

Kiyv JS November 2014

Transcript

1. Keep Your API Secure
3. OSWAP
4. XSS
5. SQL Injection
6. Plugins
7. Today
8. Crossite
9. CSRF
10. HTTP
11. Cookies
12. Secure HttpOnly
13. Set-Cookie: name=value; domain=.whatever.com; path=/; expires=Tue, 28-Nov-2034 21: 05:44 GMT; secure; HttpOnly
14. Cookie: name=value
15. sessionId=a4d543bc809
16. Session Management
17. In Memory
18. External
20. Client Based
21. WAT??? нужна картинка
22. Encrypt
23. salt
24. salt+encData
25. salt+encData
26. Sign
27. (salt+encData)+signature
28. (salt+encData+createdAt+lifetime Duration)+signature
29. 2 keys: encryption key signing key
30. {user info} => encrypt => sign => cookie
31. cookie => check signature => decrypt => {User Info}
32. Too complicated?
33. But ready-made!
34. by Mozilla
35. mozilla/node-client-sessions
36. Browser sends cookies automatically
37. CSRF
38. Roll-your-own-Cookie
39. Client: custom header / payload Server: middleware
40. Tokens
41. JSON Web Token
42. {user data} => encrypt => sign => token => memory, localStorage
43. jsonwebtoken express-jwt
44. Securing WebSockets
45. HTTP Upgrade Request 101
46. Only implicit Auth Cookie or Basic Auth
47. HTTP: get WS token WS: send token to validate user
48. Fin
49. Frontend UA
50. Frontend UA Angular UA Ember UA Node UA Mobile Frontend ...
52. Gitter
53. NodeSchool Node Forward Angular UI RobotsConf lxjs
54. dev-ua
56. https://tinyurl.com/welcome-to-dev-ua frontendua.im angular.im