Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Keep Your API Secure

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for Андрей Листочкин (Andrey Listochkin) Андрей Листочкин (Andrey Listochkin)
November 29, 2014
Programming
1
85

Keep Your API Secure

Kiyv JS November 2014

Avatar for Андрей Листочкин (Andrey Listochkin)

Андрей Листочкин (Andrey Listochkin)

November 29, 2014
Tweet

More Decks by Андрей Листочкин (Andrey Listochkin)

See All by Андрей Листочкин (Andrey Listochkin)
Everybody Stand Back! I Know Regular Expressions
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
0
200
Command-line scripting with Rust. Wait, what?!
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
0
410
Server Memory - BuildStuff Ukraine 2019
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
0
61
Server Memory - Chernivtsi JS 2019
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
1
160
10 Years Later
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
0
380
Managing Managers - DevTalks iHUB
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
0
70
Time, Numbers, Text
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
1
620
Software Licensing: A Minefield Guide
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
0
170
We Make Bots. For Real
Avatar for Андрей Листочкин (Andrey Listochkin) listochkin
0
440

Other Decks in Programming

See All in Programming
AI時代のキャリアプラン「技術の引力」からの脱出と「問い」へのいざない / tech-gravity
Avatar for MinoDriven minodriven
20
6.9k
AIエージェントのキホンから学ぶ「エージェンティックコーディング」実践入門
Avatar for Masahiro Nishimi masahiro_nishimi
5
330
20260127_試行錯誤の結晶を1冊に。著者が解説 先輩データサイエンティストからの指南書 / author's_commentary_ds_instructions_guide
Avatar for nash_efp nash_efp
0
930
15年続くIoTサービスの SREエンジニアが挑む 分散トレーシング導入
Avatar for Melonps melonps
2
180
Apache Iceberg V3 and migration to V3
Avatar for Tomohiro Tanaka tomtanaka
0
150
Patterns of Patterns
Avatar for Denys Poltorak denyspoltorak
0
1.4k
Fluid Templating in TYPO3 14
Avatar for Simon Praetorius s2b
0
130
AIフル活用時代だからこそ学んでおきたい働き方の心得
Avatar for shinoyu shinoyu
0
130
「ブロックテーマでは再現できない」は本当か？
Avatar for Takashi Kitajima inc2734
0
750
AI時代の認知負荷との向き合い方
Avatar for OptFit Corp. optfit
0
150
ThorVG Viewer In VS Code
Avatar for Nor-s nors
0
770
Spinner 軸ズレ現象を調べたらレンダリング深淵に飲まれた #レバテックMeetup
Avatar for 弁護士ドットコム bengo4com
1
230

Featured

See All Featured
Winning Ecommerce Organic Search in an AI Era - #searchnstuff2025
Avatar for Aleyda Solis aleyda
0
1.9k
Dealing with People You Can't Stand - Big Design 2015
Avatar for Cassini Nazir cassininazir
367
27k
Impact Scores and Hybrid Strategies: The future of link building
Avatar for Tamara Novitovic tamaranovitovic
0
200
Navigating the Design Leadership Dip - Product Design Week Design Leaders+ Conference 2024
Avatar for Andy Polaine apolaine
0
170
The Art of Programming - Codeland 2020
Avatar for Erika Heidi erikaheidi
57
14k
The AI Search Optimization Roadmap by Aleyda Solis
Avatar for Aleyda Solis aleyda
1
5.2k
Amusing Abliteration
Avatar for ianozsvald ianozsvald
0
96
Side Projects
Avatar for Sacha Greif sachag
455
43k
The Art of Delivering Value - GDevCon NA Keynote
Avatar for David Neal reverentgeek
16
1.8k
Large-scale JavaScript Application Architecture
Avatar for Addy Osmani addyosmani
515
110k
SEO Brein meetup: CTRL+C is not how to scale international SEO
Avatar for Linda Hogenes lindahogenes
0
2.3k
Have SEOs Ruined the Internet? - User Awareness of SEO in 2025
Avatar for Akash Hashmi akashhashmi
0
270

Transcript

  1. Keep Your API Secure

  2. None

  3. OSWAP

  4. XSS

  5. SQL Injection

  6. Plugins

  7. Today

  8. Crossite

  9. CSRF

  10. HTTP

  11. Cookies

  12. Secure HttpOnly

  13. Set-Cookie: name=value; domain=.whatever.com; path=/; expires=Tue, 28-Nov-2034 21: 05:44 GMT; secure;

    HttpOnly

  14. Cookie: name=value

  15. sessionId=a4d543bc809

  16. Session Management

  17. In Memory

  18. External

  19. None

  20. Client Based

  21. WAT??? нужна картинка

  22. Encrypt

  23. salt

  24. salt+encData

  25. salt+encData

  26. Sign

  27. (salt+encData)+signature

  28. (salt+encData+createdAt+lifetime Duration)+signature

  29. 2 keys: encryption key signing key

  30. {user info} => encrypt => sign => cookie

  31. cookie => check signature => decrypt => {User Info}

  32. Too complicated?

  33. But ready-made!

  34. by Mozilla

  35. mozilla/node-client-sessions

  36. Browser sends cookies automatically

  37. CSRF

  38. Roll-your-own-Cookie

  39. Client: custom header / payload Server: middleware

  40. Tokens

  41. JSON Web Token

  42. {user data} => encrypt => sign => token => memory,

    localStorage

  43. jsonwebtoken express-jwt

  44. Securing WebSockets

  45. HTTP Upgrade Request 101

  46. Only implicit Auth Cookie or Basic Auth

  47. HTTP: get WS token WS: send token to validate user

  48. Fin

  49. Frontend UA

  50. Frontend UA Angular UA Ember UA Node UA Mobile Frontend

    ...
  51. None

  52. Gitter

  53. NodeSchool Node Forward Angular UI RobotsConf lxjs

  54. dev-ua

  55. None

  56. https://tinyurl.com/welcome-to-dev-ua frontendua.im angular.im