انتقل إلى المحتوى
أمين أبوزيد
Englishالعربية
JNR-024

أساسيات أمان الـ API

  • 6 درس
  • 1.5 ساعة تدريب (تقدير)
ابدأ الوحدة
في هذه الصفحة 8 موضوعات

نص الدروس والتمارين باللغة الإنجليزية، بينما تبقى واجهة الموقع وعناوين الدروس بالعربية.

نظرة عامة

الموضوعات

  • المصادقة مقابل التفويض
  • الجلسة مقابل الرمز (Session vs token)
  • HTTPS
  • CORS
  • مفاهيم CSRF

تعلّم أولًا

1.5 ساعة تدريب (تقدير)

مخرجات التعلم

  1. Distinguish authentication from authorization.
  2. Compare session-based and token-based authentication.
  3. Explain what HTTPS protects and why APIs must never run over plain HTTP in production.
  4. Explain CORS and CSRF: what each protects against and when each applies.

الدروس

  1. 01من أنت مقابل ما المسموح لك
  2. 02الجلسات مقابل الرموز (Tokens)
  3. 03HTTPS للـ APIs
  4. 04تبسيط CORS
  5. 05CSRF ومتى ينطبق
  6. 06عرض عملي: مشاهدة فشل CORS وإصلاحه

المختبر والتمارين

Lab

JNR-024-LAB1 · CORS experiment

Outcomes: 3, 4 (with 1 and 2 covered by the quiz and exercises) · Time: ~1.5 h Serve a small HTML page from another origin (different port). From it, call the Shop API with fetch and observe the browser's CORS error. Then configure CORS for exactly one allowed origin and retry from the allowed and a different origin.

Acceptance: only the allowed origin succeeds.

Exercises (assessment: quiz)

IDOutcomeTask
JNR-024-EX011Decide 401 or 403 for five scenarios (no token, expired token, wrong role, other user's order, admin).
JNR-024-EX022Write a table comparing sessions and tokens: where state lives, revocation, scaling.
JNR-024-EX033Explain in four sentences what HTTPS protects and what it does not.
JNR-024-EX044List which of these are different origins from https://shop.com: https://shop.com:8443, http://shop.com, https://api.shop.com, https://shop.com/cart.
JNR-024-EX054Explain why curl ignores CORS and what that means for server protection.
JNR-024-EX064Describe a CSRF attack on a cookie-authenticated API and one defense; state why a bearer-header API is less exposed.
أظهر الحلول
  • EX01 No token: 401. Expired token: 401. Wrong role: 403. Other user's order: 403 (or 404 to hide existence). Admin: allowed.
  • EX02 Sessions: state on server, easy revoke, needs shared store to scale. Tokens: state in the token, hard to revoke early, scale easily.
  • EX03 Protects against eavesdropping and tampering, and verifies server identity; does not authenticate users or fix application bugs.
  • EX04 Different: :8443 (port), http:// (scheme), api.shop.com (host). Same origin: https://shop.com/cart.
  • EX05 CORS is a browser rule; other clients do not enforce it, so the server must still do authentication and authorization.
  • EX06 An evil page submits a form to /orders; the browser attaches the session cookie. Defense: CSRF token or SameSite cookie. A script-set bearer header is not attached automatically.

Outcomes 1 to 3 are checked by the exercises and quiz Q01 to Q07; the lab covers outcome 4 in practice.

الاختبار

Outcomes: O1 authentication vs authorization · O2 sessions vs tokens · O3 HTTPS · O4 CORS and CSRF.

اختبار ذاتي لك: لا توجد درجات، ولا يُحفظ أو يُرسل أي شيء. اختر إجابة ثم تحقق منها، ويمكنك المحاولة مرة أخرى كما تشاء.

  1. 1"Who are you?" is:O1
  2. 2A logged-in user without permission gets:O1
  3. 3Missing credentials usually gives:O1
  4. 4Which keeps login state on the server?O2
  5. 5A downside of stateless tokens:O2
  6. 6HTTPS protects against:O3
  7. 7In production, an API with tokens over plain HTTP is:O3
  8. 8Two origins differ if they differ in:O4
  9. 9CORS is enforced by:O4
  10. 10CSRF mainly threatens APIs that authenticate with:O4

الجزء العملي

Six exercises JNR-024-EX01 to EX06 plus the CORS lab. Assessment is this quiz: pass at 8 of 10 correct and a lab where only the allowed origin succeeds.

أخطاء شائعة

allowedOrigins("*") with credentials; thinking CORS protects the server.

التقييم

Quiz.

الصلة بالمسار الوظيفي

Prepares JNR-P5.

اكتب للبحث في المستويات والمراحل والوحدات والدروس.