انتقل إلى المحتوى
أمين أبوزيد
Englishالعربية
JNR-038

الجلسات والرموز (Sessions and tokens)

  • 7 درس
  • 3 ساعة تدريب (تقدير)
ابدأ الوحدة
في هذه الصفحة 8 موضوعات

نص الدروس والتمارين باللغة الإنجليزية، بينما تبقى واجهة الموقع وعناوين الدروس بالعربية.

نظرة عامة

الموضوعات

  • ملفات تعريف الارتباط (Cookies)
  • الجلسات (Sessions)
  • رموز الحامل (Bearer tokens)
  • بنية JWT والتحقق منه

تعلّم أولًا

3 ساعة تدريب (تقدير)

مخرجات التعلم

  1. Explain cookie-based sessions and secure cookie attributes (HttpOnly, Secure, SameSite).
  2. Decode a JWT and explain header, claims, and signature.
  3. Validate a JWT correctly (signature, algorithm, issuer, audience, expiry).
  4. Compare stateful sessions and stateless tokens, including revocation and expiry trade-offs.

الدروس

  1. 01ملفات تعريف الارتباط (Cookies) وجلسات الخادم
  2. 02رموز الحامل (Bearer tokens)
  3. 03داخل JWT
  4. 04التحقق من الرموز بشكل صحيح
  5. 05الانتهاء والتجديد والإلغاء
  6. 06عرض عملي: إصدار JWT والتحقق منه
  7. 07عرض عملي: مهاجمة التحقق من الرموز (التلاعب والانتهاء والجمهور)

المختبر والتمارين

Lab

JNR-038-LAB1 · Token auth for Shop

Outcomes: 1–4 · Time: ~3 h Issue short-lived signed JWTs at login and secure the API as a resource server that validates them. Acceptance: tampered, expired, and wrong-audience tokens are rejected by tests.

Exercises (assessment: token-validation exercise)

IDOutcomeTask
JNR-038-EX011Write the Set-Cookie header for a session cookie with all three secure attributes and explain each.
JNR-038-EX022Decode a given JWT by hand (Base64URL) and name header, claims, and signature.
JNR-038-EX032Explain why a JWT payload cannot hold a credit card number.
JNR-038-EX043List the checks a server must make on an incoming JWT.
JNR-038-EX053Given five tokens (bad signature, expired, wrong issuer, wrong audience, alg: none), say which are rejected and why.
JNR-038-EX064Compare sessions and tokens in a table covering revocation, scaling, and lifetime.
JNR-038-EX074Propose lifetimes for access and refresh tokens in Shop and justify them.
أظهر الحلول
  • EX01 Set-Cookie: SESSION=...; HttpOnly; Secure; SameSite=Lax. HttpOnly hides it from JavaScript; Secure sends it only over HTTPS; SameSite limits cross-site sending.
  • EX02 header.payload.signature; the first two parts decode to JSON; the signature is binary and cannot be read.
  • EX03 The payload is only encoded; anyone holding the token can read it.
  • EX04 Signature with the expected key, algorithm, issuer, audience, expiry (and not-before), then authorities.
  • EX05 All five are rejected, each failing one check: signature, exp, iss, aud, and unsigned token.
  • EX06 Sessions: server state, easy instant revocation, need shared store. Tokens: stateless, scale easily, revocation hard, rely on short expiry.
  • EX07 For example access 10 to 15 minutes, refresh a few days with rotation and server-side revocation; shorter access limits damage from theft.

الاختبار

Outcomes: O1 cookies and sessions · O2 JWT structure · O3 correct validation · O4 sessions vs tokens.

اختبار ذاتي لك: لا توجد درجات، ولا يُحفظ أو يُرسل أي شيء. اختر إجابة ثم تحقق منها، ويمكنك المحاولة مرة أخرى كما تشاء.

  1. 1HttpOnly on a cookie means:O1
  2. 2Secure on a cookie means:O1
  3. 3A session cookie normally holds:O1
  4. 4A JWT has how many dot-separated parts?O2
  5. 5The JWT payload is:O2
  6. 6Which claim names who the token is for?O3
  7. 7A token with alg: none should be:O3
  8. 8Which check is NOT required?O3
  9. 9Stateless tokens are hard to:O4
  10. 10To limit the damage of a stolen access token:O4

الجزء العملي

Seven exercises JNR-038-EX01 to EX07 plus the lab; the token-validation exercise (EX05) is the assessment. Pass: at least six exercises correct, EX05 fully correct, and the tampered, expired, and wrong-audience tests passing.

أخطاء شائعة

Secrets or personal data in JWT claims; accepting alg: none; tokens that never expire.

التقييم

Token-validation exercise.

الصلة بالمسار الوظيفي

OAuth 2.0 (JNR-039, MID-051).

اكتب للبحث في المستويات والمراحل والوحدات والدروس.