انتقل إلى المحتوى
أمين أبوزيد
Englishالعربية
JNR-040

التفويض المبني على الأدوار

  • 6 درس
  • 2.5 ساعة تدريب (تقدير)
ابدأ الوحدة
في هذه الصفحة 8 موضوعات

نص الدروس والتمارين باللغة الإنجليزية، بينما تبقى واجهة الموقع وعناوين الدروس بالعربية.

نظرة عامة

الموضوعات

  • RBAC
  • أمان الدوال (Method security)
  • فحوص الملكية

تعلّم أولًا

2.5 ساعة تدريب (تقدير)

مخرجات التعلم

  1. Model roles and authorities and apply RBAC at URL and method level (@PreAuthorize).
  2. Enforce ownership checks so users can access only their own resources.
  3. Explain insecure direct object references (IDOR) and test for them.
  4. Decide where authorization logic belongs (filter, method, domain query).

الدروس

  1. 01الأدوار والصلاحيات والأذونات
  2. 02أمان الدوال (Method security)
  3. 03فحوص الملكية (Ownership checks)
  4. 04IDOR: أكثر أخطاء الـ API شيوعًا
  5. 05عرض عملي: اكتشاف IDOR وإصلاحه
  6. 06عرض عملي: أمان الدوال مع فحوص الملكية

المختبر والتمارين

Lab

JNR-040-LAB1 · My orders only

Outcomes: 1–4 · Time: ~2.5 h Customers see only their own carts and orders; admins see all. Acceptance: a test where customer A requests customer B's order receives 404 (no existence leak).

Exercises (assessment: find IDOR bugs in a provided API)

IDOutcomeTask
JNR-040-EX011Define roles and authorities for Shop (customer, admin) and map five endpoints to them.
JNR-040-EX021Protect OrderService.listAll() with @PreAuthorize and say what else must be enabled.
JNR-040-EX032Rewrite findById(id) so it only returns the caller's order.
JNR-040-EX042A create-order request body contains customerId. Explain the risk and fix it.
JNR-040-EX053In a provided API, find three IDOR bugs (read, update, delete) and write the attack request for each.
JNR-040-EX063Write a MockMvc test where customer A requests customer B's order.
JNR-040-EX074For each rule, pick filter, method, or query: "must be logged in"; "only admins list all orders"; "only own orders".
أظهر الحلول
  • EX01 For example: GET /api/products public; POST /api/products ADMIN; GET /api/orders/{id} CUSTOMER with ownership; GET /api/orders ADMIN; POST /api/orders CUSTOMER.
  • EX02 @PreAuthorize("hasRole('ADMIN')") and @EnableMethodSecurity on a configuration class.
  • EX03 findByIdAndCustomerId(id, currentUserId); empty result leads to 404.
  • EX04 A customer could place orders as someone else; take the customer from the authenticated principal and delete the field from the request.
  • EX05 Change the ID in GET, PUT, and DELETE requests while logged in as another customer; each returns the other's data or modifies it.
  • EX06 Log in as A, request B's order id, status().isNotFound().
  • EX07 Must be logged in: filter (URL rule); only admins list all: method security; only own orders: domain query.

الاختبار

Outcomes: O1 roles and method security · O2 ownership checks · O3 IDOR · O4 where authorization belongs.

اختبار ذاتي لك: لا توجد درجات، ولا يُحفظ أو يُرسل أي شيء. اختر إجابة ثم تحقق منها، ويمكنك المحاولة مرة أخرى كما تشاء.

  1. 1In Spring, hasRole("ADMIN") matches the authority:O1
  2. 2@PreAuthorize needs:O1
  3. 3RBAC stands for:O1
  4. 4The current user's id should come from:O2
  5. 5For another customer's order, return:O2
  6. 6The preferred ownership check is:O2
  7. 7IDOR means:O3
  8. 8Using UUIDs instead of numbers:O3
  9. 9"Only admins may list all orders" is best placed in:O4
  10. 10"A customer sees only their own orders" is best placed in:O4

الجزء العملي

Seven exercises JNR-040-EX01 to EX07 plus the lab; finding IDOR bugs in the provided API (EX05) is the assessment. Pass: at least six exercises correct, all three IDOR bugs found, and the 404 test passing.

أخطاء شائعة

Checking roles but not ownership; trusting a customerId from the request body.

التقييم

Find IDOR bugs in a provided API.

الصلة بالمسار الوظيفي

Broken access control is the top OWASP risk; authorization design in MID-051.

اكتب للبحث في المستويات والمراحل والوحدات والدروس.