الإعدادات الآمنة
في هذه الصفحة 8 موضوعات
نص الدروس والتمارين باللغة الإنجليزية، بينما تبقى واجهة الموقع وعناوين الدروس بالعربية.
نظرة عامة
الموضوعات
- أساسيات إدارة الأسرار
- HTTPS
- تحديث الاعتماديات
- التسجيل الآمن
تعلّم أولًا
2 ساعة تدريب (تقدير)
مخرجات التعلم
- Supply secrets through environment variables or a secret store, never source control.
- Enforce HTTPS-only behavior (redirects, HSTS) and secure headers.
- Restrict Actuator endpoints in production.
- Scan dependencies for known vulnerabilities and keep them updated (Dependabot or OWASP Dependency-Check).
- Audit logs for sensitive data.
الدروس
المختبر والتمارين
Lab
JNR-042-LAB1 · Production hardening
Outcomes: 1–5 · Time: ~2 h Create a prod profile with secrets from the environment, restricted Actuator, security headers, and dependency scanning in the build. Acceptance: completes the capstone's security controls document.
Exercises (assessment: hardening checklist review)
| ID | Outcome | Task |
|---|---|---|
| JNR-042-EX01 | 1 | Move a hard-coded database password and JWT key out of application.yml into environment variables. |
| JNR-042-EX02 | 1 | A secret was committed. List the steps to respond. |
| JNR-042-EX03 | 2 | Check response headers with curl and list which security headers are present or missing. |
| JNR-042-EX04 | 2 | Explain HSTS and when it is safe to enable. |
| JNR-042-EX05 | 3 | Configure Actuator so only health and info are exposed and verify /actuator/env returns 404. |
| JNR-042-EX06 | 4 | Add a dependency scanner to the build and triage one finding. |
| JNR-042-EX07 | 5 | Audit sample logs and list every sensitive item found, with the fix. |
| JNR-042-EX08 | 1-5 | Review a prod configuration against a hardening checklist. |
أظهر الحلول
- EX01
password: ${DB_PASSWORD}andjwt.key: ${JWT_SIGNING_KEY}; set values in the environment or secret store; keep a sample file with placeholders only. - EX02 Rotate the secret first, then remove it from the code; consider history cleanup; check access logs for misuse; add a secret scanner.
- EX03
curl -I https://...; checkX-Content-Type-Options,Strict-Transport-Security,Content-Security-Policy, cache and referrer headers; add what is missing. - EX04 HSTS makes browsers use HTTPS only for a period; enable once HTTPS works for the whole domain, starting with a short
max-age. - EX05
management.endpoints.web.exposure.include=health,info;curl /actuator/envreturns 404 (or 401 when protected). - EX06 Add the scanner plugin or Dependabot; for a finding, update the library, or record the reason and a review date.
- EX07 Typical findings: password in a request body log,
Authorizationheader, personal data in debug lines; remove, mask, or lower the log level. - EX08 Cover secrets, HTTPS/headers, Actuator, dependencies, and logging, giving a pass or fix note for each.
الاختبار
Outcomes: O1 secrets · O2 HTTPS and headers · O3 Actuator · O4 dependency scanning · O5 secure logging.
اختبار ذاتي لك: لا توجد درجات، ولا يُحفظ أو يُرسل أي شيء. اختر إجابة ثم تحقق منها، ويمكنك المحاولة مرة أخرى كما تشاء.
الجزء العملي
Eight exercises JNR-042-EX01 to EX08 plus the lab; the hardening checklist review (EX08) is the assessment. Pass: at least seven exercises correct, /actuator/env not reachable, and no secrets in code or logs.
أخطاء شائعة
Exposing /actuator/env; ignoring scanner warnings forever.
التقييم
Hardening checklist review.
الصلة بالمسار الوظيفي
Dependency security (MID-053) and secrets (MID-054).