انتقل إلى المحتوى
أمين أبوزيد
Englishالعربية
MID-051

أمان API المتقدم

  • 5 درس
  • 2.5 ساعة تدريب (تقدير)
ابدأ الوحدة
في هذه الصفحة 8 موضوعات

نص الدروس والتمارين باللغة الإنجليزية، بينما تبقى واجهة الموقع وعناوين الدروس بالعربية.

نظرة عامة

الموضوعات

  • مسارات OAuth 2.0
  • OIDC
  • التحقق من الرموز
  • تصميم التفويض

تعلّم أولًا

2.5 ساعة تدريب (تقدير)

مخرجات التعلم

  1. Choose OAuth 2.0 flows for user-facing, machine-to-machine, and delegated scenarios.
  2. Validate tokens fully at every service, not only at the gateway.
  3. Design scopes and claims for fine-grained authorization, and propagate user identity between services.
  4. Apply token exchange or client credentials for service-to-service calls.

الدروس

  1. 01مراجعة مسارات OAuth
  2. 02التحقق من الرموز في كل مكان
  3. 03النطاقات (Scopes) والمطالبات (Claims) وتصميم التفويض
  4. 04هوية الخدمة إلى الخدمة
  5. 05عرض عملي: نشر الهوية من البوابة إلى المخزون

المختبر والتمارين

Lab

MID-051-LAB1 · Zero implicit trust

Outcomes: 1–4 · Time: ~2.5 h Every Shop service validates tokens; orders calls inventory with its own client credentials; scopes restrict admin operations. Acceptance: a direct call without a valid token fails at every service.

Exercises (assessment: authorization design review)

IDOutcomeTask
MID-051-EX011Choose a flow for each: web storefront, mobile app, nightly report job, support tool acting for a customer.
MID-051-EX022Configure a service as a resource server with issuer and audience validation.
MID-051-EX032Write tests: expired token, wrong audience, missing token, tampered signature.
MID-051-EX043Design scopes and roles for orders and inventory and fill in the endpoint matrix.
MID-051-EX053Add an ownership check and a negative test for reading another customer's order.
MID-051-EX064Configure orders to obtain a client-credentials token for inventory; limit its scopes.
MID-051-EX071–4Review a given design (gateway-only validation, header-based identity, shared service account) and list fixes.
أظهر الحلول
  • EX01 Storefront and mobile: authorization code with PKCE; nightly job: client credentials; support tool acting for the customer: token exchange (or a delegated, audited flow).
  • EX02 issuer-uri plus a JwtValidator checking aud; verify the exact Spring Security version API before recording.
  • EX03 Expect 401 for missing, expired, tampered, and wrong audience tokens.
  • EX04 Example: orders:read customer; orders:admin support role; inventory:write only for orders client and admin.
  • EX05 Compare the order's owner with the token subject; return 404 or 403 for others; test with two users.
  • EX06 Register an orders client with the inventory:read scope only; use a client-credentials WebClient filter.
  • EX07 Validate tokens in every service, take identity from the token, one client per service with minimal scopes.

الاختبار

Outcomes: O1 OAuth flows · O2 token validation · O3 scopes, claims, authorization design · O4 service-to-service identity.

اختبار ذاتي لك: لا توجد درجات، ولا يُحفظ أو يُرسل أي شيء. اختر إجابة ثم تحقق منها، ويمكنك المحاولة مرة أخرى كما تشاء.

  1. 1A user-facing SPA should use:O1
  2. 2A nightly job with no user should use:O1
  3. 3Validating tokens only at the gateway is risky because:O2
  4. 4The audience claim ensures:O2
  5. 5An X-User-Id header set by the gateway:O2
  6. 6Scopes describe:O3
  7. 7The check that stops one customer reading another's order is:O3
  8. 8Admin operations should:O3
  9. 9orders calls inventory with:O4
  10. 10Token exchange is used to:O4

الجزء العملي

Seven exercises MID-051-EX01 to EX07 (EX07 is the authorization design review) plus the zero-implicit-trust lab. Pass: at least five exercises including EX07, and a lab where a direct call without a valid token fails at every service.

أخطاء شائعة

Trusting a header set by the gateway; one all-powerful service account.

التقييم

Authorization design review.

الصلة بالمسار الوظيفي

Zero-trust security architecture (SRB-016).

اكتب للبحث في المستويات والمراحل والوحدات والدروس.