Introduction: Security, Authentication, and Authorization

웹(앱)의 보안, 인증, 권한부여에 관한 기본 개념을 정리하였습니다.

 

 

---

< Introduction to Web Security >

Documentation : Web application security : What is Application Security?

애플리케이션 보안 - 위키백과, 우리 모두의 백과사전

Application security refers to the entire lifecycle process of code, such as flaws in the security policy of application software or invisible weaknesses in system development.

 

 

Documentation : MDN - Website Security : What is Web Security?

Website security - Web 개발 학습하기 | MDN

- Effective website security requires effort throughout the design process.

- The single most important lesson about website security is to never trust data from the browser

• Typical security threats :
  1. Cross-Site Scripting(XSS)
  2. SQL Injection
  3. Cross Site Request Forgery (CSRF)

 

 

Article : The Basics of Web Application Security : Basics of Web Application Security

The Basics of Web Application Security

< In Summary : >

• Authorization must always be checked on the server. Hiding user interface components is fine for user experience, but not an adequate security measure
• Deny by default. Positive validation is safer and less error prone than negative validation
• Code should authorize against specific resources such as files, profiles, or REST endpoints
• Authorization is domain specific, but there are some common patterns to consider when designing your permission model. Stick to common patterns and frameworks unless you have a very compelling reason not to
• Use RBAC for basic cases and keep permissions and roles decoupled to allow your policies to evolve
• For more complicated scenarios, consider ABAC, and use XACML or policies coded in the application's language

 

 

---

< Introduction to Authentication/Authorization >

Documentation : OAuth - Authentication and Authorization Flows : Authentication and Authorization

Auth0

< Authentication vs Authorization >

- authentication is the process of verifying who someone is

- whereas authorization is the process of verifying what specific applications, files, and data a user has access to

 

 

Documentation : MDN - HTTP authentication : HTTP authentication

 

HTTP authentication - HTTP | MDN

HTTP provides a general framework for access control and authentication. This page is an introduction to the HTTP framework for authentication, and shows how to restrict access to your server using the HTTP "Basic" schema.

 

 

 

Article : Basic Authentication Tutorial : Basic Authentication Tutorial with Example API

NodeJS - Basic Authentication Tutorial with Example API | Jason Watmore's Blog

In this tutorial, you will learn how to implement Basic HTTP authentication in a Node API and how to use it within a React, Angular, Vue.js, or Blazor application.