Уровень 0 · материалов: 4
В кластер входят документы, описывающие техническую реализацию, хранение и защиту токенов доступа и механизмов предотвращения атак на веб-сервисы.
Общие признаки: механизмы аутентификации на основе токенов, защита от атак на веб-сервисы, безопасное хранение токенов, уязвимости протоколов авторизации
Группа выше: Протоколы и реализация аутентификации
Смысл: The main idea is that for modern web applications, storing JWTs in httpOnly, Secure, and SameSite=Strict cookies is the most secure approach compared to Web Storage, provided it is complemented by server-side security headers and token rotation.
Use httpOnly, Secure, and SameSite=Strict cookies instead of Local Storage to store JWTs to protect against XSS and CSRF attacks.
Смысл: The main idea is to provide a practical implementation of an automated token-based authentication system in JavaScript that handles token storage and silent refreshing to ensure uninterrupted access to protected API resources.
A technical guide on creating an asynchronous JavaScript wrapper for the fetch API that automatically manages access token expiration and renewal using refresh tokens.
Смысл: The text explains the mechanism of Cross-Site Request Forgery (CSRF) attacks and provides a detailed technical guide on how to implement various token-based defense mechanisms to secure web services.
A comprehensive technical guide explaining CSRF attack mechanisms and detailing three token-based defense strategies: Synchronizer, Double Submit, and Encrypted tokens.
Смысл: The main idea is that while the OAuth2 protocol is theoretically secure, poor implementation by major providers (Facebook, VK) and clients (Habr) leads to critical vulnerabilities like account hijacking and token theft. The author emphasizes the necessity of strict validation of the 'state' and 'redirect_uri' parameters to ensure security.
A technical breakdown of OAuth2 security flaws in real-world implementations, demonstrating how improper validation leads to account hijacking.