Ishga tayyor · Web xavfsizligi va threat modeling
Daraja: Ilg'or
Auth, authorization, input, secret, browser va supply-chain xavflarini amaliy boshqarish.
Tushuntirish
## Ishdagi vazifa Feature yozishdan oldin kim nimaga kira olishi va ma’lumot qayerdan kirib qayerga chiqishini chizing. Authentication kimligini, authorization huquqini tekshiradi; UI tugmasini yashirish server tekshiruvining o‘rnini bosmaydi. Object ID kelgan har endpoint ownership yoki role-ni tekshiradi.
## Himoya qatlamlari Parol mos KDF bilan hash qilinadi, token va secret repo/logga tushmaydi. Cookie uchun HttpOnly, Secure va mos SameSite; state-changing cookie request uchun CSRF siyosati kerak. XSSga qarshi output encoding va CSP, injectionga qarshi parametrli query ishlatiladi. Dependency va container image muntazam skan qilinadi.
## Manba [OWASP Top 10:2025](https://owasp.org/Top10/)
Kod misoli
@PreAuthorize("hasRole('ADMIN') or @owner.check(#id, authentication)")
@DeleteMapping("/notes/{id}")
ResponseEntity<Void> delete(@PathVariable long id) { /* ... */ }Keng tarqalgan xatolar
- Admin tugmasi ko‘rinmasa endpoint himoyalangan deb hisoblash — requestni qo‘lda yuborish mumkin.
Mashqlar
- Order loyihasi uchun asset, actor, threat va mitigation jadvali tuzing.
- Boshqa user ID si bilan o‘qish/o‘chirishga qarshi authorization test yozing.
Teglar: ishga-tayyor, career-04, owasp, security