Ubungozi obuphezulu be-API OATH
Ubungozi obuphezulu be-API OATH: Isingeniso
Uma kukhulunywa ngezenzo, ama-API ayindawo enkulu kakhulu ongaqala ngayo. API ukufinyelela ngokuvamile kuqukethe izingxenye ezintathu. Amaklayenti anikezwa amathokheni Iseva Yokugunyazwa, esebenza ngokuhambisana nama-API. I-API ithola amathokheni okufinyelela kuklayenti futhi isebenzisa imithetho yokugunyazwa eqondene nesizinda esisuselwe kuyo.
Izinhlelo zokusebenza zesofthiwe yesimanje zisengozini ezinhlobonhlobo zezingozi. Gcina unolwazi mayelana nezenzo zakamuva kanye namaphutha okuphepha; ukuba namabhentshimakhi alobu bungozi kubalulekile ukuze kuqinisekiswe ukuphepha kohlelo lokusebenza ngaphambi kokuhlaselwa. Izinhlelo zokusebenza zezinkampani zangaphandle ziya ngokuya zincika kuphrothokholi ye-OAuth. Abasebenzisi bazoba nolwazi olungcono kakhulu lomsebenzisi, kanye nokungena ngokushesha nokugunyazwa, ngenxa yalobu buchwepheshe. Ingase ivikeleke kakhulu kunokugunyazwa okuvamile njengoba abasebenzisi akudingeki badalule izifakazelo zabo ngohlelo lokusebenza lwenkampani yangaphandle ukuze bafinyelele insiza ethile. Nakuba iphrothokholi ngokwayo iphephile futhi ivikelekile, indlela esetshenziswa ngayo ingase ikushiye uvulekele ukuhlasela.
Lapho udizayina futhi usongatha ama-API, lesi sihloko sigxila ekubeni sengozini evamile ye-OAuth, kanye nokunciphisa ukuphepha okuhlukahlukene.
Ukugunyazwa Kweleveli Yento Ephukile
Kukhona indawo enkulu yokuhlasela uma ukugunyazwa kwephulwa njengoba ama-API enikeza ukufinyelela ezintweni. Njengoba izinto ezifinyeleleka ku-API kufanele zigunyazwe, lokhu kuyadingeka. Sebenzisa ukuhlola kokugunyazwa kwezinga lezinto usebenzisa isango le-API. Yilabo abanezimvume ezifanele kuphela okufanele bavunyelwe ukufinyelela kuzo.
Ukuqinisekiswa Komsebenzisi Okuphukile
Amathokheni angagunyaziwe angenye indlela evamile yokuba abahlaseli bathole ukufinyelela kuma-API. Amasistimu okufakazela ubuqiniso angase agqekezwe, noma ukhiye we-API uvezwe ngephutha. Amathokheni okuqinisekisa angaba esetshenziswa ngabaduni ukuthola ukufinyelela. Qinisekisa abantu kuphela uma bengathenjelwa, futhi usebenzise amaphasiwedi aqinile. Nge-OAuth, ungakwazi ukweqa izikhiye ze-API futhi uthole ukufinyelela kudatha yakho. Kufanele uhlale ucabanga ukuthi uzongena futhi uphume kanjani endaweni. I-OAuth MTLS Sender Constrained Tokens ingase isetshenziswe ngokubambisana ne-Mutual TLS ukuze kuqinisekiswe ukuthi amakhasimende awaphathi kabi futhi adlulisele amathokheni eqenjini elingalungile kuyilapho efinyelela kweminye imishini.
I-API Promotion:
Ukuchayeka Kwedatha Okudlulele
Ayikho imingcele enanini lamaphoyinti okugcina angase ashicilelwe. Isikhathi esiningi, akuzona zonke izici ezitholakala kubo bonke abasebenzisi. Ngokudalula idatha eningi kunalokho edingekayo, ubeka wena nabanye engozini. Gwema ukudalula ukuzwela Imininingwane kuze kube kudingekile ngempela. Onjiniyela bangacacisa ukuthi ubani onokufinyelela kulokho ngokusebenzisa i-OAuth Scopes kanye Nezimangalo. Izimangalo zingacacisa ukuthi yiziphi izigaba zedatha umsebenzisi angakwazi ukufinyelela kuzo. Ukulawula ukufinyelela kungenziwa kube lula futhi kube lula ukuphatha ngokusebenzisa isakhiwo esijwayelekile kuwo wonke ama-API.
Ukushoda Kwezinsiza kanye Nomkhawulo Wesilinganiso
Izigqoko ezimnyama zivamise ukusebenzisa ukuhlasela kwe-denial-of-service (DoS) njengendlela enonya yokweqa iseva futhi ngaleyo ndlela yehlise isikhathi sayo esiphezulu sibe iqanda. Ngaphandle kwemikhawulo kuzinsiza ezingase zibizwe, i-API isengozini yokuhlaselwa okuthena amandla. 'Usebenzisa isango le-API noma ithuluzi lokuphatha, ungasetha imikhawulo yesilinganiso sama-API. Ukuhlunga nokubhala amagama kufanele kufakwe, kanye nezimpendulo zibe nomkhawulo.
Ukungalungiseki kahle Kwesistimu Yokuphepha
Imihlahlandlela ehlukene yokucushwa kwezokuphepha ihlanganisa kahle, ngenxa yamathuba abalulekile wokungalungiselelwa kahle kwezokuvikela. Izinto ezimbalwa ezincane zingabeka engcupheni ukuphepha kwenkundla yakho. Kungenzeka ukuthi izigqoko ezimnyama ezinezinjongo zangaphandle zingathola ulwazi olubucayi oluthunyelwe ukuphendula imibuzo engalungile, njengesibonelo.
Isabelo seMisa
Ukuthi indawo yokugcina ayichazwanga esidlangalaleni akusho ukuthi ayikwazi ukufinyelelwa onjiniyela. I-API eyimfihlo ingase ibanjwe kalula futhi ibunjwe izigebengu. Bheka lesi sibonelo esiyisisekelo, esisebenzisa i-Bearer Token evulekile ku-API "yangasese". Ngakolunye uhlangothi, imibhalo yasesidlangalaleni ingase ibe khona yokuthile okwenzelwe ukusetshenziswa komuntu siqu kuphela. Ulwazi oluveziwe lungasetshenziswa izigqoko ezimnyama ukuze zingagcini nje ngokufunda kodwa futhi zisebenzise izici zento. Zibone njengomduni we-inthanethi njengoba useshela amaphuzu angaba buthaka ezivikelweni zakho. Vumela kuphela labo abanamalungelo afanele ukufinyelela kulokho okubuyisiwe. Ukuze unciphise ukuba sengozini, khawulela iphakheji yokusabela ye-API. Abaphendulayo akufanele bengeze noma yiziphi izixhumanisi ezingadingeki ngokuphelele.
I-API Ephromothiwe:
Ukuphathwa Kwempahla okungafanele
Ngaphandle kokuthuthukisa ukukhiqiza konjiniyela, izinguqulo zamanje kanye nemibhalo kubalulekile ukuze uphephe. Lungiselela ukwethulwa kwezinguqulo ezintsha kanye nokuhoxiswa kwama-API amadala kusenesikhathi. Sebenzisa ama-API amasha esikhundleni sokuvumela amadala ukuthi aqhubeke esetshenziswa. Ukucaciswa kwe-API kungasetshenziswa njengomthombo oyinhloko weqiniso wokwenza imibhalo.
Injection
Ama-API asengozini yokujovwa, kodwa kunjalo nezinhlelo zokusebenza zonjiniyela wezinkampani zangaphandle. Ikhodi enobungozi ingasetshenziswa ukususa idatha noma ukweba imininingwane eyimfihlo, njengamaphasiwedi nezinombolo zekhadi lesikweletu. Isifundo esibaluleke kakhulu okufanele usithathe kulokhu ukunganciki kuzilungiselelo ezizenzakalelayo. Abaphathi bakho noma abahlinzeki besango kufanele bakwazi ukuhlangabezana nezidingo zakho ezihlukile zohlelo lokusebenza. Imilayezo yephutha akufanele ifake ulwazi olubucayi. Ukuze uvimbele idatha kamazisi ukuthi ingavuzi ngaphandle kwesistimu, ama-Pairwise Pseudonyms kufanele asetshenziswe kumathokheni. Lokhu kuqinisekisa ukuthi alikho iklayenti elingasebenza ndawonye ukuze likhombe umsebenzisi.
Ukungena Nokugada Okungenele
Uma kwenzeka ukuhlasela, amaqembu adinga isu lokusabela elicatshangelwe kahle. Onjiniyela bazoqhubeka nokuxhaphaza ubungozi ngaphandle kokubanjwa uma uhlelo oluthembekile lokugawula nokuqapha lungekho, oluzokhulisa ukulahlekelwa futhi kulimaze umbono womphakathi ngenkampani. Sebenzisa isu eliqinile lokuqapha le-API kanye ne-endpoint yokukhiqiza. Abahloli bezigqoko ezimhlophe abathola ubungozi kusenesikhathi kufanele baklonyeliswe ngesikimu semali enhle. Umzila welogi ungase uthuthukiswe ngokufaka ubunikazi bomsebenzisi emisebenzini ye-API. Qinisekisa ukuthi zonke izendlalelo zokwakheka kwe-API yakho zihlolwa kusetshenziswa idatha ye-Access Token.
Isiphetho
Abaklami bengxenyekazi bangase bahlomise amasistimu abo ukuze bagcine isinyathelo esisodwa ngaphambi kwabahlaseli ngokulandela imibandela emisiwe yokuba sengozini. Ngenxa yokuthi ama-API angase anikeze ukufinyeleleka Kolwazi Oluhlonza Umuntu (PII), ukugcina ukuvikeleka kwamasevisi anjalo kubalulekile kukho kokubili ukuzinza kwenkampani nokuhambisana nomthetho ofana ne-GDPR. Ungalokothi uthumele amathokheni e-OAuth ngokuqondile nge-API ngaphandle kokusebenzisa i-API Gateway kanye ne-Phantom Token Approach.
I-API Ephromothiwe:
