Ukukhetha ubufakazi be-HTTP: amarekhodi egesi noma amalogi ohlelo

Ukuqapha iwebhu kuqala ngenhloso, hhayi ngendawo yokuthwebula. Ukubala amaklayenti asebenzayo, ukulinganisa isikhathi socingo lwe-API nokufunda imizimba yemiyalezo ngakunye kudinga ubufakazi obuhlukile nezinqumo zobumfihlo ezihlukile. Igesi elidlulisela i-HTTPS evikelwe libona ukuxhumana hhayi okuqukethwe kwekhasi. Ukukhetha ungqimba olungalungile kuveza idatha ebukeka inothile futhi engaphenduli lutho.

Qamba umbuzo ngaphambi komthombo wedatha

Qala ngesinqumo sokusebenza okufanele idatha isisekele. Imibuzo yokutholakala idinga izibalo nezikhathi, imibuzo yezicelo idinga izindlela namakhodi wesimo, futhi imibuzo yokuqukethwe idinga imizimba yemiyalezo. Isinyathelo ngasinye sokungena sidweba ubuzwelo nobunkimbinkimbi bobunjiniyela. Cela umnikazi wensizakalo nomnikazi wokuphepha bagunyaze izethameli, inhloso nokuphathwa ngaphambi kokuqala ukuqoqa, ngoba ukuqondisa ithumbu akusona leso sinqumo.

Bhala umbuzo emushweni owodwa futhi uwugcine eduze kohlelo lokuqoqa. Iwukuphela kokulawula okwethembekile kobubanzi.

Igesi elingakubonisa nokungakubonisi

Igesi elidlulisela i-HTTPS evikelwe ngendlela efanele ngokuvamile libona amakheli, izimbobo nomthamo, hhayi imigqa yezicelo noma umzimba.

conntrack -L -d 203.0.113.10 | head
tcpdump -ni vpn0 -c 20 'tcp port 443'

Uhlu lwe-conntrack lukhombisa ukuhamba nokuhumusha, futhi ukuthwebula okufushane kukhombisa amaphakethe ngaphandle kokuqukethwe kohlelo okufundekayo. Lokho kwanele ukuphendula ukuthi ithrafikhi iyahamba yini, ingakanani, naphakathi kwaziphi iziphetho. Lona akulona uhlu lwama-URL, futhi i-proxy ye-CONNECT evamile idlulisela ukuhwebelana okubethelwe ngaphandle kokuqeda i-TLS yohlelo. Uma othile ethembisa izindlela zezicelo kusukela kuleso sikhundla, buza ukuthi yiluphi uphawu olubethelayo nangaphansi kokwethenjwa kabani.

Amalogi ohlelo aphendula imibuzo eminingi yezicelo

Ohlelweni olusebenzisayo, ukuloga kwalo okusekelwayo ngokuvamile kuphendula umbuzo wezinga lesicelo ngaphandle kokubethela ukuxhumana kwabanye.

curl -sS -o /dev/null -w "%{http_code} %{time_total}\n" https://app.example.com/health
tail -n 5 /var/log/nginx/access.log

Isicelo sempilo silinganisa ukutholakala kusukela esikhundleni sekhayenti, futhi ilogi yokufinyelela ibhala izinkambu iseva esezikhethe ukuzigcina. Khetha izinkambu ezidingwa umsebenzi futhi ushiye ezinye ngaphandle, ngoba ngisho i-URL ingathwala amapharamitha abonakalayo. Umugqa welogi uwubufakazi mayelana naleyo nsizakalo, hhayi mayelana nayo yonke enye insizakalo umsebenzisi ayifinyelele ngethumbu. Ukugcina ukuqoqwa kuncane kugcina nomubuzo wokugcinwa mncane, ngakho setha iwindi elifushane kunokuhlolwa komcabango okwakhiqiza isidingo.

Ukungena phakathi kuwumklamo wokwethenjwa ohlukile

Uma ukuhlolwa kwezinga lomlayezo kudingeka ngempela, ukungena phakathi kwe-TLS kwakha iphuzu elisha elithembekile lokuphela kanye nelungiselelo lokwethenjwa kwekhayenti okufanele lisatshalaliswe futhi ligcinwe. Izinhlelo ezibophela izitifiketi ziyophuka, futhi umqhubi manje uphethe okhiye abayimfihlo okubaluleka kokuvikelwa kwabo kulingana nanoma yimuphi ukhiye wesiva. Ukwenza ukuqoqwa kusebenze ngokwenza buthakathaka ukuqinisekiswa kwezitifiketi, noma ngokulungisa uhlelo olubophela izitifiketi zalo, kushintshanisa ukulawula kokuphepha ngomugqa welogi. Khetha umklamo wokuhlola obhalisiwe okusatshalaliswa kwawo ukwethenjwa osekuphathwa, futhi gcina ukhiye oyimfihlo wegunya ngaphandle kwanoma yini eyabiwe.

Ekupheleni kwewindi lokuqoqa, susa ukucushwa kanye nezinto zako zokwethenjwa ngobanikazi bazo, futhi ulahle ubufakazi obugciniwe ngokwenqubomgomo ekuvunyelwene ngayo. Ulwazi oluthembekile olwanele ngenhloso eshiwo yiyona ndlela yokuphumelela, hhayi ukuthwebula okukhulu kakhulu okungenzeka.