I-OAuth ngaphakathi kwe-VPN: iziphi izigaba ezisadinga i-TLS

Umzila wangasese unquma ukuthi ubani ofinyelela kuseva; imithetho yokuthutha ye-OAuth inquma ukuthi umlayezo ngamunye uhamba kanjani. Isiphequluli, iseva yokugunyazwa, indawo yokugcina ithokheni kanye neseva yezinsiza kungaba ngemuva kwe-VPN eyodwa futhi zisahwebhana ngemilayezo ngezigaba ezahlukene. Isigaba ngasinye sinesidingo saso sokuthutha, futhi i-VPN ayikhululi kukho lokho. Umngcele we-VPN nomngcele wephrothokholi yimigqa ehlukene.

Isinqumo siba lula uma uyeka ukubuza ukuthi inethiwekhi ithembekile yini bese uqala ukubuza ukuthi ukushintshana kuphi kunqamula umngcele upi.

Nquma ngesigaba, hhayi ngenethiwekhi

Bhala izindawo zokugcina ngokwahlukana: indawo yokugunyazwa, indawo yethokheni, i-URI yokuqondisa kabusha, i-URL yeseva yezinsiza, indawo yokuphela kwe-TLS kanye nesango le-VPN. Bese umaka ukuthi iyiphi inhlangano eqala isicelo ngasinye nokuthi impendulo iyaphi.

I-VPN ephela esangweni ishubisa ingxenye eya kuleso sango. Isicelo singaqhubeka njenge-HTTP evamile ngemuva kwaso, futhi leyo ngxenye esele ayiphendukanga ibe yi-HTTPS ngenxa yokuthi ingxenye yangaphambili yashubiswa. Yilokho kuqhubeka okuyisigaba i-phrothokholi ekhathazayo. Ukushubisa ingxenye yokuqala akukwenzi ingxenye yesibili iphephe.

Ukuthutha kuhamba nokuhlolwa kobuwena besevisi. Isiphequluli siqinisekisa isitifiketi se-URL yohlelo; i-VPN ayikwenzi lokho kuqinisekisa egameni lesiphequluli, futhi ayikwenzi indawo engaqinisekisiwe ibe yamukelekayo. Isitifiketi sisho indawo iklayenti elicabanga ukuthi iyayishaya ucingo. Umshini wangaphansi oya esangweni awushintshi leyo ndawo futhi awuyiqinisekisi.

Impendulo yokugunyazwa kanye ne-URI yokuqondisa kabusha

Inqubo enhle kakhulu yezokuphepha ye-OAuth yamanje iyakwenqabela ukudlulisa izimpendulo zokugunyazwa ngezixhumo ezingashubisiwe. Lokho kuhlanganisa nokuqondisa kabusha okuthwala ikhodi yokugunyazwa noma amathokheni abuyela kuklayenti, hhayi isicelo sokuqala kuphela.

Ukweluleka okufanayo akuvumeli ama-URI okuqondisa kabusha e-HTTP ngaphandle kwecala elishiwo le-loopback yeklayenti lomdabu. Igama lomsingathi wangaphakathi alidali icala elisha, futhi igama le-DNS elixazululwa ngaphakathi kwe-VPN kuphela liseyi-URL ye-HTTP uma isikimu sisho kanjalo. Hlola isikimu ku-URI ebhalisiwe, hhayi igama lomsingathi kuphela.

Bhalisa i-URI yokuqondisa kabusha ye-HTTPS enembile kuseva yokugunyazwa futhi ugcine ukuqinisekiswa kwesitifiketi kuvuliwe kuklayenti. Indlela emfishane yokuthuthukisa evala isidingo se-HTTPS ikhiqiza ukugeleza okuziphatha ngendlela ehlukile kunokucushwa kokukhiqiza okufanele ikulingise.

Indawo yethokheni kanye nezicelo ze-bearer-token

Isicelo sethokheni sithwala ubufakazi noma ikhodi engashintshwa ngokufinyelela. Ukusithumela ngesigaba esingavikelwe kuveza into iseva yezinsiza eyozethemba kamuva, ngisho noma inethiwekhi ezungezile iyimfihlo. I-proxy ekwazi ukufunda isicelo nayo ingafunda ubufakazi obuthwelwayo.

Ezimcelweni zezinsiza ze-bearer-token, i-RFC 6750 ithatha i-TLS njengento ephoqelekile ukuyisebenzisa nokuyisebenzisa kuleyo ncazelo. Ukuthi isethi engaphansi yasehhovisi ithembekile akusona isimo esihlukile se-phrothokholi esivamile esidingwa ukuthunyelwa kwe-bearer ngombhalo ocacile.

Sebenzisa ama-URL ezindawo eziphephile abhaliwe kuzo zombili izigaba. Uma ilabhulali inqaba ukushaya indawo yethokheni ye-HTTP, lokho kunqaba ukusebenza kwencazelo, hhayi iphutha lokucushwa okufanele kweqiwe. Bhala leyo URL ekucushweni kweklayenti esikhundleni sokuyithola ngesikhathi sokusebenza.

I-TLS iphela kuphi futhi kusala ini

Uma i-TLS iphela kungaphambili okugunyaziwe, shono leyo ngaphambili bese uhlola indlela esuka kuyo iya kuhlelo. Ingaphambili iba nesibopho sokudlulisela, ukuthembela kanye nobumfihlo engxenyeni esele, futhi ukwakheka okusekelwayo kwesevisi kufanele kuchaze lelo lungiselelo.

I-VPN kwenye indawo emzileni ayizixazululi lezo zibopho. Futhi ayikutsheli ukuthi i-URL yohlelo isiphequluli esiyibonayo iyahambisana yini nesitifiketi esethulwa ingaphambili.

Ekuthunyelweni kwangaphakathi, bhala indawo yokuphela kanye nobuwena obuthulwayo. Ingaphambili ephelisa i-TLS ngesitifiketi segama elihlukile idala isexwayiso sesiphequluli esivame ukucindezelwa abasebenzi esikhundleni sokulungiswa.

Icala le-loopback lomdabu lincane

Icala lokuqondisa kabusha kwe-loopback liphathelene nokubizwa emuva kudivayisi yomsebenzisi uqobo, lapho iklayenti nesiphequluli babelana ngaleyo divayisi. Lelo lungiselelo lingelokubizwa emuva kudivayisi eyodwa, futhi alikunikezi ilungelo lokuletha iseva yokugunyazwa evamile noma i-API ethwala ithokheni nge-HTTP esethini engaphansi yasehhovisi.

Gcina icala lingaphakathi kohlobo lweklayenti nokubizwa emuva okulichazayo. Ukulisebenzisa kuhlelo lwewebhu, isevisi yangaphakathi eyabiwe noma i-URI yokuqondisa kabusha kwenye indawo kushintsha ukuthunyelwa, hhayi icala.

Hlola ukugeleza kwangempela kumngcele ngamunye bese ukuqhathanisa nohlobo lweklayenti. Ukuqondisa kabusha okusebenzayo akusho lutho ngokuthi zonke izigaba ezithwala ithokheni zisebenzisa ukuvikelwa okudingekayo, futhi isithonjana se-VPN esiluhlaza akusho lutho ngesikimu sesicelo esilandelayo.