Authentication & JWTBeginner
JWTは誰でも復号（デコード）して中身を見ることができますか？
はい。一般的なJSON Web Token（JWS）は「署名」されているだけで「暗号化」されていません。ヘッダーとペイロードは単にBase64URLでエンコードされた文字列であり、秘密鍵がなくても誰でも平文として閲覧可能です。
#JWT #Security #Encoding
Read Full Answer→Knowledge Base • 20 Questions AnsweredDirect • Verified • RFC-Standard
技術Q&Aナレッジベース
無駄な前置きを省き、ソフトウェア工学の疑問に直球で回答する権威ある技術Q&A集。
Showing 20 of 20 questions
Authentication & JWTIntermediate
なぜJWTをLocalStorageに保存してはいけないのですか？
認証JWTをlocalStorageに保存すると、ページ上に存在するクロスサイトスクリプティング（XSS）脆弱性によってトークンが即座に外部へ持ち出される危険があるためです。HttpOnly、Secure、SameSite属性付きCookieを使用することで、JavaScriptからのアクセスを完全に遮断できます。
#JWT #LocalStorage #XSS
Read Full Answer→Authentication & JWTIntermediate
Can an Expired JWT Token Still Be Verified?
Yes, the cryptographic signature of an expired JWT remains mathematically valid because signatures are computed solely over the header and payload data. However, compliant JWT libraries will reject the token during authentication because the expiration claim (`exp`) is explicitly checked after signature verification.
#JWT #Verification #exp
Read Full Answer→Authentication & JWTBeginner
What Is the Difference Between Authentication and Authorization?
Authentication (AuthN) verifies who a user is (identity confirmation), while Authorization (AuthZ) determines what permissions or resources that authenticated user is allowed to access.
#Authentication #Authorization #Identity
Read Full Answer→Web Security & CORS/CSPIntermediate
Why Does CORS Allow GET Requests Without a Preflight Check?
CORS allows standard GET requests without a preflight check for backward compatibility with the legacy web. Because HTML tags like `<form>`, `<img>`, and `<script>` have always been able to issue cross-origin GET requests without pre-approval, requiring preflights for all GETs would have broken decades of existing web architecture.
#CORS #HTTP #Preflight
Read Full Answer→Web Security & CORS/CSPIntermediate
なぜブラウザはCORSでプリフライト（OPTIONS）リクエストを送信するのですか？
ブラウザは、カスタムヘッダー（Authorizationなど）やapplication/jsonを含む非単純リクエスト（Non-Simple Request）を送信する前に、サーバー側がそのメソッドやヘッダーを安全に受け入れられるかを確認するためにOPTIONSプリフライトを送信します。
#CORS #HTTP #OPTIONS
Read Full Answer→Web Security & CORS/CSPAdvanced
Why Does CSP 'unsafe-inline' Defeat XSS Protection?
Using 'unsafe-inline' in a Content Security Policy defeats XSS protection because it instructs the browser to execute any inline script found in the HTML. Since Cross-Site Scripting works by injecting malicious inline script tags or event handlers, 'unsafe-inline' allows the attacker's payload to run freely.
#CSP #XSS #Web Security
Read Full Answer→HTTP & Web ArchitectureBeginner
What Is the Difference Between HTTP 401 Unauthorized and 403 Forbidden?
HTTP 401 Unauthorized means the user is not authenticated (identity unknown; credentials missing or invalid), whereas HTTP 403 Forbidden means the user is authenticated (identity known), but lacks the necessary permissions to access the requested resource.
#HTTP #Status Codes #401
Read Full Answer→HTTP & Web ArchitectureBeginner
Does HTTPS Encrypt the URL Path and Query Parameters?
Yes, HTTPS encrypts the entire HTTP request—including the URL path, query parameters, request headers, cookies, and message body. Only the destination hostname (domain name) and port number are visible on the wire via the TLS Server Name Indication (SNI) extension.
#HTTPS #TLS #Privacy
Read Full Answer→HTTP & Web ArchitectureIntermediate
How Does HTTP/2 Multiplex Multiple Requests Over a Single TCP Connection?
HTTP/2 multiplexes requests by splitting HTTP messages into independent binary frames tagged with a unique Stream ID. These frames are interleaved concurrently over a single shared TCP socket, eliminating the head-of-line blocking problem of HTTP/1.1.
#HTTP/2 #Networking #Multiplexing
Read Full Answer→HTTP & Web ArchitectureIntermediate
What Is the Difference Between ETag and Last-Modified Headers?
Last-Modified is a timestamp-based cache validator with 1-second resolution, while ETag is an arbitrary content-based fingerprint (such as a hash) that accurately detects byte-level changes even when modifications occur multiple times in the same second or across distributed server clusters.
#HTTP #Caching #ETag
Read Full Answer→HTTP & Web ArchitectureIntermediate
Why Is HTTP POST Not Idempotent While PUT Is?
An HTTP method is idempotent if executing it multiple times produces the exact same server state as executing it once. PUT is idempotent because repeating a PUT replaces the target resource at a known URI, whereas repeating a POST creates additional new subordinate resources or appends duplicate records each time.
#HTTP #REST #Idempotency
Read Full Answer→Networking & DNSBeginner
What Exactly Happens When a DNS Record TTL Expires?
When a DNS record's Time-To-Live (TTL) expires, the recursive resolver purges or invalidates the cached record from its local memory. The next time a client queries that domain name, the resolver must issue a new query over the network to the authoritative nameserver to obtain fresh data.
#DNS #TTL #Caching
Read Full Answer→Networking & DNSBeginner
Can a CNAME Record Point Directly to an IP Address?
No, a CNAME (Canonical Name) record cannot point to an IP address. RFC 1034 strictly mandates that a CNAME record must point exclusively to another fully qualified domain name (FQDN). To point a hostname directly to an IP address, you must use an A record (for IPv4) or an AAAA record (for IPv6).
#DNS #CNAME #IP Address
Read Full Answer→Networking & DNSIntermediate
Why Can't a CNAME Record Coexist With Other Records at the Zone Apex?
A CNAME cannot exist at the zone apex (@ or example.com) because RFC 1034 mandates that if a CNAME exists at a node, no other record types may exist at that node. Because every zone apex is required to have SOA and NS records, an apex CNAME creates an irreconcilable protocol violation.
#DNS #CNAME #Apex
Read Full Answer→Cryptography & HashingIntermediate
Why Does Changing One Character in an Input Completely Change the SHA-256 Hash?
Changing a single character (or even a single bit) changes approximately 50% of the output SHA-256 hash digest because of the cryptographic Avalanche Effect. Secure hash algorithms use iterative rounds of bitwise rotations, non-linear boolean operations, and modular addition to diffuse input bits across the entire internal state.
#SHA-256 #Avalanche Effect #Cryptography
Read Full Answer→Cryptography & HashingIntermediate
Why Is MD5 Considered Cryptographically Broken and Insecure?
MD5 is considered cryptographically broken because practical collision attacks exist that allow attackers to generate two completely different files with the exact same MD5 hash in a fraction of a second. Consequently, MD5 cannot be trusted for digital signatures, certificates, or file integrity verification.
#MD5 #Collision Attack #Cryptography
Read Full Answer→Cryptography & HashingAdvanced
Can AES-GCM Plaintext Be Recovered If an Initialization Vector (IV) Is Reused?
Yes, reusing an Initialization Vector (IV) with the same AES-GCM key allows attackers to recover the plaintexts by XORing the ciphertexts together. Furthermore, IV reuse allows attackers to calculate the internal authentication subkey (H), enabling them to forge valid authentication tags and inject malicious data.
#AES-GCM #IV Reuse #Cryptography
Read Full Answer→Data Formats & EncodingsIntermediate
Why Is UUID v7 Better Than UUID v4 for Database Primary Keys?
UUID v7 is significantly better for database primary keys because it begins with a 48-bit millisecond timestamp, making records sortable in chronological order. This preserves B-tree index locality and eliminates the severe page fragmentation and cache thrashing caused by completely random UUID v4 values.
#UUID #UUID v7 #UUID v4
Read Full Answer→Data Formats & EncodingsBeginner
Does Base64 Encoding Increase Data Size, and by How Much?
Yes, Base64 encoding increases data size by approximately 33.3% (a 4:3 ratio). For every 3 bytes of raw binary data, Base64 produces 4 ASCII characters, plus up to 2 bytes of padding characters (`=`).
#Base64 #Encoding #Data Size
Read Full Answer→