Authentication & JWTBeginner
누구나 JWT를 복호화(디코딩)하여 내용을 볼 수 있나요?
네, 일반적인 JSON Web Token(JWS)은 서명된 것이지 암호화된 것이 아닙니다. 헤더와 페이로드는 Base64URL로 인코딩된 문자열일 뿐이므로 비밀 키가 없어도 누구나 평문으로 읽을 수 있습니다.
#JWT #Security #Encoding
Read Full Answer→Knowledge Base • 20 Questions AnsweredDirect • Verified • RFC-Standard
기술 Q&A 지식 베이스
불필요한 군더더기 없이 소프트웨어 엔지니어링의 핵심 질문에 직관적이고 정확하게 답변합니다.
Showing 20 of 20 questions
Authentication & JWTIntermediate
JWT를 LocalStorage에 저장하면 안 되는 이유는 무엇인가요?
인증 JWT를 localStorage에 저장하면 크로스 사이트 스크립팅(XSS) 취약점이 발생했을 때 악성 스크립트가 토큰을 즉시 탈취할 수 있기 때문입니다. HttpOnly, Secure, SameSite 속성이 적용된 쿠키를 사용하면 자바스크립트의 토큰 접근을 원천 차단할 수 있습니다.
#JWT #LocalStorage #XSS
Read Full Answer→Authentication & JWTIntermediate
Can an Expired JWT Token Still Be Verified?
Yes, the cryptographic signature of an expired JWT remains mathematically valid because signatures are computed solely over the header and payload data. However, compliant JWT libraries will reject the token during authentication because the expiration claim (`exp`) is explicitly checked after signature verification.
#JWT #Verification #exp
Read Full Answer→Authentication & JWTBeginner
What Is the Difference Between Authentication and Authorization?
Authentication (AuthN) verifies who a user is (identity confirmation), while Authorization (AuthZ) determines what permissions or resources that authenticated user is allowed to access.
#Authentication #Authorization #Identity
Read Full Answer→Web Security & CORS/CSPIntermediate
Why Does CORS Allow GET Requests Without a Preflight Check?
CORS allows standard GET requests without a preflight check for backward compatibility with the legacy web. Because HTML tags like `<form>`, `<img>`, and `<script>` have always been able to issue cross-origin GET requests without pre-approval, requiring preflights for all GETs would have broken decades of existing web architecture.
#CORS #HTTP #Preflight
Read Full Answer→Web Security & CORS/CSPIntermediate
브라우저는 왜 CORS에서 OPTIONS 프리플라이트 요청을 보내나요?
브라우저는 Authorization 헤더나 application/json과 같은 커스텀 속성을 포함하는 비단순 요청(Non-Simple Request)을 전송하기 전에, 대상 서버가 해당 메서드와 헤더를 안전하게 허용하는지 사전 확인하기 위해 OPTIONS 프리플라이트 요청을 전송합니다.
#CORS #HTTP #OPTIONS
Read Full Answer→Web Security & CORS/CSPAdvanced
Why Does CSP 'unsafe-inline' Defeat XSS Protection?
Using 'unsafe-inline' in a Content Security Policy defeats XSS protection because it instructs the browser to execute any inline script found in the HTML. Since Cross-Site Scripting works by injecting malicious inline script tags or event handlers, 'unsafe-inline' allows the attacker's payload to run freely.
#CSP #XSS #Web Security
Read Full Answer→HTTP & Web ArchitectureBeginner
What Is the Difference Between HTTP 401 Unauthorized and 403 Forbidden?
HTTP 401 Unauthorized means the user is not authenticated (identity unknown; credentials missing or invalid), whereas HTTP 403 Forbidden means the user is authenticated (identity known), but lacks the necessary permissions to access the requested resource.
#HTTP #Status Codes #401
Read Full Answer→HTTP & Web ArchitectureBeginner
Does HTTPS Encrypt the URL Path and Query Parameters?
Yes, HTTPS encrypts the entire HTTP request—including the URL path, query parameters, request headers, cookies, and message body. Only the destination hostname (domain name) and port number are visible on the wire via the TLS Server Name Indication (SNI) extension.
#HTTPS #TLS #Privacy
Read Full Answer→HTTP & Web ArchitectureIntermediate
How Does HTTP/2 Multiplex Multiple Requests Over a Single TCP Connection?
HTTP/2 multiplexes requests by splitting HTTP messages into independent binary frames tagged with a unique Stream ID. These frames are interleaved concurrently over a single shared TCP socket, eliminating the head-of-line blocking problem of HTTP/1.1.
#HTTP/2 #Networking #Multiplexing
Read Full Answer→HTTP & Web ArchitectureIntermediate
What Is the Difference Between ETag and Last-Modified Headers?
Last-Modified is a timestamp-based cache validator with 1-second resolution, while ETag is an arbitrary content-based fingerprint (such as a hash) that accurately detects byte-level changes even when modifications occur multiple times in the same second or across distributed server clusters.
#HTTP #Caching #ETag
Read Full Answer→HTTP & Web ArchitectureIntermediate
Why Is HTTP POST Not Idempotent While PUT Is?
An HTTP method is idempotent if executing it multiple times produces the exact same server state as executing it once. PUT is idempotent because repeating a PUT replaces the target resource at a known URI, whereas repeating a POST creates additional new subordinate resources or appends duplicate records each time.
#HTTP #REST #Idempotency
Read Full Answer→Networking & DNSBeginner
What Exactly Happens When a DNS Record TTL Expires?
When a DNS record's Time-To-Live (TTL) expires, the recursive resolver purges or invalidates the cached record from its local memory. The next time a client queries that domain name, the resolver must issue a new query over the network to the authoritative nameserver to obtain fresh data.
#DNS #TTL #Caching
Read Full Answer→Networking & DNSBeginner
Can a CNAME Record Point Directly to an IP Address?
No, a CNAME (Canonical Name) record cannot point to an IP address. RFC 1034 strictly mandates that a CNAME record must point exclusively to another fully qualified domain name (FQDN). To point a hostname directly to an IP address, you must use an A record (for IPv4) or an AAAA record (for IPv6).
#DNS #CNAME #IP Address
Read Full Answer→Networking & DNSIntermediate
Why Can't a CNAME Record Coexist With Other Records at the Zone Apex?
A CNAME cannot exist at the zone apex (@ or example.com) because RFC 1034 mandates that if a CNAME exists at a node, no other record types may exist at that node. Because every zone apex is required to have SOA and NS records, an apex CNAME creates an irreconcilable protocol violation.
#DNS #CNAME #Apex
Read Full Answer→Cryptography & HashingIntermediate
Why Does Changing One Character in an Input Completely Change the SHA-256 Hash?
Changing a single character (or even a single bit) changes approximately 50% of the output SHA-256 hash digest because of the cryptographic Avalanche Effect. Secure hash algorithms use iterative rounds of bitwise rotations, non-linear boolean operations, and modular addition to diffuse input bits across the entire internal state.
#SHA-256 #Avalanche Effect #Cryptography
Read Full Answer→Cryptography & HashingIntermediate
Why Is MD5 Considered Cryptographically Broken and Insecure?
MD5 is considered cryptographically broken because practical collision attacks exist that allow attackers to generate two completely different files with the exact same MD5 hash in a fraction of a second. Consequently, MD5 cannot be trusted for digital signatures, certificates, or file integrity verification.
#MD5 #Collision Attack #Cryptography
Read Full Answer→Cryptography & HashingAdvanced
Can AES-GCM Plaintext Be Recovered If an Initialization Vector (IV) Is Reused?
Yes, reusing an Initialization Vector (IV) with the same AES-GCM key allows attackers to recover the plaintexts by XORing the ciphertexts together. Furthermore, IV reuse allows attackers to calculate the internal authentication subkey (H), enabling them to forge valid authentication tags and inject malicious data.
#AES-GCM #IV Reuse #Cryptography
Read Full Answer→Data Formats & EncodingsIntermediate
Why Is UUID v7 Better Than UUID v4 for Database Primary Keys?
UUID v7 is significantly better for database primary keys because it begins with a 48-bit millisecond timestamp, making records sortable in chronological order. This preserves B-tree index locality and eliminates the severe page fragmentation and cache thrashing caused by completely random UUID v4 values.
#UUID #UUID v7 #UUID v4
Read Full Answer→Data Formats & EncodingsBeginner
Does Base64 Encoding Increase Data Size, and by How Much?
Yes, Base64 encoding increases data size by approximately 33.3% (a 4:3 ratio). For every 3 bytes of raw binary data, Base64 produces 4 ASCII characters, plus up to 2 bytes of padding characters (`=`).
#Base64 #Encoding #Data Size
Read Full Answer→