Ukuba usebenza kuphuhliso, uyazi ukuba ukushiya ii-API zakho zibonakala kufana nokushiya ucango lwakho luvulekile. Ngamanye amaxesha, isitshixo esinye se-API esivuzayo sanele ukuba umntu aqale ukukhuphula amatyala akho okanye ukusebenzisa kakubi iinkonzo zakho. Ukuze uphephe ezi ngxaki, iFirebase ikhuphe... AppCheck, isixhobo esenzelwe ngokukodwa ukuqinisekisa ukuba nabani na ofowunela iseva yakho ulusetyenziso lwakho ngokwenene hayi i-bot okanye umntu wesithathu onobubi.
Eyona nto inomdla kukuba le nkqubo ayijolisi ekubeni ngubani umsebenzisi (ngumsebenzi wokuqinisekisa), kodwa igxile ukuba semthethweni kwesixhobo okanye i-app. Ngamanye amazwi, idala isikhuselo esiqinisekisa ubuwena besoftware ngaphambi kokuba siyivumele ukuba ifikelele kwidatha yakho, nto leyo eyindlela enkulu yokuqhubekela phambili. khusela i-backend ngokuchasene nokukhohlisa nge-phishing kunye nobuqhetseba bokuhlawulisa.
Isebenza njani kanye kanye le ndlela yokusebenza?
Le nkqubo ayixakekanga kwaye yenzeka ngasemva ukuze ingaphazamisi umsebenzisi. Ngokwenyani, xa uvula inkonzo, usetyenziso lwakho luqhagamshelana no umboneleli wesatifikethi (ezifana nePlay Integrity kwi-Android okanye iDeviceCheck kwi-iOS) ukuze kuqinisekiswe ubunyani bayo. Nje ukuba umboneleli ayivume, eso siqinisekiso sithunyelwa kwiseva yeApp Check.
Iseva iqinisekisa ukuba yonke into ilungile kwaye ibuyisela umyalezo kwisicelo sakho. Ithokheni yokujonga usetyenziso kunye nomhla wokuphelelwa. I-Firebase SDK iphatha ukugcina le token kwaye iyincamathisele ngokuzenzekelayo kuyo yonke isicelo osenzayo kwiinkonzo ezikhuselweyo. Ngale ndlela, i-backend iya kuphendula kuphela ukuba isicelo sihamba ne ithokheni esebenzayo nehlaziyiweyoukwala naluphi na umzamo wokufikelela ngaphandle.
Ukuqina kunye nohlalutyo lokhuseleko
Kubalulekile ukuba ungaweli kumgibe wokucinga ukuba i-App Check yindlela yomlingo elungisa yonke into. Ukhuseleko luxhomekeke ngqo kwi ukuthembeka komthengisi ukuba ukhetha ukuqinisekisa usetyenziso. Nangona lususa uninzi lwezona vectors zixhaphakileyo zokuxhatshazwa, aluqinisekisi ukhuseleko olupheleleyo kuzo zonke iintlaselo ezinokwenzeka, kodwa, ngaphandle kwamathandabuzo, lunjalo. amanyathelo okuthintela abalulekileyo kuyo nayiphi na iprojekthi enzulu.
Kubalulekile ukwahlula phakathi koHlolo lwe-App kunye noQinisekiso lwe-Firebase. Ngelixa uqinisekiso lukhusela ubuwena bomsebenzisi, uHlolo lwe-App... ikhusela umphuhlisi ukuqinisekisa ukuba i-app ayiphazanyiswanga. Zombini ezi nkqubo ziyahambelana ngokugqibeleleyo: enye iyazi ukuba ngubani umntu kwaye enye iyazi ukuba Le yi-app yokuqala.
Ababoneleli kunye nemida yokusetyenziswa
Ngokuxhomekeke kwiqonga olisebenzisayo, uya kuba neendlela ezahlukeneyo zokuqinisekisa ubunyani. Kwi-Apple ecosystem, kusetyenziswa ezi zilandelayo: Uvavanyo lweDeviceCheck kunye neApp, ngelixa kwi-Android inkwenkwezi ikhona Dlala IngqibeleloKwiwebhu, ukhetho oluqinileyo kakhulu Ishishini le-reCAPTCHAnangona kukwakho nenguqulelo v3.
Ngokuphathelele iindleko kunye neentlawulo, kufuneka uzazi. Umzekelo, i-Play Integrity inikezela ngenqanaba eliqhelekileyo le Iifowuni ezili-10,000 ngosukuI-reCAPTCHA Enterprise inikezela ngee-10,000 zokuqala zovavanyo zasimahla ngenyanga, kodwa emva koko inkonzo ayisasimahla. Inexabiso elihambelanayo.Ukuba ucinga ukuba ithrafikhi yakho iza kudlula la manani, kungcono uqhagamshelane nenkxaso yeFirebase ukuze wandise imida.
Ukuphunyezwa kwiindawo ezenziwe ngokwezifiso kunye ne-backend
Ukujonga ii-App akupheleli nje kwiinkonzo zikaGoogle; ungayisebenzisela izixhobo ze-backend ezenziwe ngokwezifisonokuba zikwiCloud Run okanye kwiseva yakho. Kule meko, ithokheni idla ngokuthunyelwa kwi-header. X-Firebase-AppCheck kwaye kufuneka uyiqinisekise kwikhowudi yakho.
Ukuba usebenzisa i-Node.js, ungenza i- I-Express.js middleware esebenzisa i-Firebase Admin SDK ukuqinisekisa ithokheni. Kwezinye iilwimi, ezifana neRuby, inkqubo ibandakanya ukuqinisekisa ukuba ithokheni yi I-JSON Web Token (JWT) Bhalisa, jonga ukuba i-algorithm yi-RS256, kwaye uqinisekise ukuba umthumeli kunye nomamkeli bahambelana nenombolo yeprojekthi yakho ye-Firebase. Ukuze uphucule olu hambo lomsebenzi, kuyacetyiswa Khuphela isitudiyo se-Android kwaye ulungiselele ngokufanelekileyo imeko-bume yophuhliso.
Izifundo zetyala: Iimephu zikaGoogle kunye neFireCMS
Umzekelo oluncedo kakhulu kukukhusela iGoogle Maps JavaScript API. Ukuthintela umntu ekubeni abe isitshixo sakho se-API aze asisebenzise kwenye indawo, ungasiqhagamshela kwi-App Check. Okokuqala, uthintela isitshixo ukuba idomeyini yakho yokusingatha uze emva koko ulungiselele ReCaptchaV3Provider kwikhowudi yakho yangaphambili. Ekugqibeleni, imephu iya kulayisha kuphela ukuba ithokheni iyasebenzaukuvala naziphi na izicelo ezivela kumaphepha angagunyaziswanga.
Kwabo basebenzisa I-FireCMSUkudibanisa kulula kakhulu kuba kukuvumela ukuba uvule i-App Check ngqo kwi-FireCMS Cloud console okanye ngepropathi. appCheck kwizicwangciso. Khumbula nje ukongeza idomeyini yeFireCMS kwi uluhlu oluvumelekileyo kumboneleli wakho we-reCAPTCHA ukuze uphephe iimpazamo zonxibelelwano.
Iinkcukacha zobugcisa malunga nokuqinisekiswa kwethokheni
Kwabo bafuna ukuphumeza uqinisekiso ngesandla kwi Edge (njengabasebenzi beCloudflare) Kwi-Apigee, inkqubo ilandela umgangatho ongqongqo. Ifuna ukufumana iseti yesitshixo sikawonke-wonke se-JWK kwisiphelo se-Firebase, ukuqinisekisa utyikityo lwethokheni, nokuqinisekisa ukuba ayikaphelelwa lixesha.
Kwa-Apigee, oku kuthetha ukuba ngumgaqo-nkqubo Qinisekisa i-JWT apho umniki kunye nabaphulaphuli bachazwa kusetyenziswa inombolo yeprojekthi. Ukuba ithokheni ayisebenzi okanye ayikho kwintloko, isicelo si iyaliwe ngoko nangoko ngempazamo ye-401, egcina iziseko zakho zikhuselekile kwizicelo ezinobungozi.
Ukusebenzisa i-App Check kukuvumela ukuba uguqule i-API kawonke-wonke esengozini ibe yinkqubo evaliweyo apho kuphela isoftware esemthethweni enokufikelela kuyo, udibanisa i-hardware kunye ne-software ukuqinisekiswa kunye nolawulo lweethokheni ze-JWT ukudala indawo yophuhliso ekhuselekileyo nechasene nobuqhetseba. Yabelana ngolwazi ukuze abanye abasebenzisi bafunde malunga nesihloko.