<\/div>\n

Merhaba,<\/p>\n

IdentityServer4 Yaz\u0131 Serisi<\/a>nin bu yirminci makalesinde OAuth 2.0’da ki client id ve secret de\u011ferleri ile olu\u015fabilecek g\u00fcvenlik zaafiyeti \u00fczerine konu\u015fuyor olacak ve bu zaafiyete kar\u015f\u0131 geli\u015ftirilen PKCE(Proof Key for Code Exchange)<\/em> \u00f6nleminin nas\u0131l al\u0131nabilece\u011fini inceleyece\u011fiz.<\/p>\n

Proof Key for Code Exchange Nedir?<\/strong>
\nSingle Page Application(SPA) ve Mobil uygulamalara client secret gibi kritik olan de\u011ferleri g\u00f6ndermek olduk\u00e7a tehlike arz edebilmektedir. Misal, SPA’lar \u00f6z\u00fcnde JavaScript olduklar\u0131 i\u00e7in, kendilerine g\u00f6nderilen \u00e7o\u011fu veriyi taray\u0131c\u0131da tutmakta ve i\u015flemlerini taray\u0131c\u0131lar \u00fczerinde ger\u00e7ekle\u015ftirmektedirler. Biliyorsunuz ki, taray\u0131c\u0131 \u00fczerinde tutulan verilere kullan\u0131c\u0131lar az \u00e7abayla eri\u015febilmektedirler. Bu durumda client secret gibi \u00f6nemli bir de\u011feri taray\u0131c\u0131 \u00fczerinde \u00e7al\u0131\u015fan SPA gibi uygulamalara g\u00f6ndermek, k\u00f6t\u00fc niyetli ki\u015filer taraf\u0131ndan elde edilmesini ve t\u00fcrl\u00fc sald\u0131r\u0131lara yahut s\u0131z\u0131nt\u0131lara mahal verilmesini sa\u011flayabilir. Ayn\u0131 \u015fekilde bu durum mobil uygulamalar i\u00e7inde ge\u00e7erlidir. Mobil uygulamalar, tersine m\u00fchendislikle \u00e7ok rahat de\u015fifre edilebilmekte ve kendilerine g\u00f6nderilen kritik verileri k\u00f6t\u00fc niyetli kullan\u0131c\u0131lara ister istemez kapt\u0131rabilmektedirler.<\/p>\n

\u0130\u015fte, OAuth 2.0 ve Open Id Connect protokollerini kullan\u0131rken yahut bu protokolleri benimsemi\u015f olan IdentityServer4 gibi framework’ler de \u00e7al\u0131\u015f\u0131rken client’a g\u00f6nderilmesi gereken client secret gibi kritik de\u011ferleri mevcudiyette olan b\u00f6yle bir riske kar\u015f\u0131 g\u00f6ndermek yerine g\u00fcvenlik a\u00e7\u0131s\u0131ndan farkl\u0131 \u00e7\u00f6z\u00fcmler d\u00fc\u015f\u00fcn\u00fclm\u00fc\u015f ve Proof Key for Code Exchange<\/em> y\u00f6ntemi tasarlanm\u0131\u015ft\u0131r.<\/p>\n

Proof Key for Code Exchange<\/em>, kod de\u011fi\u015fimi i\u00e7in \u0131spat\/kan\u0131t anahtar\u0131 \u015feklinde meal edilebilir. Peki bu ne demektir?<\/em> PKCE, kullan\u0131c\u0131 kimli\u011finin do\u011frulanmas\u0131n\u0131 talep eden client’\u0131n, access token elde edebilmesi i\u00e7in tutmas\u0131 gereken secret gibi kritik bilgiler yerine farkl\u0131 de\u011ferler \u00fcreterek do\u011frulama i\u015fleminin g\u00fcvenli bir \u015fekilde yap\u0131lmas\u0131n\u0131 sa\u011flamaktad\u0131r. Server, kendisine gelen talep i\u00e7erisinde kod de\u011fi\u015fimi yap\u0131labilecek bir do\u011frulay\u0131c\u0131 ile yapaca\u011f\u0131 do\u011frulama neticesinde g\u00fcvenli bir kullan\u0131c\u0131 do\u011frulamas\u0131 ger\u00e7ekle\u015ftirecek ve b\u00f6ylece k\u00f6t\u00fc niyetli client’lardan korunmu\u015f olacakt\u0131r.<\/p>\n

\u015eimdi burada i\u015flevsellik g\u00f6sterecek iki akt\u00f6r\u00fcm\u00fcz\u00fc net tan\u0131yal\u0131m, tan\u0131mlayal\u0131m;<\/p>\n

\n
code_verifier<\/strong>
\nClient taraf\u0131ndan yap\u0131lan access token talebi neticesinde do\u011frulama i\u015flemi i\u00e7in kullan\u0131lan random \u00fcretilmi\u015f bir koddur.\n<\/li>\n

code_challenge<\/strong>
\ncode_verifier’\u0131 do\u011frulamak i\u00e7in client’a g\u00f6nderilmi\u015f olan random \u00fcretilmi\u015f bir koddur.\n<\/li>\n<\/ul>\n
Client, authorization code talebinde bulundu\u011funda \u00f6ncelikle client’a ait code_challenge<\/em> ve code_verifier<\/em> \u00fcretilir. code_verifier<\/em> authorization code ile birlikte client’a g\u00f6nderilirken, code_challenge<\/em> Auth Server’da bu client’a \u00f6zel kaydedilir. Ard\u0131ndan authorization code’u alan client, access token iste\u011finde bulunabilmek i\u00e7in code_verifier<\/em>‘\u0131 da istekte g\u00f6nderir. Auth Server, gelen istekteki code_verifier<\/em>‘\u0131 al\u0131r ve \u00f6nceden olu\u015fturulup ilgili client’a dair tutulan code_challenge<\/em> de\u011feri ile kar\u015f\u0131la\u015ft\u0131r\u0131r. E\u011fer bu kar\u015f\u0131la\u015ft\u0131rma neticesinde do\u011frulama ger\u00e7ekle\u015ftirilirse client access token’\u0131 elde eder. B\u00f6ylece ilgili client, secret de\u011feri yerine sadece code_verifier<\/em> ve code_challenge<\/em> de\u011ferlerini kullanm\u0131\u015f olacakt\u0131r ve olas\u0131 risk ortadan kalkacakt\u0131r.<\/p>\n
Proof Key for Code Exchange, merkezi \u00fcyelik sistemi gerektiren–Authorization Code Grant(Flow)<\/a> ve Implicit Grant(Flow)<\/a>–<\/span> durumlarda kullan\u0131l\u0131r. Lakin do\u011frulaman\u0131n merkezi olmad\u0131\u011f\u0131 –Resource Owner Credentials Grant(Flow)<\/a>–<\/span> durumlarda ise kullan\u0131lmas\u0131na gerek yoktur.<\/em><\/p><\/blockquote>\n
IdentityServer4’te PKCE Kullan\u0131m\u0131 Nas\u0131ld\u0131r?<\/strong>
\nIdentityServer4’te PKCE kullan\u0131m\u0131 olduk\u00e7a basittir. Bunun i\u00e7in ‘Config.cs’ dosyas\u0131nda ilgili client’a dair a\u015fa\u011f\u0131daki gibi ‘RequirePkce’ property’sine ‘true’ de\u011ferinin verilmesi yeterlidir.<\/p>\n
\r\n public static IEnumerable<Client> GetClients() =>\r\n new List<Client>\r\n {\r\n new Client\r\n {\r\n .\r\n .\r\n .\r\n RequirePkce = true\r\n }\r\n };\r\n<\/pre>\n
B\u00f6ylece ilgili client i\u00e7in secret de\u011feri tan\u0131mlamaya gerek kalmaks\u0131z\u0131n yukar\u0131da anlat\u0131ld\u0131\u011f\u0131 gibi ‘code_verifier’ ve ‘code_challenge’ de\u011ferleri ile i\u015flem ger\u00e7ekle\u015ftirilecektir.<\/p>\n
PKCE, client side uygulamalar i\u00e7in i\u015flevseldir. Server side uygulamalar i\u00e7in kullan\u0131lmas\u0131na gerek yoktur!<\/em><\/p><\/blockquote>\n
\u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle…
\nSonraki yaz\u0131lar\u0131mda g\u00f6r\u00fc\u015fmek \u00fczere…
\n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\n","protected":false},"excerpt":{"rendered":"
Merhaba, IdentityServer4 Yaz\u0131 Serisinin bu yirminci makalesinde OAuth 2.0’da ki client id ve secret de\u011ferleri ile olu\u015fabilecek g\u00fcvenlik zaafiyeti \u00fczerine konu\u015fuyor olacak ve bu zaafiyete kar\u015f\u0131 geli\u015ftirilen PKCE(Proof Key for Code Exchange) \u00f6nleminin nas\u0131l...<\/p>\n","protected":false},"author":1,"featured_media":18168,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3826],"tags":[3964,3963,3827,3960,3961,3959,3958,3962],"class_list":["post-19443","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-identityserver4","tag-code_challenge","tag-code_verifier","tag-identityserver4","tag-identityserver4-pkce","tag-identityserver4-proof-key-for-code-exchange","tag-pkce","tag-proof-key-for-code-exchange","tag-proof-key-for-code-exchange-nedir"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/19443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=19443"}],"version-history":[{"count":27,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/19443\/revisions"}],"predecessor-version":[{"id":26919,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/19443\/revisions\/26919"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/18168"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=19443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=19443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=19443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}