# API Xavfsizligi: Authentication va Authorization — Zamonaviy Tizimlarning Yurak Urishi 🛡️ > **Xulosa**: Zamonaviy dasturlash dunyosida API xavfsizligi — bu faqat texnik masala emas, balki butun raqamli ekotizimning hayot-mamot masalasidir. Authentication va Authorization mexanizmlari orqali biz kim ekanligimizni isbotlash va nima qilishga huquqli ekanligimizni aniqlash jarayonlarini chuqur o'rganamiz. --- Zamonaviy raqamli dunyoda API (Application Programming Interface) xavfsizligi — bu faqat texnik masala emas, balki butun kibermakonda mavjud bo'lgan ma'lumotlar va xizmatlarning hayot-mamot masalasidir. Tasavvur qiling, siz eng muhim sir-u razlaringizni saqlaydigan xazina sandiqchangiz bor. Bu sandiqchaning kalitlari Authentication, unga kirishga ruxsat beruvchi mexanizm esa Authorization deb ataladi. Agar bu ikki tizim to'g'ri ishlamasa, butun raqamli imperiyangiz qulab tushishi mumkin. Bugungi kunda har bir dasturiy ta'minot mahsuloti yuzlab, hatto minglab API orqali boshqa xizmatlar bilan bog'lanadi. Bir WhatsApp xabar yuborishda kamida 15-20 turli API chaqiruvi amalga oshiriladi — foydalanuvchini autentifikatsiya qilishdan tortib, xabarni shifrlash va yetkazib berishgacha. Shuning uchun API xavfsizligi zamonaviy dasturlash sohasidagi eng muhim va murakkab mavzulardan biridir. ## Authentication: "Kim Siz?" Savoliga Javob Berish San'ati ### Nazariy Asoslar va Fundamental Tushunchalar Authentication (autentifikatsiya) — bu foydalanuvchi yoki tizimning o'zini kim ekanligini isbotlash jarayonidir. Bu jarayonni odatdagi hayotdan misol keltirib tushuntiraylik: bankka kirganingizda xavfsizlik xodimi sizdan pasport yoki ID karta so'raydi. Bu yerda pasportingiz — Authentication vositasi, siz esa o'zingizning haqiqiy shaxsingizni isbotlayapsiz. Raqamli dunyoda Authentication jarayoni ancha murakkab va ko'p qatlamli tizim hisoblanadi. Eng sodda ko'rinishda, bu username va password orqali amalga oshirilsa ham, zamonaviy tizimlarda bu jarayon kriptografiya, biometrik ma'lumotlar va hatto sun'iy intellekt algoritmlarini o'z ichiga oladi. Authentication tizimining asosiy komponentlari quyidagilardan iborat: 1. **Identity Provider (IdP)** — foydalanuvchi identifikatorlarini boshqaruvchi tizim 2. **Credential Store** — autentifikatsiya ma'lumotlarini saqlash omborlari 3. **Authentication Protocol** — autentifikatsiya jarayonini boshqaruvchi protokollar 4. **Session Management** — foydalanuvchi sessiyasini boshqarish mexanizmlari 5. **Token Management** — autentifikatsiya tokenlarini yaratish va nazorat qilish > [!IMPORTANT] > Authentication jarayonining asosiy maqsadi — tizimga kirayotgan shaxsning haqiqiy ekanligini tasdiqlashdir. Bu jarayon noto'g'ri amalga oshirilsa, butun tizim xavf ostida qoladi. Statistik ma'lumotlarga ko'ra, 81% kiberhujumlar zaif yoki buzilgan parollar tufayli sodir bo'ladi. Authentication jarayonining uch asosiy turi mavjud: - **Knowledge-based (bilim asosida)**: Bu kategoriyaga parollar, PIN kodlar, maxfiy savollar va javoblar kiradi - **Possession-based (egalik asosida)**: Telefon, token, smart karta, kalitlar kabi jismoniy obyektlar - **Inherence-based (xususiyat asosida)**: Barmoq izi, yuz tanish, ovoz tanish, ko'z gavharining naqshi kabi biometrik ma'lumotlar ### Parollar: Eng Zaif Halqa va Uning Ilmiy Tahlili Parollar — Authentication tizimining eng keng tarqalgan, ammo eng zaif halqasidir. Insonlar tabiatan oddiy va eslab qolinadigan parollarni tanlashga moyil. "123456", "password", "qwerty" kabi parollar hali ham eng ko'p ishlatiladigan parollar ro'yxatida birinchi o'rinlarda turadi. Bu xuddi uyingizning eshigiga "Kalit tagida" deb yozib qo'yish bilan barobardir. Parollarning zaifligini matematik jihatdan tahlil qiladigan bo'lsak, entropiya tushunchasidan foydalanishimiz kerak. Entropiya — bu parolning tasodifiylik darajasini o'lchaydigan kattalik. Matematik formula quyidagicha: **H = log₂(N^L)** Bu yerda: - H = entropiya (bit hisobida) - N = ishlatiladigan belgilar to'plami hajmi - L = parol uzunligi 8 belgili parol (kichik harflar, katta harflar, raqamlar va maxsus belgilar — jami 94 ta belgi) nazariy jihatdan 6.1 × 10¹⁵ turli kombinatsiyani hosil qilishi mumkin. Ammo zamonaviy kompyuter texnologiyalari bunday parollarni soniyalar ichida sindirishi mumkin. Modern GPU-lar (Graphics Processing Unit) asosidagi hujum usullari sekundiga 350 milliard parol kombinatsiyasini sinab ko'rishi mumkin. NVIDIA RTX 4090 videokartasi MD5 hash uchun sekundiga 140 GH/s tezlikka erishishi mumkin. ```javascript // Parol xavfsizligi tahlil qilish tizimi class PasswordSecurityAnalyzer { constructor() { // Eng ko'p ishlatiladigan zaif parollar ro'yxati this.commonPasswords = new Set([ "123456", "password", "admin", "qwerty", "12345678", "123456789", "1234567890", "abc123", "password123", "admin123", "root", "toor", "pass", "test", "guest" ]); // Belgilar to'plami this.charsets = { lowercase: "abcdefghijklmnopqrstuvwxyz", uppercase: "ABCDEFGHIJKLMNOPQRSTUVWXYZ", digits: "0123456789", special: "!@#$%^&*()_+-=[]{}|;:,.<>?~`" }; } /** * Kuchli parol yaratish algoritmi * Bu algoritm kriptografik jihatdan xavfsiz tasodifiy generatordan foydalanadi */ generateSecurePassword(length = 16, options = {}) { const defaults = { includeLowercase: true, includeUppercase: true, includeDigits: true, includeSpecial: true, excludeSimilar: false // O, 0, I, l kabi o'xshash belgilarni chiqarib tashlash }; const config = { ...defaults, ...options }; let charset = ""; if (config.includeLowercase) charset += this.charsets.lowercase; if (config.includeUppercase) charset += this.charsets.uppercase; if (config.includeDigits) charset += this.charsets.digits; if (config.includeSpecial) charset += this.charsets.special; if (config.excludeSimilar) { charset = charset.replace(/[0O1lI]/g, ''); } // Kriptografik jihatdan xavfsiz tasodifiy generatordan foydalanish const array = new Uint32Array(length); crypto.getRandomValues(array); let password = ""; for (let i = 0; i < length; i++) { const randomIndex = array[i] % charset.length; password += charset[randomIndex]; } // Har bir kategoriyadan kamida bitta belgi borligini ta'minlash password = this.ensureComplexity(password, config); return password; } /** * Parol murakkabligini ta'minlash * Agar biron bir kategoriyadan belgi yo'q bo'lsa, majburiy qo'shadi */ ensureComplexity(password, config) { const requirements = []; if (config.includeLowercase && !/[a-z]/.test(password)) { requirements.push(this.charsets.lowercase); } if (config.includeUppercase && !/[A-Z]/.test(password)) { requirements.push(this.charsets.uppercase); } if (config.includeDigits && !/[0-9]/.test(password)) { requirements.push(this.charsets.digits); } if (config.includeSpecial && !/[^A-Za-z0-9]/.test(password)) { requirements.push(this.charsets.special); } // Yetishmayotgan kategoriyalardan tasodifiy belgilar qo'shish let passwordArray = password.split(''); requirements.forEach(charset => { const randomIndex = Math.floor(Math.random() * passwordArray.length); const randomChar = charset[Math.floor(Math.random() * charset.length)]; passwordArray[randomIndex] = randomChar; }); return passwordArray.join(''); } /** * Parol kuchliligini batafsil tahlil qilish * NIST (National Institute of Standards and Technology) standartlari asosida */ analyzePasswordStrength(password) { const analysis = { length: password.length, entropy: 0, score: 0, strength: '', weaknesses: [], suggestions: [] }; // Uzunlik tekshiruvi if (password.length < 8) { analysis.weaknesses.push('Juda qisqa (8 belgidan kam)'); analysis.suggestions.push('Kamida 12 belgili parol ishlating'); } else if (password.length < 12) { analysis.suggestions.push('Uzunroq parol (12+ belgi) tavsiya etiladi'); } // Belgilar xilma-xilligi tekshiruvi let charsetSize = 0; if (/[a-z]/.test(password)) { charsetSize += 26; analysis.score += 1; } else { analysis.weaknesses.push('Kichik harflar yo\'q'); } if (/[A-Z]/.test(password)) { charsetSize += 26; analysis.score += 1; } else { analysis.weaknesses.push('Katta harflar yo\'q'); } if (/[0-9]/.test(password)) { charsetSize += 10; analysis.score += 1; } else { analysis.weaknesses.push('Raqamlar yo\'q'); } if (/[^A-Za-z0-9]/.test(password)) { charsetSize += 32; analysis.score += 2; } else { analysis.weaknesses.push('Maxsus belgilar yo\'q'); } // Entropiya hisobi analysis.entropy = Math.log2(Math.pow(charsetSize, password.length)); // Umumiy parollarni tekshirish if (this.commonPasswords.has(password.toLowerCase())) { analysis.weaknesses.push('Juda keng tarqalgan parol'); analysis.score = 0; } // Ketma-ketlik va takrorlanish tekshiruvi if (this.hasSequence(password)) { analysis.weaknesses.push('Ketma-ket belgilar mavjud (abc, 123)'); analysis.score -= 2; } if (this.hasRepeatedChars(password)) { analysis.weaknesses.push('Ko\'p takrorlanadigan belgilar'); analysis.score -= 1; } // Yakuniy baho if (analysis.score <= 0) analysis.strength = 'Juda zaif'; else if (analysis.score <= 2) analysis.strength = 'Zaif'; else if (analysis.score <= 4) analysis.strength = 'O\'rta'; else if (analysis.score <= 6) analysis.strength = 'Kuchli'; else analysis.strength = 'Juda kuchli'; return analysis; } /** * Ketma-ketlik mavjudligini tekshirish */ hasSequence(password) { const sequences = [ 'abcdefghijklmnopqrstuvwxyz', '0123456789', 'qwertyuiopasdfghjklzxcvbnm' ]; const lowerPassword = password.toLowerCase(); for (let seq of sequences) { for (let i = 0; i <= seq.length - 3; i++) { if (lowerPassword.includes(seq.substring(i, i + 3))) { return true; } } } return false; } /** * Takrorlanadigan belgilarni tekshirish */ hasRepeatedChars(password) { let consecutiveCount = 1; for (let i = 1; i < password.length; i++) { if (password[i] === password[i-1]) { consecutiveCount++; if (consecutiveCount >= 3) return true; } else { consecutiveCount = 1; } } return false; } /** * Parol buzilish vaqtini hisoblash * Turli hujum usullari uchun */ calculateCrackTime(password) { const analysis = this.analyzePasswordStrength(password); const entropy = analysis.entropy; // Turli hujum usullari uchun sekundiga urinishlar soni const attackMethods = { 'Oddiy kompyuter': 1e3, // 1K/sec 'Zamonaviy GPU': 1e9, // 1B/sec 'GPU klaster': 1e12, // 1T/sec 'Quantum kompyuter (nazariy)': 1e15 // 1P/sec }; const results = {}; const totalCombinations = Math.pow(2, entropy) / 2; // O'rtacha yarmi for (let [method, speed] of Object.entries(attackMethods)) { const seconds = totalCombinations / speed; results[method] = this.formatTime(seconds); } return results; } /** * Vaqtni odam tushunadigan formatga o'girish */ formatTime(seconds) { if (seconds < 60) return `${Math.round(seconds)} soniya`; if (seconds < 3600) return `${Math.round(seconds/60)} daqiqa`; if (seconds < 86400) return `${Math.round(seconds/3600)} soat`; if (seconds < 31536000) return `${Math.round(seconds/86400)} kun`; if (seconds < 31536000000) return `${Math.round(seconds/31536000)} yil`; return "Astronomik vaqt"; } } // Foydalanish namunasi const analyzer = new PasswordSecurityAnalyzer(); // Xavfsiz parol yaratish const securePassword = analyzer.generateSecurePassword(16, { includeSpecial: true, excludeSimilar: true }); console.log('Yaratilgan xavfsiz parol:', securePassword); // Parol tahlili const analysis = analyzer.analyzePasswordStrength('MyP@ssw0rd123'); console.log('Parol tahlili:', analysis); // Buzilish vaqti hisobi const crackTime = analyzer.calculateCrackTime('MyP@ssw0rd123'); console.log('Buzilish vaqti:', crackTime); ``` > [!TIP] > Zamonaviy xavfsizlik ekspertlari kamida 12 belgili, turli xil belgilar kombinatsiyasini o'z ichiga olgan parollarni tavsiya etishadi. NIST (National Institute of Standards and Technology) yangi qo'llanmalarida parol uzunligi murakkablikdan muhimroq ekanligini ta'kidlaydi. ### Ikki Faktorli Autentifikatsiya (2FA): Qo'shimcha Himoya Qatlami Ikki faktorli autentifikatsiya (Two-Factor Authentication - 2FA) — bu zamonaviy xavfsizlikning oltin standartidir. Bu yondashuv ikkita mustaqil autentifikatsiya usulini birlashtiradi: birinchisi odatda parol (bilim), ikkinchisi esa telefon yoki dastur orqali yuborilgan kod (egalik). 2FA tizimining matematik asoslari HMAC (Hash-based Message Authentication Code) va TOTP (Time-based One-Time Password) algoritmlariga asoslangan. Bu algoritmlar RFC 6238 standartida belgilangan va kriptografik jihatdan mustahkam hisoblanadi. 2FA tizimi quyidagi printsiplar asosida ishlaydi: 1. **Shared Secret**: Foydalanuvchi va server o'rtasida umumiy maxfiy kalit (secret key) 2. **Time Synchronization**: Vaqt sinxronizatsiyasi (odatda 30 soniya interval) 3. **Counter-based**: Yoki hisoblagich asosidagi generatsiya 4. **Hash Function**: Xavfsiz hash funktsiyasi (SHA-1, SHA-256) ```javascript // To'liq TOTP (Time-based One-Time Password) implementatsiyasi const crypto = require('crypto'); class AdvancedTOTP { constructor(secret, options = {}) { this.secret = secret; this.timeStep = options.timeStep || 30; // Vaqt qadam (soniya) this.codeDigits = options.codeDigits || 6; // Kod uzunligi this.hashAlgorithm = options.hashAlgorithm || 'sha1'; this.window = options.window || 1; // Vaqt oynasi tolerance } /** * Base32 ni binary ga o'girish * RFC 4648 standartiga mos */ base32Decode(encoded) { const base32Chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'; let bits = ''; let result = []; // Paddingni olib tashlash encoded = encoded.replace(/=+$/, ''); for (let char of encoded) { const value = base32Chars.indexOf(char.toUpperCase()); if (value === -1) { throw new Error('Invalid base32 character: ' + char); } bits += value.toString(2).padStart(5, '0'); } // 8-bitlik byte'larga bo'lish for (let i = 0; i < bits.length - 7; i += 8) { const byte = parseInt(bits.substr(i, 8), 2); result.push(byte); } return Buffer.from(result); } /** * HOTP (HMAC-based OTP) generatsiya * RFC 4226 standartiga mos */ generateHOTP(secret, counter) { // Secret kalit tayyorlash let key; if (typeof secret === 'string') { try { key = this.base32Decode(secret); } catch (error) { // Agar base32 decode muvaffaqiyatsiz bo'lsa, UTF-8 sifatida qaraymiz key = Buffer.from(secret, 'utf8'); } } else { key = secret; } // Counter ni 8-byte big-endian formatga o'girish const buffer = Buffer.alloc(8); // JavaScript'da big integer'lar bilan ishlash const high = Math.floor(counter / 0x100000000); const low = counter % 0x100000000; buffer.writeUInt32BE(high, 0); buffer.writeUInt32BE(low, 4); // HMAC hisoblash const hmac = crypto.createHmac(this.hashAlgorithm, key); hmac.update(buffer); const digest = hmac.digest(); // Dynamic Truncation (RFC 4226, Section 5.4) const offset = digest[digest.length - 1] & 0xf; const code = ((digest[offset] & 0x7f) << 24) | ((digest[offset + 1] & 0xff) << 16) | ((digest[offset + 2] & 0xff) << 8) | (digest[offset + 3] & 0xff); // Kerakli uzunlikka keltirib olish const truncatedCode = code % Math.pow(10, this.codeDigits); return String(truncatedCode).padStart(this.codeDigits, '0'); } /** * TOTP kod generatsiya qilish * RFC 6238 standartiga mos */ generateTOTP(timestamp = Date.now()) { // Unix timestamp'ni time step'ga bo'lib, T0=0 deb hisoblaymiz const timeCounter = Math.floor(timestamp / (this.timeStep * 1000)); return this.generateHOTP(this.secret, timeCounter); } /** * TOTP kodni tekshirish * Vaqt oynasi (window) ni hisobga olgan holda */ verifyTOTP(token, timestamp = Date.now()) { const currentTimeCounter = Math.floor(timestamp / (this.timeStep * 1000)); // Window oralig'ida tekshirish for (let i = -this.window; i <= this.window; i++) { const testCounter = currentTimeCounter + i; const expectedToken = this.generateHOTP(this.secret, testCounter); if (this.safeCompare(token, expectedToken)) { return { valid: true, timeStep: i, usedAt: timestamp }; } } return { valid: false, reason: 'Invalid token or expired' }; } /** * Timing attack'larga qarshi xavfsiz string taqqoslash */ safeCompare(a, b) { if (a.length !== b.length) { return false; } let result = 0; for (let i = 0; i < a.length; i++) { result |= a.charCodeAt(i) ^ b.charCodeAt(i); } return result === 0; } /** * QR kod uchun URL yaratish * Google Authenticator format */ generateQRCodeURL(issuer, accountName) { const params = new URLSearchParams({ secret: this.secret, issuer: issuer, algorithm: this.hashAlgorithm.toUpperCase(), digits: this.codeDigits, period: this.timeStep }); const label = encodeURIComponent(`${issuer}:${accountName}`); return `otpauth://totp/${label}?${params.toString()}`; } /** * Qolgan vaqtni hisoblash */ getRemainingTime(timestamp = Date.now()) { const timeCounter = Math.floor(timestamp / (this.timeStep * 1000)); const nextStep = (timeCounter + 1) * this.timeStep * 1000; return Math.ceil((nextStep - timestamp) / 1000); } /** * Backup kodlarni yaratish * Foydalanuvchi 2FA qurilmasini yo'qotgan holatda */ generateBackupCodes(count = 10) { const codes = []; for (let i = 0; i < count; i++) { // 8 belgili alfanumerik kod const code = crypto.randomBytes(4).toString('hex').toUpperCase(); codes.push(`${code.slice(0,4)}-${code.slice(4)}`); } return codes; } /** * Secret key yaratish * Kriptografik jihatdan xavfsiz */ static generateSecret(length = 32) { const base32Chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'; const randomBytes = crypto.randomBytes(length); let secret = ''; for (let byte of randomBytes) { secret += base32Chars[byte % 32]; } return secret; } } // 2FA Session Management class TwoFactorSession { constructor() { this.sessions = new Map(); // Real aplikatsiyada Redis yoki boshqa cache this.usedTokens = new Set(); // Token replay attack'larini oldini olish this.sessionTimeout = 5 * 60 * 1000; // 5 daqiqa } /** * 2FA jarayonini boshlash */ initiateTwoFactor(userId, primaryAuth) { const sessionId = crypto.randomBytes(32).toString('hex'); const session = { userId, primaryAuth, createdAt: Date.now(), attempts: 0, maxAttempts: 3, verified: false }; this.sessions.set(sessionId, session); // Auto cleanup setTimeout(() => { this.sessions.delete(sessionId); }, this.sessionTimeout); return sessionId; } /** * 2FA kodni tekshirish */ verifySecondFactor(sessionId, token, totpInstance) { const session = this.sessions.get(sessionId); if (!session) { return { success: false, error: 'Session not found or expired' }; } if (session.attempts >= session.maxAttempts) { this.sessions.delete(sessionId); return { success: false, error: 'Too many attempts' }; } // Token'ni bir marta ishlatilganligini tekshirish const tokenKey = `${session.userId}:${token}:${Math.floor(Date.now()/30000)}`; if (this.usedTokens.has(tokenKey)) { return { success: false, error: 'Token already used' }; } session.attempts++; const verification = totpInstance.verifyTOTP(token); if (verification.valid) { session.verified = true; this.usedTokens.add(tokenKey); // Eski tokenlarni tozalash setTimeout(() => { this.usedTokens.delete(tokenKey); }, 60000); return { success: true, userId: session.userId, sessionId: sessionId }; } else { return { success: false, error: 'Invalid token', attemptsLeft: session.maxAttempts - session.attempts }; } } /** * Session holatini tekshirish */ getSessionStatus(sessionId) { const session = this.sessions.get(sessionId); if (!session) return null; return { userId: session.userId, verified: session.verified, attempts: session.attempts, attemptsLeft: session.maxAttempts - session.attempts, timeLeft: Math.max(0, (session.createdAt + this.sessionTimeout - Date.now()) / 1000) }; } } // Express.js middleware sifatida ishlatish class TwoFactorMiddleware { constructor(totpInstance, sessionManager) { this.totp = totpInstance; this.sessionManager = sessionManager; } requireTwoFactor() { return (req, res, next) => { const sessionId = req.headers['x-2fa-session'] || req.body.sessionId; if (!sessionId) { return res.status(401).json({ error: '2FA required', step: 'primary_auth' }); } const status = this.sessionManager.getSessionStatus(sessionId); if (!status) { return res.status(401).json({ error: 'Session expired', step: 'primary_auth' }); } if (!status.verified) { return res.status(401).json({ error: '2FA verification required', step: 'second_factor', attemptsLeft: status.attemptsLeft, timeLeft: Math.round(status.timeLeft) }); } req.userId = status.userId; next(); }; } } // ```