Varnost in zaščita spletnih aplikacij z uporabo ogrodja Laravel

SNEŽIČ, RENE (author), Zaletelj, Janez (mentor)

V diplomskem delu sem opisal problem varnosti spletnih portalov ter načine preprečevanja vdorov v spletne aplikacije. Namen diplomskega dela je poučiti programerje spletnih aplikacij o pomenu varnosti v spletu. V ta namen sem v prvem delu naloge opisal najpogostejše varnostne ranljivosti spletnih sistemov ter podal primere le-teh. Nato sem opisal glavne vidike varnosti ter načine preprečevanja vdorov in kraj podatkov. Posebno pozornost sem posvetil pravilnemu ustvarjanju uporabniških računov, predvsem gesel, njihovemu shranjevanju, uporabi in ponastavitvi. Opisal ter izdelal sem spletno aplikacijo za vpis uporabnika v sistem z vso pripadajočo funkcionalnostjo z uporabo ogrodja Laravel. Za to orodje sem se odločil, ker je zgrajeno sistematično in že v osnovi ponuja osnovno zaščito spletnih aplikacij. Opisal sem, kako preprečiti določene vrste vdorov in kraj podatkov. Podal sem primere izvorne kode izdelane aplikacije, ki nazorno prikazujejo postopke avtentikacije, pošiljanja obrazcev, varovanja obrazcev ter tudi samo postavitev Laravel ogrodja na strežniku, saj je pri praktičnem delu pomembno, da se programer zaveda razlike med produkcijskim ter testnim in razvojnim okoljem.

• Language: Slovenian
• Keywords: varnost v spletu, varnostne ranljivosti, uporabniška gesla, Laravel, izdelava aplikacije.
• Work type: Bachelor thesis/paper
• Organization: FE - Faculty of Electrical Engineering
• Year: 2015
• PID: 20.500.12556/RUL-30838
• Publication date in RUL: 23.06.2015

Secondary language

• Language: English
• Title: Web application security and protection by using Laravel framework

Abstract

In this thesis I have described website vulnerabilities. The goal of the thesis is to educate and inform website developers about the importance of online security. To this end I have dedicated a chapter describing the top 10 website vulnerabilities according to OWASP. I described the main aspects of security and how to properly prevent system hijacks and data theft. The emphasis was given on how to properly generate user accounts, especially passwords – their saving, usage and resetting. I have described and developed a web application for user registration and logging by using Laravel, a web framework. I have chosen this framework because it is built systematically and because it offers basic level of protection out of the box. I have described how to prevent specific system intrusions and data theft. I have included examples of the test web application which clearly illustrates proper procedures of authentication, form submission, form security and the Laravel setup. In practical web developement it is very important that the developer is aware of the differences between the production and the test environment.

• Keywords: website security, security vulnerabilities, user passwords, Laravel, application development