Veb-ilovamiz uchun transport qatlamining…

Transport darajasida HTTPS protokolidan foydalaning.

Asosiy chora-tadbirlar:

SSL/TLS sertifikatidan foydalanish: Ishonchli SSL/TLS sertifikatini sertifikat markazidan oling. Uni veb-serverga o'rnating.

# SSL/TLS uchun Nginx konfiguratsiya misoli
server {
    listen 443 ssl;
    server_name your_domain.com;

    ssl_certificate /etc/nginx/ssl/your_domain.crt;
    ssl_certificate_key /etc/nginx/ssl/your_domain.key;

    # ... boshqa sozlamalar
}

Veb-serverni sozlash: Veb-serverni (Apache, Nginx, Tomcat va boshqalar) 443 portidan foydalanishga va SSL/TLS ni yoqishga sozlang.

Ruxsat etilgan shifrlash algoritmlari ro'yxatini tartibga solish (Cipher Suites): Eskirgan va xavfsiz bo'lmagan shifrlashlarni o'chiring, faqat kuchli va zamonaviylarni qoldiring.

# Apache uchun Cipher Suites konfiguratsiya misoli
SSLProtocol All -SSLv2 -SSLv3
SSLCipherSuite ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:DH+AESGCM:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 # Kuchli shifrlashlar misoli
SSLHonorCipherOrder on

HSTS (HTTP Strict Transport Security) ni yoqish: Brauzerda HTTPS ni majburiy qilish, HTTP ulanishlarini oldini olish.

# HSTS uchun Nginx konfiguratsiya misoli
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";

HTTP dan HTTPS ga yo'naltirish: Barcha so'rovlarni avtomatik ravishda HTTP dan HTTPS ga yo'naltirish.

# Apache uchun HTTP dan HTTPS ga yo'naltirish misoli
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

SSL/TLS kutubxonalarini va sertifikatlarni muntazam yangilash: Yangi versiyalarni ta'minlash va sertifikatlarni o'z vaqtida yangilash.
Zamonaviy TLS versiyalaridan foydalanish: Serverni TLS 1.2 yoki TLS 1.3 ni ishlatishga sozlang, eski va zaif versiyalarni (SSLv2, SSLv3, TLS 1.0, TLS 1.1) o'chiring.

Ushbu chora-tadbirlar ma'lumotlarni shifrlash va serverni autentifikatsiya qilishni transport darajasida birgalikda ta'minlaydi.

Veb-ilovamiz uchun transport qatlamining xavfsizligini qanday ta'minlashimiz mumkin?