{"id":30479,"date":"2026-10-07T05:49:43","date_gmt":"2026-10-07T05:49:43","guid":{"rendered":"https:\/\/umang.pk\/2026\/10\/07\/api-%da%a9%db%8c-%da%a9%d9%85%d8%b2%d9%88%d8%b1%db%8c%d9%88%da%ba-%da%a9%d8%a7-%d8%a7%d9%86%d8%ac%db%8c%d9%86%d8%a6%d8%b1%d9%86%da%af-%d8%aa%d8%ac%d8%b2%db%8c%db%81-owasp-api-%d8%b3%db%8c%da%a9%d9%88\/"},"modified":"2026-10-07T05:49:43","modified_gmt":"2026-10-07T05:49:43","slug":"api-%da%a9%db%8c-%da%a9%d9%85%d8%b2%d9%88%d8%b1%db%8c%d9%88%da%ba-%da%a9%d8%a7-%d8%a7%d9%86%d8%ac%db%8c%d9%86%d8%a6%d8%b1%d9%86%da%af-%d8%aa%d8%ac%d8%b2%db%8c%db%81-owasp-api-%d8%b3%db%8c%da%a9%d9%88","status":"publish","type":"post","link":"https:\/\/umang.pk\/en_us\/2026\/10\/07\/api-%da%a9%db%8c-%da%a9%d9%85%d8%b2%d9%88%d8%b1%db%8c%d9%88%da%ba-%da%a9%d8%a7-%d8%a7%d9%86%d8%ac%db%8c%d9%86%d8%a6%d8%b1%d9%86%da%af-%d8%aa%d8%ac%d8%b2%db%8c%db%81-owasp-api-%d8%b3%db%8c%da%a9%d9%88\/","title":{"rendered":"API \u06a9\u06cc \u06a9\u0645\u0632\u0648\u0631\u06cc\u0648\u06ba \u06a9\u0627 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u062a\u062c\u0632\u06cc\u06c1: OWASP API \u0633\u06cc\u06a9\u0648\u0631\u0679\u06cc \u0679\u0627\u067e 10 \u0645\u06cc\u06ba \u06af\u06c1\u0631\u0627 \u063a\u0648\u0637\u06c1"},"content":{"rendered":"\n<div id=\"\">\n<p>\u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0645\u0636\u0627\u0645\u06cc\u0646 \u062e\u0637\u0631\u06d2 \u06a9\u06cc \u0631\u067e\u0648\u0631\u0679\u0648\u06ba \u06a9\u06cc \u0637\u0631\u062d \u067e\u0691\u06be\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06cc\u06c1 \u0628\u0627\u06c1\u0631 \u0633\u06d2 \u0627\u0646\u062f\u0631 \u062f\u06cc\u06a9\u06be \u06a9\u0631 \u06a9\u0645\u0632\u0648\u0631\u06cc\u0648\u06ba \u06a9\u06cc \u0648\u0636\u0627\u062d\u062a \u06a9\u0631\u062a\u0627 \u06c1\u06d2: \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u06a9\u06cc\u0627 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0627\u0633 \u06a9\u0627 \u06a9\u06cc\u0627 \u0627\u062b\u0631 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0639\u0627\u0644\u0645\u06cc \u0633\u0637\u062d \u067e\u0631 \u06a9\u062a\u0646\u06d2 \u0646\u0638\u0627\u0645 \u0645\u062a\u0627\u062b\u0631 \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06cc\u06c1 \u0645\u0641\u06cc\u062f \u0633\u06cc\u0627\u0642 \u0648 \u0633\u0628\u0627\u0642 \u06c1\u06d2\u060c \u0644\u06cc\u06a9\u0646 \u06cc\u06c1 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0632 \u06a9\u0648 \u0628\u06c1\u062a\u0631 \u0646\u0638\u0627\u0645 \u0628\u0646\u0627\u0646\u06d2 \u0645\u06cc\u06ba \u0645\u062f\u062f \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u06cc\u06c1 \u0645\u0636\u0645\u0648\u0646 \u0645\u062e\u062a\u0644\u0641 \u06c1\u06d2\u06d4 \u06c1\u0631 \u0627\u06cc\u06a9 OWASP API \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u06a9\u06cc \u0679\u0627\u067e 10 \u06a9\u0645\u0632\u0648\u0631\u06cc\u0648\u06ba \u067e\u0631 \u0627\u06cc\u06a9 \u0627\u0646\u062f\u0631\u0648\u0646\u06cc \u0646\u0638\u0631\u06d4 \u06cc\u0639\u0646\u06cc\u060c \u06c1\u0645 \u062f\u06cc\u06a9\u06be\u062a\u06d2 \u06c1\u06cc\u06ba \u06a9\u06c1 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06d2 \u06a9\u0646 \u0641\u06cc\u0635\u0644\u0648\u06ba \u0633\u06d2 \u06a9\u0645\u0632\u0648\u0631\u06cc \u06a9\u06d2 \u0648\u062c\u0648\u062f \u0645\u06cc\u06ba \u0622\u06cc\u0627\u060c \u06a9\u0646 \u062a\u0639\u0645\u06cc\u0631\u0627\u062a\u06cc \u0627\u0635\u0648\u0644\u0648\u06ba \u06a9\u06cc \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc \u06c1\u0648\u0626\u06cc\u060c \u0627\u0648\u0631 \u0627\u0633 \u062e\u0637\u0631\u06d2 \u06a9\u0648 \u067e\u06cc\u062f\u0627\u0648\u0627\u0631 \u0645\u06cc\u06ba \u062c\u0627\u0631\u06cc \u06c1\u0648\u0646\u06d2 \u0633\u06d2 \u0631\u0648\u06a9\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06d2 \u06a9\u0648\u0646 \u0633\u06d2 \u0645\u0639\u06cc\u0627\u0631\u0627\u062a \u0645\u0648\u062c\u0648\u062f \u062a\u06be\u06d2\u06d4<\/p>\n<p>\u0645\u06cc\u06ba \u0646\u06d2 \u0631\u06cc\u06af\u0648\u0644\u06cc\u0679\u0688 \u0645\u0627\u0644\u06cc\u0627\u062a\u06cc \u0645\u0627\u062d\u0648\u0644 \u0645\u06cc\u06ba \u0628\u0691\u06d2 \u067e\u06cc\u0645\u0627\u0646\u06d2 \u067e\u0631 \u067e\u0631\u0648\u0688\u06a9\u0634\u0646 \u0627\u06cc\u067e\u0644\u06cc \u06a9\u06cc\u0634\u0646\u0632 \u0628\u0646\u0627\u0646\u06d2 \u0645\u06cc\u06ba \u06a9\u0626\u06cc \u0633\u0627\u0644 \u06af\u0632\u0627\u0631\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0627\u0633 \u0641\u06c1\u0631\u0633\u062a \u0645\u06cc\u06ba \u0645\u0648\u062c\u0648\u062f \u06a9\u0645\u0632\u0648\u0631\u06cc\u0627\u06ba \u0646\u0638\u0631\u06cc\u0627\u062a\u06cc \u0646\u06c1\u06cc\u06ba \u06c1\u06cc\u06ba\u06d4 \u0645\u06cc\u06ba \u0646\u06d2 \u0627\u0646 \u0645\u06cc\u06ba \u0633\u06d2 \u0628\u06cc\u0634\u062a\u0631 \u06a9\u0648 \u062d\u0642\u06cc\u0642\u06cc \u0646\u0638\u0627\u0645\u0648\u06ba \u0645\u06cc\u06ba \u062f\u06cc\u06a9\u06be\u0627 \u06c1\u06d2\u06d4 \u0627\u0646 \u0645\u06cc\u06ba \u0633\u06d2 \u06a9\u0686\u06be \u06a9\u0648 \u067e\u06cc\u0634 \u06c1\u0648\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u06c1\u06cc \u067e\u06a9\u0691 \u0644\u06cc\u0627 \u06af\u06cc\u0627\u06d4 \u062c\u0628 \u0645\u06cc\u06ba \u067e\u06c1\u0646\u0686\u0627 \u062a\u0648 \u0627\u0646 \u0645\u06cc\u06ba \u0633\u06d2 \u06a9\u0686\u06be \u067e\u06c1\u0644\u06d2 \u06c1\u06cc \u0632\u0646\u062f\u06c1 \u062a\u06be\u06d2\u06d4 \u0627\u0646 \u0645\u06cc\u06ba \u0633\u06d2 \u06c1\u0631 \u0627\u06cc\u06a9 \u06a9\u0648 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u0688\u0633\u067e\u0644\u0646 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0631\u0648\u06a9\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627 \u062a\u06be\u0627\u060c \u0633\u06cc\u06a9\u0648\u0631\u0679\u06cc \u0679\u0648\u0644\u0632 \u0633\u06d2 \u0646\u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u06cc\u06c1 \u0627\u0633 \u0645\u0636\u0645\u0648\u0646 \u0645\u06cc\u06ba \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u0634\u062f\u06c1 \u0639\u06cc\u0646\u06a9 \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-table-of-contents\">\u0627\u0646\u0688\u06cc\u06a9\u0633<\/h2>\n<h2 id=\"heading-prerequisites\">\u0634\u0631\u0637\u06cc\u06ba<\/h2>\n<p>\u0627\u0633 \u0645\u0636\u0645\u0648\u0646 \u06a9\u0648 \u067e\u0691\u06be\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2\u060c \u0622\u067e \u06a9\u0648 \u062f\u0631\u062c \u0630\u06cc\u0644 \u0633\u06d2 \u0648\u0627\u0642\u0641 \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2:<\/p>\n<ul>\n<li>\n<p>\u06a9\u0633\u06cc \u0628\u06be\u06cc \u0632\u0628\u0627\u0646 \u06cc\u0627 \u0641\u0631\u06cc\u0645 \u0648\u0631\u06a9 \u0645\u06cc\u06ba APIs \u0628\u0646\u0627\u0626\u06cc\u06ba<\/p>\n<\/li>\n<li>\n<p>\u062a\u0635\u062f\u06cc\u0642 \u06a9\u06cc \u0628\u0646\u06cc\u0627\u062f\u06cc \u062a\u0641\u06c1\u06cc\u0645: \u0679\u0648\u06a9\u0646 \u0627\u0648\u0631 \u0633\u06cc\u0634\u0646\u0632 \u06a9\u06cc\u0627 \u06c1\u06cc\u06ba\u061f<\/p>\n<\/li>\n<li>\n<p>\u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u06a9\u0627 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u0627\u0639\u0644\u06cc \u0633\u0637\u062d \u067e\u0631 \u06a9\u06cc\u0633\u0627 \u0644\u06af\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0639\u0627\u0645 \u0633\u0627\u0641\u0679 \u0648\u06cc\u0626\u0631 \u0622\u0631\u06a9\u06cc\u0679\u06cc\u06a9\u0686\u0631 \u06a9\u06d2 \u062a\u0635\u0648\u0631\u0627\u062a \u062c\u06cc\u0633\u06d2 \u067e\u0631\u062a\u06cc\u06ba\u060c \u062e\u062f\u0645\u0627\u062a \u0627\u0648\u0631 \u06af\u06cc\u0679 \u0648\u06cc\u0632<\/p>\n<\/li>\n<\/ul>\n<p>\u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u06a9\u06d2 \u067e\u0633 \u0645\u0646\u0638\u0631 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0645\u0636\u0645\u0648\u0646 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u062a\u062c\u0632\u06cc\u06c1 \u06a9\u0627\u0631 \u06a9\u06d2 \u0646\u0642\u0637\u06c1 \u0646\u0638\u0631 \u06a9\u06d2 \u0628\u062c\u0627\u0626\u06d2 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06d2 \u0646\u0642\u0637\u06c1 \u0646\u0638\u0631 \u0633\u06d2 \u062a\u0645\u0627\u0645 \u062e\u0637\u0631\u0627\u062a \u06a9\u0648 \u0628\u06cc\u0627\u0646 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-what-is-the-owasp-api-security-top-10\">OWASP API \u0633\u06cc\u06a9\u0648\u0631\u0679\u06cc \u0679\u0627\u067e 10 \u06a9\u06cc\u0627 \u06c1\u06cc\u06ba\u061f<\/h2>\n<p>OWASP \u06a9\u0627 \u0645\u0637\u0644\u0628 \u06c1\u06d2 \u0627\u0648\u067e\u0646 \u0648\u06cc\u0628 \u0627\u06cc\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u067e\u0631\u0648\u062c\u06cc\u06a9\u0679\u06d4 \u0627\u06cc\u06a9 \u063a\u06cc\u0631 \u0645\u0646\u0627\u0641\u0639 \u0628\u062e\u0634 \u0641\u0627\u0624\u0646\u0688\u06cc\u0634\u0646 \u062c\u0648 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0632 \u0627\u0648\u0631 \u062a\u0646\u0638\u06cc\u0645\u0648\u06ba \u06a9\u06d2 \u0644\u06cc\u06d2 \u0622\u0632\u0627\u062f\u0627\u0646\u06c1 \u0637\u0648\u0631 \u067e\u0631 \u062f\u0633\u062a\u06cc\u0627\u0628 \u062d\u0641\u0627\u0638\u062a\u06cc \u0631\u06c1\u0646\u0645\u0627\u0626\u06cc \u062a\u06cc\u0627\u0631 \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u06d4 OWASP API \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0679\u0627\u067e 10 \u062f\u0646\u06cc\u0627 \u0628\u06be\u0631 \u06a9\u06d2 \u067e\u0631\u0648\u0688\u06a9\u0634\u0646 \u0633\u0633\u0679\u0645\u0632 \u0645\u06cc\u06ba \u067e\u0627\u0626\u06cc \u062c\u0627\u0646\u06d2 \u0648\u0627\u0644\u06cc \u0627\u0646\u062a\u06c1\u0627\u0626\u06cc \u0627\u06c1\u0645 API \u06a9\u0645\u0632\u0648\u0631\u06cc\u0648\u06ba \u06a9\u06cc \u0628\u0627\u0642\u0627\u0639\u062f\u06af\u06cc \u0633\u06d2 \u0627\u067e \u0688\u06cc\u0679 \u06a9\u0631\u062f\u06c1 \u0641\u06c1\u0631\u0633\u062a \u06c1\u06d2\u06d4<\/p>\n<p>\u06cc\u06c1 \u06a9\u0648\u0626\u06cc \u0646\u0638\u0631\u06cc\u0627\u062a\u06cc \u0641\u06c1\u0631\u0633\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u06cc\u06c1 \u062d\u0642\u06cc\u0642\u06cc \u062d\u0641\u0627\u0638\u062a\u06cc \u0648\u0627\u0642\u0639\u0627\u062a\u060c \u062f\u062e\u0648\u0644 \u06a9\u06cc \u062c\u0627\u0646\u0686 \u06a9\u06d2 \u0646\u062a\u0627\u0626\u062c\u060c \u0627\u0648\u0631 \u0635\u0646\u0639\u062a\u0648\u06ba \u06a9\u06d2 \u067e\u0631\u0648\u0688\u06a9\u0634\u0646 \u0633\u0633\u0679\u0645\u0632 \u0633\u06d2 \u062c\u0645\u0639 \u06a9\u0631\u062f\u06c1 \u062e\u0637\u0631\u06d2 \u06a9\u06cc \u0631\u067e\u0648\u0631\u0679\u0633 \u067e\u0631 \u0645\u0628\u0646\u06cc \u06c1\u06d2\u06d4 \u0627\u0633 \u0641\u06c1\u0631\u0633\u062a \u0645\u06cc\u06ba \u0645\u0648\u062c\u0648\u062f \u06c1\u0631 \u0622\u0626\u0679\u0645 \u06a9\u06d2 \u0646\u062a\u06cc\u062c\u06d2 \u0645\u06cc\u06ba \u062d\u0642\u06cc\u0642\u06cc \u0627\u0639\u062f\u0627\u062f \u0648 \u0634\u0645\u0627\u0631 \u06a9\u06cc \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc\u0627\u06ba\u060c \u062d\u0642\u06cc\u0642\u06cc \u0645\u0627\u0644\u06cc \u0646\u0642\u0635\u0627\u0646\u0627\u062a\u060c \u0627\u0648\u0631 \u062d\u0642\u06cc\u0642\u06cc \u062a\u0646\u0638\u06cc\u0645\u0648\u06ba \u0645\u06cc\u06ba \u062d\u0642\u06cc\u0642\u06cc \u0631\u06cc\u06af\u0648\u0644\u06cc\u0679\u0631\u06cc \u062c\u0631\u0645\u0627\u0646\u06d2 \u06c1\u0648\u0626\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>APIs \u0628\u0646\u0627\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0632 \u06a9\u06d2 \u0644\u06cc\u06d2\u060c \u0627\u0633 \u0641\u06c1\u0631\u0633\u062a \u06a9\u0648 \u0633\u0645\u062c\u06be\u0646\u0627 \u0627\u062e\u062a\u06cc\u0627\u0631\u06cc \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0628\u0646\u06cc\u0627\u062f\u06cc \u0639\u0644\u0645 \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-1-broken-object-level-authorization-bola\">1. BOLA (\u0628\u0631\u0648\u06a9\u0646 \u0622\u0628\u062c\u06cc\u06a9\u0679 \u0644\u06cc\u0648\u0644 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a)<\/h2>\n<h3 id=\"heading-what-it-is\">\u06cc\u06c1 \u06a9\u06cc\u0627 \u06c1\u06d2<\/h3>\n<p>\u0635\u0627\u0631\u0641 \u06a9\u06cc \u062a\u0648\u062b\u06cc\u0642 \u06a9\u06cc \u06af\u0626\u06cc \u06c1\u06d2 \u0627\u0648\u0631 \u0627\u0633 \u06a9\u06d2 \u067e\u0627\u0633 \u0627\u06cc\u06a9 \u062f\u0631\u0633\u062a \u0679\u0648\u06a9\u0646 \u06c1\u06d2\u06d4 \u062a\u0627\u06c1\u0645\u060c \u0622\u067e \u0627\u067e\u0646\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0645\u06cc\u06ba \u0634\u0646\u0627\u062e\u062a \u06a9\u0646\u0646\u062f\u06c1 \u06a9\u0648 \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0631\u06a9\u06d2 \u0627\u0633 \u0688\u06cc\u0679\u0627 \u062a\u06a9 \u0631\u0633\u0627\u0626\u06cc \u062d\u0627\u0635\u0644 \u06a9\u0631\u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0648 \u0622\u067e \u06a9\u06d2 \u067e\u0627\u0633 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-plaintext\">GET \/api\/accounts\/12345\/transactions\n<\/code><\/pre>\n<p>\u0635\u0627\u0631\u0641 A \u062a\u0635\u062f\u06cc\u0642 \u0634\u062f\u06c1 \u06c1\u06d2 \u0627\u0648\u0631 \u0627\u06a9\u0627\u0624\u0646\u0679 12345 \u06a9\u0627 \u0645\u0627\u0644\u06a9 \u06c1\u06d2\u06d4 \u0648\u06c1 \u0627\u06a9\u0627\u0624\u0646\u0679 \u0646\u0645\u0628\u0631 \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-plaintext\">GET \/api\/accounts\/99999\/transactions\n<\/code><\/pre>\n<p>\u0627\u06cc\u06a9 BOLA \u0645\u0648\u062c\u0648\u062f \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u062c\u0628 API \u0635\u0627\u0631\u0641 B \u0633\u06d2 \u06a9\u0648\u0626\u06cc \u0644\u06cc\u0646 \u062f\u06cc\u0646 \u0648\u0627\u067e\u0633 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0635\u0627\u0631\u0641 \u06a9\u06cc \u062a\u0648\u062b\u06cc\u0642 \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u060c \u0644\u06cc\u06a9\u0646 API \u0627\u0633 \u0628\u0627\u062a \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u062a\u0635\u062f\u06cc\u0642 \u0634\u062f\u06c1 \u0635\u0627\u0631\u0641 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0631\u062f\u06c1 \u0648\u0633\u0627\u0626\u0644 \u06a9\u0627 \u0645\u0627\u0644\u06a9 \u06c1\u06d2\u06d4<\/p>\n<p>\u06cc\u06c1 \u062f\u0646\u06cc\u0627 \u0645\u06cc\u06ba \u0633\u0628 \u0633\u06d2 \u0639\u0627\u0645 API \u06a9\u0627 \u062e\u0637\u0631\u06c1 \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0645\u0633\u0644\u0633\u0644 OWASP \u0641\u06c1\u0631\u0633\u062a\u0648\u06ba \u0645\u06cc\u06ba \u0633\u0631\u0641\u06c1\u0631\u0633\u062a \u06c1\u06d2 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u0627\u0633\u06d2 \u0627\u067e\u0646\u0627\u0646\u0627 \u0622\u0633\u0627\u0646 \u06c1\u06d2 \u0627\u0648\u0631 \u06a9\u0648\u0688 \u06a9\u06d2 \u062c\u0627\u0626\u0632\u0648\u06ba \u0645\u06cc\u06ba \u06cc\u0627\u062f \u06a9\u0631\u0646\u0627 \u0622\u0633\u0627\u0646 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-engineering-failure\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06cc \u0646\u0627\u06a9\u0627\u0645\u06cc<\/h3>\n<p>BOLA \u0627\u0633 \u0648\u0642\u062a \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u062c\u0628 \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0648 \u0628\u0627\u0626\u0646\u0631\u06cc \u0633\u0648\u0627\u0644 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u0633\u0645\u062c\u06be\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u06a9\u06cc\u0627 \u06cc\u06c1 \u0635\u0627\u0631\u0641 \u0645\u0633\u062a\u0646\u062f \u06c1\u06d2\u061f \u06c1\u0627\u06ba \u06cc\u0627 \u0646\u06c1\u06cc\u06ba\u061f API \u0686\u06cc\u06a9 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0622\u06cc\u0627 \u0635\u0627\u0631\u0641 \u06a9\u06d2 \u067e\u0627\u0633 \u062f\u0631\u0633\u062a \u0679\u0648\u06a9\u0646 \u06c1\u06d2 \u0627\u0648\u0631 \u0648\u06c1 \u0648\u06c1\u06cc\u06ba \u0631\u06a9 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u062f\u0648\u0633\u0631\u0627 \u0633\u0648\u0627\u0644 \u06a9\u0628\u06be\u06cc \u0646\u06c1\u06cc\u06ba \u067e\u0648\u0686\u06be\u0627 \u062c\u0627\u062a\u0627\u06d4 \u06a9\u06cc\u0627 \u062a\u0635\u062f\u06cc\u0642 \u0634\u062f\u06c1 \u0635\u0627\u0631\u0641 \u0627\u0633 \u0645\u062e\u0635\u0648\u0635 \u0648\u0633\u0627\u0626\u0644 \u06a9\u0627 \u0645\u0627\u0644\u06a9 \u06c1\u06d2 \u062c\u0633 \u06a9\u06cc \u0648\u06c1 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0631 \u0631\u06c1\u06d2 \u06c1\u06cc\u06ba\u061f<\/p>\n<p>\u062a\u0648\u062b\u06cc\u0642 \u0634\u0646\u0627\u062e\u062a \u06a9\u0627 \u0639\u0644\u0645 \u06c1\u06d2\u06d4 \u06cc\u06c1 \u062b\u0627\u0628\u062a \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0622\u067e \u06a9\u0648\u0646 \u06c1\u06cc\u06ba\u060c \u0644\u06cc\u06a9\u0646 \u06cc\u06c1 \u06a9\u0628\u06be\u06cc \u062b\u0627\u0628\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u0627 \u06a9\u06c1 \u0622\u067e \u062c\u0648 \u0645\u0627\u0646\u06af \u0631\u06c1\u06d2 \u06c1\u06cc\u06ba \u0648\u06c1 \u0622\u067e \u06a9\u0627 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-engineering-fix\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u0679\u06be\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba<\/h3>\n<p>\u0627\u062c\u0627\u0632\u062a \u0635\u0631\u0641 API \u06af\u06cc\u0679 \u0648\u06d2 \u067e\u0631 \u0646\u06c1\u06cc\u06ba \u0628\u0644\u06a9\u06c1 \u0633\u0631\u0648\u0633 \u0644\u06cc\u0626\u0631 \u067e\u0631 \u06c1\u0648\u0646\u06cc \u0686\u0627\u06c1\u06cc\u06d2\u06d4 API \u06af\u06cc\u0679 \u0648\u06d2 \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0631 \u0633\u06a9\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0679\u0648\u06a9\u0646 \u062f\u0631\u0633\u062a \u06c1\u06d2\u06d4 \u0635\u0631\u0641 \u0633\u0631\u0648\u0633 \u06a9\u06cc \u067e\u0631\u062a \u06c1\u06cc \u062c\u0627\u0646\u062a\u06cc \u06c1\u06d2 \u06a9\u06c1 \u0622\u06cc\u0627 \u062a\u0635\u062f\u06cc\u0642 \u0634\u062f\u06c1 \u0635\u0627\u0631\u0641 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u06cc\u06d2 \u062c\u0627\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u0648\u0633\u0627\u0626\u0644 \u06a9\u0627 \u0645\u0627\u0644\u06a9 \u06c1\u06d2\u06d4<\/p>\n<p><strong>\u0688\u0627\u0631\u0679 (\u0633\u0631\u0648\u0633 \u0644\u06cc\u0626\u0631 \u06a9\u06d2 \u0633\u0627\u062a\u06be):<\/strong><\/p>\n<pre><code class=\"language-dart\">class TransactionService {\n  final TransactionRepository _repository;\n  final AuthContext _authContext;\n\n  TransactionService(this._repository, this._authContext);\n\n  Future<result>, AppException>> getTransactions(\n    String accountId,\n  ) async {\n    final currentUserId = _authContext.currentUserId;\n\n    \/\/ fetch the account first\n    final account = await _repository.findAccountById(accountId);\n\n    if (account == null) {\n      return Result.failure(AppException.notFound('Account not found'));\n    }\n\n    \/\/ verify ownership before returning any data\n    if (account.ownerId != currentUserId) {\n      return Result.failure(\n        AppException.forbidden('Access denied to this account'),\n      );\n    }\n\n    final transactions = await _repository.findByAccountId(accountId);\n    return Result.success(transactions);\n  }\n}\n<\/result><\/code><\/pre>\n<p><strong>aspirate#:<\/strong><\/p>\n<pre><code class=\"language-csharp\">public async Task<result>>> GetTransactions(\n    string accountId,\n    ClaimsPrincipal currentUser)\n{\n    var userId = currentUser.FindFirst(ClaimTypes.NameIdentifier)?.Value;\n    var account = await _repository.FindAccountByIdAsync(accountId);\n\n    if (account == null)\n        return Result.Failure<ienumerable>>(\"Account not found\");\n\n    \/\/ ownership check \u2014 never skip this\n    if (account.OwnerId != userId)\n        return Result.Failure<ienumerable>>(\"Access denied\");\n\n    var transactions = await _repository.FindByAccountIdAsync(accountId);\n    return Result.Success(transactions);\n}\n<\/ienumerable><\/ienumerable><\/result><\/code><\/pre>\n<p>\u06a9\u0633\u06cc \u0645\u062e\u0635\u0648\u0635 \u0648\u0633\u0627\u0626\u0644 \u062a\u06a9 \u0631\u0633\u0627\u0626\u06cc \u06a9\u06cc \u06c1\u0631 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u067e\u0631 \u0645\u0644\u06a9\u06cc\u062a \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06c1\u0648\u0646\u06cc \u0686\u0627\u06c1\u06cc\u06d2\u06d4 \u06cc\u06c1 \u0635\u0631\u0641 \u067e\u06c1\u0644\u06d2 \u0644\u0648\u0688 \u06cc\u0627 \u062a\u062d\u0631\u06cc\u0631\u06cc \u0622\u067e\u0631\u06cc\u0634\u0646 \u067e\u0631 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 \u06c1\u0631 \u0627\u06cc\u06a9 \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u06d4<\/p>\n<h2 id=\"heading-2-broken-authentication\">2. \u062a\u0635\u062f\u06cc\u0642 \u06a9\u06cc \u0646\u0627\u06a9\u0627\u0645\u06cc\u06d4<\/h2>\n<h3 id=\"heading-what-it-is\">\u06cc\u06c1 \u06a9\u06cc\u0627 \u06c1\u06d2<\/h3>\n<p>\u06a9\u0645\u0632\u0648\u0631 \u0679\u0648\u06a9\u0646\u060c \u06a9\u0648\u0626\u06cc \u0679\u0648\u06a9\u0646 \u0645\u06cc\u0639\u0627\u062f \u062e\u062a\u0645 \u0646\u06c1\u06cc\u06ba\u060c \u062a\u0635\u062f\u06cc\u0642 \u06a9\u06d2 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0645\u0642\u0627\u0645\u0627\u062a \u067e\u0631 \u06a9\u0648\u0626\u06cc \u0634\u0631\u062d \u0645\u062d\u062f\u0648\u062f \u0646\u06c1\u06cc\u06ba\u060c \u06cc\u0627 \u0627\u06cc\u0633\u06d2 \u0633\u06cc\u0634\u0646 \u062c\u0648 \u0644\u0627\u06af \u0622\u0624\u0679 \u067e\u0631 \u06a9\u0628\u06be\u06cc \u062e\u062a\u0645 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u06d2\u06d4 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0633 \u0646\u06d2 \u06a9\u06cc \u06c1\u06d2 \u0627\u0633 \u06a9\u06cc \u0634\u0646\u0627\u062e\u062a \u06a9\u06d2 \u0637\u0631\u06cc\u0642\u06c1 \u06a9\u0627\u0631 \u0645\u06cc\u06ba \u06cc\u06c1 \u0627\u06cc\u06a9 \u06a9\u0645\u0632\u0648\u0631\u06cc \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-engineering-failure\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06cc \u0646\u0627\u06a9\u0627\u0645\u06cc<\/h3>\n<p>\u0627\u06cc\u06a9 \u0628\u0627\u0631 \u062c\u0628 \u062a\u0648\u062b\u06cc\u0642 \u06a9\u0627\u0645 \u06a9\u0631 \u0631\u06c1\u06cc \u06c1\u06d2\u060c \u0645\u0633\u0626\u0644\u06c1 \u06a9\u0648 \u062d\u0644 \u0633\u0645\u062c\u06be\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631 \u0644\u0627\u06af \u0627\u0646 \u06a9\u0648 \u0644\u0627\u06af\u0648 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0679\u0648\u06a9\u0646 \u0648\u0627\u067e\u0633 \u0648\u0635\u0648\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u062c\u0627\u0631\u06cc \u0631\u06c1\u062a\u0627 \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0646\u0627\u06a9\u0627\u0645\u06cc \u06a9\u06d2 \u0637\u0631\u06cc\u0642\u0648\u06ba \u06a9\u06d2 \u0644\u06cc\u06d2 \u0688\u06cc\u0632\u0627\u0626\u0646 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2 (\u0645\u062b\u0627\u0644 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u0627\u06af\u0631 \u06a9\u0648\u0626\u06cc \u0679\u0648\u06a9\u0646 \u0686\u0648\u0631\u06cc \u06c1\u0648 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u060c \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u067e\u0627\u0633 \u0648\u0631\u0688 \u06a9\u06cc \u0641\u06c1\u0631\u0633\u062a \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0644\u0627\u06af \u0627\u0646 \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u06af\u0691\u0628\u0691 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u06cc\u0627 \u06a9\u0686\u06be \u0627\u06cc\u0633\u0627 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u062c\u0628 \u0635\u0627\u0631\u0641 \u0644\u0627\u06af \u0622\u0624\u0679 \u06c1\u0648\u062a\u0627 \u06c1\u06d2)\u06d4<\/p>\n<p>\u062a\u0648\u062b\u06cc\u0642 \u06a9\u06d2 \u0637\u0631\u06cc\u0642\u06c1 \u06a9\u0627\u0631 \u06a9\u0648 \u0645\u062e\u0627\u0644\u0641 \u062d\u0627\u0644\u0627\u062a \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0633\u0627\u062a\u06be \u062e\u0648\u0634\u06af\u0648\u0627\u0631 \u0631\u0627\u0633\u062a\u06d2 \u06a9\u06d2 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0688\u06cc\u0632\u0627\u0626\u0646 \u06a9\u06cc\u0627 \u062c\u0627\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-engineering-fix\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u0679\u06be\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba<\/h3>\n<p><strong>\u0679\u0648\u06a9\u0646 \u06a9\u06cc \u0645\u06cc\u0639\u0627\u062f \u062e\u062a\u0645 \u06c1\u0648\u0646\u06d2 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u06d4<\/strong> \u0631\u0633\u0627\u0626\u06cc \u06a9\u06d2 \u0679\u0648\u06a9\u0646 \u0642\u0644\u06cc\u0644 \u0627\u0644\u0645\u062f\u062a (15 \u0645\u0646\u0679 \u0633\u06d2 1 \u06af\u06be\u0646\u0679\u06c1) \u06c1\u0648\u0646\u06d2 \u0686\u0627\u06c1\u0626\u06cc\u06ba\u06d4 \u0631\u06cc\u0641\u0631\u06cc\u0634 \u0679\u0648\u06a9\u0646 \u0633\u06cc\u0634\u0646 \u06a9\u06d2 \u062a\u0633\u0644\u0633\u0644 \u06a9\u0648 \u0633\u0646\u0628\u06be\u0627\u0644\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0642\u0644\u06cc\u0644 \u0627\u0644\u0645\u062f\u062a \u0631\u0633\u0627\u0626\u06cc \u0679\u0648\u06a9\u0646 \u0679\u0648\u06a9\u0646 \u0686\u0648\u0631\u06cc \u06a9\u06cc \u0635\u0648\u0631\u062a \u0645\u06cc\u06ba \u0646\u0642\u0635\u0627\u0646 \u06a9\u06cc \u06a9\u06be\u0691\u06a9\u06cc \u06a9\u0648 \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p><strong>\u062a\u0635\u062f\u06cc\u0642 \u06a9\u06d2 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0646\u0642\u0637\u06c1 \u06a9\u06cc \u0634\u0631\u062d \u06a9\u0648 \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u0646\u0627 \u0636\u0631\u0648\u0631\u06cc \u06c1\u06d2\u06d4<\/strong> \u0631\u06cc\u0679 \u0645\u062d\u062f\u0648\u062f \u06a9\u06cc\u06d2 \u0628\u063a\u06cc\u0631 \u0644\u0627\u06af \u0627\u0646 \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679 \u0648\u062d\u0634\u06cc\u0627\u0646\u06c1 \u0637\u0627\u0642\u062a \u06a9\u06d2 \u062d\u0645\u0644\u0648\u06ba \u06a9\u06cc \u06a9\u06be\u0644\u06cc \u062f\u0639\u0648\u062a \u06c1\u06d2\u06d4 \u0627\u06cc\u06a9 \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 10 \u0645\u0644\u06cc\u0646 \u0627\u06cc \u0645\u06cc\u0644 \u0627\u0648\u0631 \u067e\u0627\u0633 \u0648\u0631\u0688 \u06a9\u06d2 \u0627\u0645\u062a\u0632\u0627\u062c \u06a9\u06cc \u0641\u06c1\u0631\u0633\u062a \u06a9\u06d2 \u0633\u0627\u062a\u06be \u06c1\u0631 \u0627\u0645\u062a\u0632\u0627\u062c \u06a9\u0648 \u0637\u0631\u06cc\u0642\u06c1 \u0633\u06d2 \u0622\u0632\u0645\u0627\u0626\u06d2 \u06af\u0627\u06d4<\/p>\n<p><strong>\u0633\u06cc\u0634\u0646 \u062f\u0631\u0627\u0635\u0644 \u0644\u0627\u06af \u0622\u0624\u0679 \u067e\u0631 \u062e\u062a\u0645 \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/strong> \u0627\u06af\u0631 \u0622\u067e \u0627\u0633\u0679\u06cc\u0679\u0641\u0648\u0644 \u0633\u06cc\u0634\u0646\u0632 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062a\u0648 \u0622\u067e \u06a9\u0648 \u0644\u0627\u06af \u0622\u0624\u0679 \u067e\u0631 \u0633\u0631\u0648\u0631 \u0633\u0627\u0626\u06cc\u0688 \u067e\u0631 \u0633\u06cc\u0634\u0646 \u06a9\u0648 \u0628\u0627\u0637\u0644 \u06a9\u0631\u0646\u0627 \u06c1\u0648\u06af\u0627\u06d4 \u0627\u06af\u0631 \u0622\u067e JWT \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u062a\u0648 \u06cc\u0627 \u062a\u0648 \u0679\u0648\u06a9\u0646 \u0628\u0644\u06cc\u06a9 \u0644\u0633\u0679 \u06a9\u0648 \u0628\u0631\u0642\u0631\u0627\u0631 \u0631\u06a9\u06be\u06cc\u06ba \u06cc\u0627 \u0631\u06cc\u0641\u0631\u06cc\u0634 \u0679\u0648\u06a9\u0646 \u0631\u0648\u0679\u06cc\u0634\u0646 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0627\u06cc\u06a9 \u0628\u06c1\u062a \u06c1\u06cc \u0645\u062e\u062a\u0635\u0631 \u0645\u062f\u062a \u062e\u062a\u0645 \u06c1\u0648\u0646\u06d2 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<p><strong>\u0688\u0627\u0631\u0679:<\/strong><\/p>\n<pre><code class=\"language-dart\">class AuthService {\n  final TokenRepository _tokenRepository;\n  final RateLimiter _rateLimiter;\n\n  AuthService(this._tokenRepository, this._rateLimiter);\n\n  Future<result appexception=\"\">> login(\n    String email,\n    String password,\n    String ipAddress,\n  ) async {\n    \/\/ rate limit by IP to prevent brute force\n    final isAllowed = await _rateLimiter.checkLimit(\n      key: 'login:$ipAddress',\n      maxAttempts: 5,\n      windowSeconds: 300,\n    );\n\n    if (!isAllowed) {\n      return Result.failure(\n        AppException.rateLimited('Too many login attempts. Try again later.'),\n      );\n    }\n\n    final user = await _validateCredentials(email, password);\n\n    if (user == null) {\n      return Result.failure(\n        AppException.unauthorized('Invalid credentials'),\n      );\n    }\n\n    \/\/ short-lived access token\n    final accessToken = _generateAccessToken(user, expiryMinutes: 15);\n\n    \/\/ longer-lived refresh token, stored server-side\n    final refreshToken = _generateRefreshToken(user);\n    await _tokenRepository.storeRefreshToken(user.id, refreshToken);\n\n    return Result.success(AuthTokens(\n      accessToken: accessToken,\n      refreshToken: refreshToken,\n    ));\n  }\n\n  Future<void> logout(String userId, String refreshToken) async {\n    \/\/ invalidate the refresh token server-side on logout\n    await _tokenRepository.revokeRefreshToken(userId, refreshToken);\n  }\n}\n<\/void><\/result><\/code><\/pre>\n<p><strong>aspirate#:<\/strong><\/p>\n<pre><code class=\"language-csharp\">public async Task<result>> Login(\n    LoginRequest request,\n    string ipAddress)\n{\n    var isAllowed = await _rateLimiter.CheckLimit(\n        key: $\"login:{ipAddress}\",\n        maxAttempts: 5,\n        windowSeconds: 300);\n\n    if (!isAllowed)\n        return Result.Failure<authtokens>(\"Too many login attempts.\");\n\n    var user = await _userService.ValidateCredentials(\n        request.Email,\n        request.Password);\n\n    if (user == null)\n        return Result.Failure<authtokens>(\"Invalid credentials\");\n\n    var accessToken = _tokenService.GenerateAccessToken(user, expiryMinutes: 15);\n    var refreshToken = _tokenService.GenerateRefreshToken(user);\n\n    await _tokenRepository.StoreRefreshToken(user.Id, refreshToken);\n\n    return Result.Success(new AuthTokens(accessToken, refreshToken));\n}\n\npublic async Task Logout(string userId, string refreshToken)\n{\n    await _tokenRepository.RevokeRefreshToken(userId, refreshToken);\n}\n<\/authtokens><\/authtokens><\/result><\/code><\/pre>\n<h2 id=\"heading-3-broken-object-property-level-authorization-bopla\">3. BOPLA (\u0628\u0631\u0648\u06a9\u0646 \u0622\u0628\u062c\u06cc\u06a9\u0679 \u067e\u0631\u0627\u067e\u0631\u0679\u06cc \u0644\u06cc\u0648\u0644 \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642)<\/h2>\n<h3 id=\"heading-what-it-is\">\u06cc\u06c1 \u06a9\u06cc\u0627 \u06c1\u06d2<\/h3>\n<p>API \u0635\u0627\u0631\u0641 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u0688\u06cc\u0679\u0627 \u0648\u0627\u067e\u0633 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u0646\u062f\u0631\u0648\u0646\u06cc \u062c\u06be\u0646\u0688\u06d2\u060c \u0645\u0646\u062a\u0638\u0645 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a\u06cc\u06ba\u060c \u0627\u0648\u0631 \u062d\u0633\u0627\u0633 \u0641\u06cc\u0644\u0688\u0632 \u062c\u0648 \u0633\u0631\u0648\u0631 \u06a9\u0648 \u06a9\u0628\u06be\u06cc \u0646\u06c1\u06cc\u06ba \u0686\u06be\u0648\u0691\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2 \u062c\u0648\u0627\u0628\u06cc \u067e\u06d2 \u0644\u0648\u0688 \u0645\u06cc\u06ba \u0634\u0627\u0645\u0644 \u06c1\u06cc\u06ba\u06d4 \u06cc\u0627 \u0627\u0633 \u0633\u06d2 \u0628\u06be\u06cc \u0628\u062f\u062a\u0631: API \u0635\u0627\u0631\u0641 \u06a9\u06cc \u0633\u06cc\u0679 \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u0688\u06cc\u0679\u0627 \u06a9\u0648 \u0642\u0628\u0648\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u062c\u0633 \u0633\u06d2 \u0635\u0627\u0631\u0641 \u06a9\u0648 \u0627\u0646 \u0641\u06cc\u0644\u0688\u0632 \u0645\u06cc\u06ba \u062a\u0631\u0645\u06cc\u0645 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u0645\u0644\u062a\u06cc \u06c1\u06d2 \u062c\u0646\u06c1\u06cc\u06ba \u0627\u0646\u06c1\u06cc\u06ba \u06a9\u0628\u06be\u06cc \u06c1\u0627\u062a\u06be \u0646\u06c1\u06cc\u06ba \u0644\u06af\u0627\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/p>\n<p>\u062c\u0628 \u06a9\u0648\u0626\u06cc \u0635\u0627\u0631\u0641 \u0627\u067e\u0646\u0627 \u067e\u0631\u0648\u0641\u0627\u0626\u0644 \u062f\u0631\u0622\u0645\u062f \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u062a\u0648 \u062c\u0648\u0627\u0628 \u0645\u06cc\u06ba \u0634\u0627\u0645\u0644 \u06c1\u0648\u062a\u0627 \u06c1\u06d2: <code>isAdmin: false<\/code>\u060c <code>internalAccountScore: 742<\/code>\u06cc\u0627 <code>fraudRiskLevel: \"low\"<\/code>. \u0627\u0646 \u0645\u06cc\u06ba \u0633\u06d2 \u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc \u0635\u0627\u0631\u0641 \u06a9\u06d2 \u062c\u0648\u0627\u0628 \u0645\u06cc\u06ba \u0645\u0648\u062c\u0648\u062f \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/p>\n<p>\u06cc\u0627\u060c \u062c\u0628 \u0635\u0627\u0631\u0641 \u0627\u067e\u0646\u06d2 \u067e\u0631\u0648\u0641\u0627\u0626\u0644 \u06a9\u0648 \u0627\u067e \u0688\u06cc\u0679 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u06d2 \u0628\u0627\u0688\u06cc \u0645\u06cc\u06ba \u0634\u0627\u0645\u0644 \u06c1\u06cc\u06ba: <code>\"role\": \"admin\"<\/code>. API \u0622\u067e \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0633\u06d2 \u06c1\u06cc\u0646\u0688\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u06cc\u06a9 \u0635\u0627\u0631\u0641 \u0646\u06d2 \u0627\u0628\u06be\u06cc \u062e\u0648\u062f \u06a9\u0648 \u0627\u06cc\u0688\u0645\u0646\u0633\u0679\u0631\u06cc\u0679\u0631 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u062a\u0631\u0642\u06cc \u062f\u06cc \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-engineering-failure\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06cc \u0646\u0627\u06a9\u0627\u0645\u06cc<\/h3>\n<p>\u06cc\u06c1 \u0627\u06cc\u06a9 \u0633\u0627\u062e\u062a\u06cc \u0645\u0633\u0626\u0644\u06c1 \u06c1\u06d2\u06d4 \u0627\u06cc\u0633\u0627 \u0627\u0633 \u0648\u0642\u062a \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u062c\u0628 \u0622\u067e \u062c\u0627\u0646 \u0628\u0648\u062c\u06be \u06a9\u0631 \u0688\u06cc\u0632\u0627\u0626\u0646 \u06a9\u0631\u062f\u06c1 \u0631\u0633\u067e\u0627\u0646\u0633 \u0627\u0633\u06a9\u06cc\u0645\u0627 \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u0633\u0633\u0679\u0645 \u0628\u0646\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06a9\u0686\u06be \u0688\u0648\u06cc\u0644\u067e\u0631\u0632 \u062e\u0627\u0645 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0627\u062f\u0627\u0631\u0648\u06ba \u06a9\u0648 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u0648\u0627\u067e\u0633 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u06cc\u06c1 \u0622\u0633\u0627\u0646 \u06c1\u06d2\u06d4 \u06a9\u0686\u06be \u06a9\u06d2 \u067e\u0627\u0633 \u0688\u06cc\u0679\u0627 \u0644\u06cc\u0626\u0631 \u06a9\u0648 \u0635\u062d\u06cc\u062d \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2 \u062a\u0631\u062a\u06cc\u0628 \u062f\u06cc\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0688\u0648\u0645\u06cc\u0646 \u06a9\u06cc \u0645\u0639\u0644\u0648\u0645\u0627\u062a \u06a9\u06cc \u06a9\u0645\u06cc \u06c1\u06d2\u06d4 \u0646\u062a\u06cc\u062c\u06d2 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631\u060c \u0627\u0646\u062f\u0631\u0648\u0646\u06cc \u0688\u06cc\u0679\u0627 \u062e\u0627\u0631\u062c\u06cc \u0631\u062f\u0639\u0645\u0644 \u0645\u06cc\u06ba \u0644\u06cc\u06a9 \u06c1\u0648 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u06cc\u06c1 \u0627\u0646\u0679\u0631\u0641\u06cc\u0633 \u0639\u0644\u06cc\u062d\u062f\u06af\u06cc \u06a9\u06d2 \u0627\u0635\u0648\u0644 \u06a9\u06cc \u0628\u06be\u06cc \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc \u06c1\u06d2\u06d4 \u0631\u0633\u067e\u0627\u0646\u0633 \u0627\u0646\u0679\u0631\u0641\u06cc\u0633 \u0635\u0627\u0631\u0641\u06cc\u0646 \u06a9\u0648 \u0688\u06cc\u0679\u0627 \u062d\u0627\u0635\u0644 \u06a9\u0631\u0646\u06d2 \u067e\u0631 \u0645\u062c\u0628\u0648\u0631 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u062c\u0633 \u062a\u06a9 \u0627\u0646\u06c1\u06cc\u06ba \u06a9\u0628\u06be\u06cc \u0628\u06be\u06cc \u0631\u0633\u0627\u0626\u06cc \u062d\u0627\u0635\u0644 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u06af\u06cc\u06d4<\/p>\n<h3 id=\"heading-the-engineering-fix\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u0679\u06be\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba<\/h3>\n<p>\u06c1\u0631 API \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679 \u06a9\u0627 \u0627\u06cc\u06a9 \u0648\u0627\u0636\u062d\u060c \u062c\u0627\u0646 \u0628\u0648\u062c\u06be \u06a9\u0631 \u0688\u06cc\u0632\u0627\u0626\u0646 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u062c\u0648\u0627\u0628 DTO \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4 \u062c\u0648\u0627\u0628 \u0688\u06cc \u0679\u06cc \u0627\u0648 \u0645\u06cc\u06ba \u0635\u0631\u0641 \u0648\u06c1 \u0641\u06cc\u0644\u0688\u0632 \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0648 \u06a9\u0627\u0644 \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u06a9\u0648 \u0648\u0635\u0648\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u06d4 \u0688\u0648\u0645\u06cc\u0646 \u0627\u062f\u0627\u0631\u06d2 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u062c\u0648\u0627\u0628 \u0645\u06cc\u06ba \u0646\u06c1\u06cc\u06ba \u062c\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p><strong>\u0688\u0627\u0631\u0679:<\/strong><\/p>\n<pre><code class=\"language-dart\">\/\/Wrong returning the domain entity directly - exposes internal fields\nFuture<response> getProfile(Request request) async {\n  final user = await _userRepository.findById(userId);\n  return Response.ok(jsonEncode(user.toJson())); \/\/ exposes everything\n}\n\n\/\/ Correct : explicit response DTO \u2014 only what the caller should see\nclass UserProfileResponse {\n  final String id;\n  final String firstName;\n  final String lastName;\n  final String email;\n\n  const UserProfileResponse({\n    required this.id,\n    required this.firstName,\n    required this.lastName,\n    required this.email,\n  });\n\n  Map<string dynamic=\"\"> toJson() => {\n    'id': id,\n    'first_name': firstName,\n    'last_name': lastName,\n    'email': email,\n    \/\/ isAdmin, internalScore, fraudRiskLevel \u2014 never here\n  };\n}\n\nFuture<response> getProfile(Request request) async {\n  final user = await _userRepository.findById(userId);\n\n  final response = UserProfileResponse(\n    id: user.id,\n    firstName: user.firstName,\n    lastName: user.lastName,\n    email: user.email,\n  );\n\n  return Response.ok(jsonEncode(response.toJson()));\n}\n<\/response><\/string><\/response><\/code><\/pre>\n<p><strong>aspirate#:<\/strong><\/p>\n<pre><code class=\"language-csharp\">\/\/ Wrong = returning the domain model directly\npublic async Task<iactionresult> GetProfile(string userId)\n{\n    var user = await _repository.FindByIdAsync(userId);\n    return Ok(user); \n}\n\n\/\/ Correct explicit response DTO\npublic record UserProfileResponse(\n    string Id,\n    string FirstName,\n    string LastName,\n    string Email);\n\npublic async Task<iactionresult> GetProfile(string userId)\n{\n    var user = await _repository.FindByIdAsync(userId);\n\n    var response = new UserProfileResponse(\n        user.Id,\n        user.FirstName,\n        user.LastName,\n        user.Email\n        \/\/ IsAdmin, InternalScore, FraudRiskLevel \u2014 never exposed\n    );\n\n    return Ok(response);\n}\n<\/iactionresult><\/iactionresult><\/code><\/pre>\n<p>\u0622\u0646\u06d2 \u0648\u0627\u0644\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u0648\u06ba \u06a9\u06d2 \u0644\u06cc\u06d2\u060c \u0627\u06cc\u06a9 \u062f\u0631\u062e\u0648\u0627\u0633\u062a DTO \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba \u062c\u0648 \u0635\u0631\u0641 \u0627\u0646 \u0641\u06cc\u0644\u0688\u0632 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u062a\u06cc \u06c1\u06d2 \u062c\u0646 \u0645\u06cc\u06ba \u0635\u0627\u0631\u0641 \u06a9\u0648 \u062a\u0631\u0645\u06cc\u0645 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u06c1\u06d2\u06d4 \u0627\u067e\u0646\u06d2 \u0627\u067e \u0688\u06cc\u0679 \u06a9\u06cc \u06a9\u0627\u0631\u0631\u0648\u0627\u0626\u06cc\u0648\u06ba \u0645\u06cc\u06ba \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u0688\u0648\u0645\u06cc\u0646 \u0627\u062f\u0627\u0631\u0648\u06ba \u0633\u06d2 \u0645\u0646\u0633\u0644\u06a9 \u0646\u06c1 \u06c1\u0648\u06ba\u06d4<\/p>\n<h2 id=\"heading-4-unrestricted-resource-consumption\">4. \u0644\u0627\u0645\u062d\u062f\u0648\u062f \u0648\u0633\u0627\u0626\u0644 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/h2>\n<h3 id=\"heading-what-it-is\">\u06cc\u06c1 \u06a9\u06cc\u0627 \u06c1\u06d2<\/h3>\n<p>\u0631\u0641\u062a\u0627\u0631 \u06a9\u06cc \u06a9\u0648\u0626\u06cc \u062d\u062f \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u06a9\u0627\u0644 \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u062d\u0633\u0627\u0633 APIs \u06a9\u0648 \u06c1\u0631 \u0645\u0646\u0679 \u0645\u06cc\u06ba \u06c1\u0632\u0627\u0631\u0648\u06ba \u0628\u0627\u0631 \u0633\u06a9\u0631\u06cc\u067e\u0646\u06af\u060c \u0628\u0631\u0648\u0679 \u0641\u0648\u0631\u0633\u060c \u0633\u0631\u0648\u0633 \u0633\u06d2 \u0627\u0646\u06a9\u0627\u0631\u060c \u0648\u063a\u06cc\u0631\u06c1 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0627\u0633\u067e\u0627\u0645 \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 API \u062a\u0645\u0627\u0645 \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u0648\u06ba \u06a9\u0648 \u062a\u06be\u0631\u0648\u0679\u0644\u0646\u06af \u06cc\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u06cc \u062d\u062f \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u0642\u0628\u0648\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-engineering-failure\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06cc \u0646\u0627\u06a9\u0627\u0645\u06cc<\/h3>\n<p>\u0631\u0641\u062a\u0627\u0631 \u06a9\u06cc \u062d\u062f \u06cc\u0627 \u062a\u0648 \u0627\u062e\u062a\u06cc\u0627\u0631\u06cc \u06c1\u06d2 \u06cc\u0627 \u0645\u0633\u062a\u0642\u0628\u0644 \u06a9\u0627 \u0645\u0633\u0626\u0644\u06c1 \u0633\u0645\u062c\u06be\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0627\u0633 \u0648\u0642\u062a \u062a\u06a9 \u0645\u0644\u062a\u0648\u06cc \u06c1\u0648 \u062c\u0627\u062a\u0627 \u06c1\u06d2 \u062c\u0628 \u062a\u06a9 \u06a9\u06c1 &quot;\u062c\u0628 \u06c1\u0645\u06cc\u06ba \u062a\u0648\u0633\u06cc\u0639 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648&#8221; \u06cc\u0627 &quot;\u062c\u0628 \u06c1\u0645\u06cc\u06ba \u0628\u062f\u0633\u0644\u0648\u06a9\u06cc \u06a9\u0627 \u067e\u062a\u06c1 \u0686\u0644\u062a\u0627 \u06c1\u06d2\u06d4&#8221; \u062c\u0628 \u062a\u06a9 \u0632\u06cc\u0627\u062f\u062a\u06cc \u0646\u0638\u0631 \u0622\u062a\u06cc \u06c1\u06d2\u060c \u0646\u0642\u0635\u0627\u0646 \u06c1\u0648 \u0686\u06a9\u0627 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 \u0634\u0631\u062d \u06a9\u06cc \u062d\u062f \u06a9\u06d2 \u0628\u063a\u06cc\u0631\u060c \u0645\u0627\u0644\u06cc\u0627\u062a\u06cc API \u062f\u0631\u0633\u062a \u0627\u06a9\u0627\u0624\u0646\u0679 \u0646\u0645\u0628\u0631 \u062a\u0644\u0627\u0634 \u06a9\u0631\u0646\u06d2\u060c \u0642\u06cc\u0645\u062a\u0648\u06ba \u06a9\u06d2 \u0688\u06cc\u0679\u0627 \u06a9\u0648 \u06a9\u06be\u0631\u0686\u0646\u06d2\u060c \u06cc\u0627 \u0645\u062d\u0636 \u0645\u063a\u0644\u0648\u0628 \u0627\u0648\u0631 \u0646\u0627\u0642\u0627\u0628\u0644 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06c1\u0648\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0632\u0628\u0631\u062f\u0633\u062a \u062d\u0645\u0644\u06c1 \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h3 id=\"heading-the-engineering-fix\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u0679\u06be\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba<\/h3>\n<p>\u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u06d2 \u0633\u0631\u0648\u0633 \u0644\u06cc\u0626\u0631 \u062a\u06a9 \u067e\u06c1\u0646\u0686\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 API \u06af\u06cc\u0679 \u0648\u06d2 \u067e\u0631\u062a \u067e\u0631 \u0634\u0631\u062d \u06a9\u06cc \u062d\u062f \u0628\u0646\u062f\u06cc \u06a9\u0648 \u0644\u0627\u06af\u0648 \u06a9\u06cc\u0627 \u062c\u0627\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4 \u06cc\u06c1 \u0633\u0631\u0648\u0633 \u06a9\u06cc \u0630\u0645\u06c1 \u062f\u0627\u0631\u06cc \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u06af\u06cc\u0679 \u0648\u06d2 \u0627\u06cc\u06a9 \u062f\u0631\u0633\u062a \u0646\u0641\u0627\u0630 \u06a9\u0627 \u0646\u0642\u0637\u06c1 \u06c1\u06d2 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u06cc\u06c1 \u062a\u0645\u0627\u0645 \u062e\u062f\u0645\u0627\u062a \u06a9\u06d2 \u0644\u06cc\u06d2 \u0628\u06cc\u06a9 \u0648\u0642\u062a \u0627\u0633\u06d2 \u0633\u0646\u0628\u06be\u0627\u0644 \u0633\u06a9\u062a\u0627 \u06c1\u06d2 \u0628\u063a\u06cc\u0631 \u06c1\u0631 \u0633\u0631\u0648\u0633 \u06a9\u0648 \u0627\u0633\u06d2 \u062f\u0648\u0628\u0627\u0631\u06c1 \u0646\u0627\u0641\u0630 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u06d4<\/p>\n<p>\u0645\u062e\u062a\u0644\u0641 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0645\u0642\u0627\u0645\u0627\u062a \u06a9\u0648 \u0645\u062e\u062a\u0644\u0641 \u062d\u062f\u0648\u062f \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u06d4 \u062a\u0648\u062b\u06cc\u0642 \u06a9\u06d2 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0645\u0642\u0627\u0645\u0627\u062a \u06a9\u06d2 \u0644\u06cc\u06d2 \u0633\u062e\u062a \u062d\u062f\u0648\u062f \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u062a\u06cc \u06c1\u06d2 (\u0641\u06cc \u0622\u0626\u06cc \u067e\u06cc \u0645\u06cc\u06ba 5 \u0645\u0646\u0679 \u0645\u06cc\u06ba 5 \u06a9\u0648\u0634\u0634\u06cc\u06ba)\u06d4 \u067e\u0628\u0644\u06a9 \u0631\u06cc\u0688 \u067e\u0648\u0627\u0626\u0646\u0679\u0633 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0645\u0639\u0642\u0648\u0644 \u067e\u0627\u0628\u0646\u062f\u06cc\u0648\u06ba \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u06d4 \u062d\u0633\u0627\u0633 \u0648\u0633\u0627\u0626\u0644 \u067e\u0631 \u06a9\u0627\u0631\u0631\u0648\u0627\u0626\u06cc\u0648\u06ba \u06a9\u0648 \u0644\u06a9\u06be\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0633\u062e\u062a \u062d\u062f\u0648\u062f \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u06d4<\/p>\n<p><strong>\u0688\u0627\u0631\u0679 (\u0645\u0688\u0644 \u0648\u06cc\u0626\u0631 \u0627\u067e\u0631\u0648\u0686):<\/strong><\/p>\n<pre><code class=\"language-dart\">class RateLimitMiddleware {\n  final RateLimiter _limiter;\n\n  RateLimitMiddleware(this._limiter);\n\n  Handler call(Handler innerHandler) {\n    return (Request request) async {\n      final clientIp = request.headers['x-forwarded-for'] ?? 'unknown';\n      final endpoint = request.url.path;\n\n      final limit = _getLimitForEndpoint(endpoint);\n      final isAllowed = await _limiter.checkLimit(\n        key: '$clientIp:$endpoint',\n        maxRequests: limit.maxRequests,\n        windowSeconds: limit.windowSeconds,\n      );\n\n      if (!isAllowed) {\n        return Response(\n          429,\n          body: jsonEncode({'error': 'Rate limit exceeded'}),\n          headers: {'Retry-After': '60'},\n        );\n      }\n\n      return innerHandler(request);\n    };\n  }\n\n  RateLimit _getLimitForEndpoint(String path) {\n    if (path.contains('\/auth\/login')) {\n      return RateLimit(maxRequests: 5, windowSeconds: 300);\n    }\n    if (path.contains('\/transactions')) {\n      return RateLimit(maxRequests: 100, windowSeconds: 60);\n    }\n    return RateLimit(maxRequests: 1000, windowSeconds: 60);\n  }\n}\n<\/code><\/pre>\n<p><strong>aspirate#:<\/strong><\/p>\n<pre><code class=\"language-csharp\">\/\/ using AspNetCoreRateLimit\nbuilder.Services.AddRateLimiter(options =>\n{\n    options.AddFixedWindowLimiter(\"auth\", limiterOptions =>\n    {\n        limiterOptions.PermitLimit = 5;\n        limiterOptions.Window = TimeSpan.FromMinutes(5);\n        limiterOptions.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;\n        limiterOptions.QueueLimit = 0;\n    });\n\n    options.AddFixedWindowLimiter(\"standard\", limiterOptions =>\n    {\n        limiterOptions.PermitLimit = 100;\n        limiterOptions.Window = TimeSpan.FromMinutes(1);\n    });\n\n    options.RejectionStatusCode = 429;\n});\n\n\/\/ apply per controller\n[EnableRateLimiting(\"auth\")]\n[HttpPost(\"login\")]\npublic async Task<iactionresult> Login(LoginRequest request) { }\n\n[EnableRateLimiting(\"standard\")]\n[HttpGet(\"transactions\")]\npublic async Task<iactionresult> GetTransactions() { }\n<\/iactionresult><\/iactionresult><\/code><\/pre>\n<h2 id=\"heading-5-broken-function-level-authorization-bfla\">5. \u0679\u0648\u0679\u06d2 \u06c1\u0648\u0626\u06d2 \u0641\u0646\u06a9\u0634\u0646\u0644 \u0644\u06cc\u0648\u0644 \u06a9\u06cc \u062a\u0648\u062b\u06cc\u0642 (BFLA)<\/h2>\n<h3 id=\"heading-what-it-is\">\u06cc\u06c1 \u06a9\u06cc\u0627 \u06c1\u06d2<\/h3>\n<p>\u0628\u0627\u0642\u0627\u0639\u062f\u06c1 \u0635\u0627\u0631\u0641\u06cc\u0646 \u0627\u0646 \u062e\u0635\u0648\u0635\u06cc\u0627\u062a \u06cc\u0627 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0645\u0642\u0627\u0645\u0627\u062a \u062a\u06a9 \u0631\u0633\u0627\u0626\u06cc \u062d\u0627\u0635\u0644 \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0646 \u062a\u06a9 \u0635\u0631\u0641 \u0645\u0646\u062a\u0638\u0645\u06cc\u0646 \u06cc\u0627 \u0645\u0631\u0627\u0639\u0627\u062a \u06cc\u0627\u0641\u062a\u06c1 \u06a9\u0631\u062f\u0627\u0631 \u06c1\u06cc \u0631\u0633\u0627\u0626\u06cc \u062d\u0627\u0635\u0644 \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0641\u0631\u0646\u0679 \u0627\u06cc\u0646\u0688 \u0628\u0679\u0646 \u06a9\u0648 \u0686\u06be\u067e\u0627\u062a\u0627 \u06c1\u06d2\u060c \u0644\u06cc\u06a9\u0646 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0646\u0642\u0637\u06c1 \u0627\u0628 \u0628\u06be\u06cc \u06a9\u06be\u0644\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0628\u0627\u0642\u0627\u0639\u062f\u06c1 \u0635\u0627\u0631\u0641 \u0679\u0648\u06a9\u0646 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u0645\u06cc\u0646\u062c\u0645\u0646\u0679 \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679 \u06a9\u0648 \u06a9\u0627\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u06cc\u06c1 \u06a9\u0627\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u06a9\u06d2 \u067e\u0627\u0633 \u0627\u0628 \u0646\u0627\u0646 \u0627\u06cc\u0688\u0645\u0646\u0633\u0679\u0631\u06cc\u0679\u0631 \u0627\u06a9\u0627\u0624\u0646\u0679 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0627\u06cc\u0688\u0645\u0646\u0633\u0679\u0631\u06cc\u0679\u0631 \u06a9\u06cc \u0635\u0644\u0627\u062d\u06cc\u062a\u06cc\u06ba \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u0645\u0628\u06c1\u0645\u06cc\u062a \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0633\u0644\u0627\u0645\u062a\u06cc \u0633\u0644\u0627\u0645\u062a\u06cc \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 UI \u0633\u0637\u062d \u067e\u0631 \u0645\u0646\u0638\u0645 \u0648\u0633\u0627\u0626\u0644 \u06a9\u0648 \u0686\u06be\u067e\u0627\u0646\u0627 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u062c\u06cc\u0633\u0627 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-engineering-failure\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06cc \u0646\u0627\u06a9\u0627\u0645\u06cc<\/h3>\n<p>\u0631\u0648\u0644 \u067e\u0631 \u0645\u0628\u0646\u06cc \u0631\u0633\u0627\u0626\u06cc \u06a9\u0646\u0679\u0631\u0648\u0644 (RBAC) \u06a9\u0648 \u063a\u0644\u0637 \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2 \u0646\u0627\u0641\u0630 \u06cc\u0627 \u0644\u0627\u06af\u0648 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u06d4 \u0641\u0646\u06a9\u0634\u0646\u0644 \u0633\u0637\u062d \u067e\u0631 \u0627\u062c\u0627\u0632\u062a \u06a9\u06d2 \u0686\u06cc\u06a9 \u063a\u0627\u0626\u0628 \u06c1\u06cc\u06ba\u06d4 \u0627\u06af\u0631 \u0635\u0627\u0631\u0641 \u06a9\u0648 UI \u0645\u06cc\u06ba \u0627\u06cc\u0688\u0645\u0646 \u0628\u0679\u0646 \u0646\u0638\u0631 \u0646\u06c1\u06cc\u06ba \u0622\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 \u0645\u06cc\u06ba \u0641\u0631\u0636 \u06a9\u0631\u062a\u0627 \u06c1\u0648\u06ba \u06a9\u06c1 \u0648\u06c1 Admin API \u06a9\u0648 \u06a9\u0627\u0644 \u0646\u06c1\u06cc\u06ba \u06a9\u0631 \u0633\u06a9\u062a\u06d2\u06d4 \u06cc\u06c1 \u0642\u06cc\u0627\u0633 \u06c1\u0645\u06cc\u0634\u06c1 \u063a\u0644\u0637 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 \u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc \u0688\u0648\u06cc\u0644\u067e\u0631 \u0679\u0648\u0644 UI \u06a9\u0648 \u0645\u06a9\u0645\u0644 \u0637\u0648\u0631 \u067e\u0631 \u0646\u0638\u0631\u0627\u0646\u062f\u0627\u0632 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a API \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679 \u06a9\u0648 \u06a9\u0627\u0644 \u06a9\u0631 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-engineering-fix\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u0679\u06be\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba<\/h3>\n<p>\u06c1\u0631 \u0641\u0646\u06a9\u0634\u0646 \u06a9\u0648 \u0639\u0645\u0644 \u062f\u0631\u0622\u0645\u062f \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u06a9\u0627\u0644 \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u06a9\u06d2 \u06a9\u0631\u062f\u0627\u0631 \u06a9\u06cc \u062c\u0627\u0646\u0686 \u06a9\u0631\u0646\u06cc \u0686\u0627\u06c1\u06cc\u06d2\u06d4 \u06cc\u06c1 \u0686\u06cc\u06a9 \u0633\u0631\u0648\u0633 \u0644\u06cc\u0626\u0631 \u067e\u0631 \u06a9\u06cc\u0627 \u062c\u0627\u0646\u0627 \u0686\u0627\u06c1\u0626\u06d2 \u0646\u06c1 \u06a9\u06c1 \u0635\u0631\u0641 UI \u067e\u0631\u062a \u06cc\u0627 API \u06af\u06cc\u0679 \u0648\u06d2 \u067e\u0631\u06d4 \u06af\u06cc\u0679 \u0648\u06d2 \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0631 \u0633\u06a9\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0679\u0648\u06a9\u0646 \u062f\u0631\u0633\u062a \u06c1\u06d2\u06d4 \u0635\u0631\u0641 \u0633\u0631\u0648\u0633 \u067e\u0631\u062a \u06c1\u06cc \u062c\u0627\u0646\u062a\u06cc \u06c1\u06d2 \u06a9\u06c1 \u06c1\u0631 \u0645\u062e\u0635\u0648\u0635 \u06a9\u0627\u0645 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0648\u0646 \u0633\u06d2 \u06a9\u0631\u062f\u0627\u0631 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u06d4<\/p>\n<p><strong>\u0688\u0627\u0631\u0679:<\/strong><\/p>\n<pre><code class=\"language-dart\">class UserManagementService {\n  final AuthContext _authContext;\n  final UserRepository _repository;\n\n  UserManagementService(this._authContext, this._repository);\n\n  Future<result appexception=\"\">> deleteUser(String targetUserId) async {\n    final currentUser = _authContext.currentUser;\n\n    \/\/ role check - this must happen in the service layer\n    if (!currentUser.hasRole(UserRole.admin)) {\n      return Result.failure(\n        AppException.forbidden('Admin role required for this operation'),\n      );\n    }\n\n    await _repository.deleteUser(targetUserId);\n    return Result.success(null);\n  }\n\n  Future<result>, AppException>> getAllUsers() async {\n    final currentUser = _authContext.currentUser;\n\n    if (!currentUser.hasRole(UserRole.admin)) {\n      return Result.failure(\n        AppException.forbidden('Admin role required'),\n      );\n    }\n\n    final users = await _repository.findAll();\n    return Result.success(users);\n  }\n}\n<\/result><\/result><\/code><\/pre>\n<p><strong>aspirate#:<\/strong><\/p>\n<pre><code class=\"language-csharp\">[ApiController]\n[Route(\"api\/admin\/users\")]\n[Authorize]\npublic class UserManagementController : ControllerBase\n{\n    private readonly IUserManagementService _service;\n\n    [HttpDelete(\"{userId}\")]\n    [Authorize(Roles = \"Admin\")] \n    public async Task<iactionresult> DeleteUser(string userId)\n    {\n        await _service.DeleteUser(userId);\n        return NoContent();\n    }\n\n    [HttpGet]\n    [Authorize(Roles = \"Admin\")]\n    public async Task<iactionresult> GetAllUsers()\n    {\n        var users = await _service.GetAllUsers();\n        return Ok(users);\n    }\n}\n<\/iactionresult><\/iactionresult><\/code><\/pre>\n<p>C# \u0645\u06cc\u06ba \u067e\u0631\u0627\u067e\u0631\u0679\u06cc \u0644\u06cc\u0648\u0644 \u067e\u0631 \u0631\u0648\u0644 \u0686\u06cc\u06a9\u0646\u06af \u0627\u0648\u0631 \u0688\u0627\u0631\u0679 \u0645\u06cc\u06ba \u0633\u0631\u0648\u0633 \u0644\u06cc\u0626\u0631 \u067e\u0631 \u0648\u0627\u0636\u062d \u0631\u0648\u0644 \u06a9\u06cc \u062a\u0648\u062b\u06cc\u0642 \u062f\u0648\u0646\u0648\u06ba \u0627\u06cc\u06a9 \u06c1\u06cc \u0646\u062a\u06cc\u062c\u06c1 \u062d\u0627\u0635\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0627\u0633 \u06a9\u0627 \u0645\u0637\u0644\u0628 \u06c1\u06d2 \u06a9\u06c1 \u0686\u06cc\u06a9 \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u060c UI \u0645\u06cc\u06ba \u0646\u06c1\u06cc\u06ba\u060c \u0627\u0648\u0631 API \u0635\u0627\u0631\u0641 \u06a9\u06d2 \u0631\u0648\u06cc\u06d2 \u0645\u06cc\u06ba \u0646\u06c1\u06cc\u06ba\u06d4<\/p>\n<h2 id=\"heading-6-unrestricted-access-to-sensitive-business-flows\">6. \u062d\u0633\u0627\u0633 \u06a9\u0627\u0631\u0648\u0628\u0627\u0631\u06cc \u0628\u06c1\u0627\u0624 \u062a\u06a9 \u063a\u06cc\u0631 \u0645\u062d\u062f\u0648\u062f \u0631\u0633\u0627\u0626\u06cc<\/h2>\n<h3 id=\"heading-what-it-is\">\u06cc\u06c1 \u06a9\u06cc\u0627 \u06c1\u06d2<\/h3>\n<p>\u0628\u0646\u06cc\u0627\u062f\u06cc \u06a9\u0627\u0631\u0648\u0628\u0627\u0631\u06cc \u0645\u0646\u0637\u0642 \u062c\u0633 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0633\u062e\u062a \u06af\u0627\u0631\u0688\u0631\u06cc\u0644\u0632 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u062a\u06cc \u06c1\u06d2 \u0627\u0633 \u0645\u06cc\u06ba \u06af\u0627\u0631\u0688\u0631\u06cc\u0644\u0632 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0635\u0627\u0631\u0641\u06cc\u0646 \u06a9\u0627\u0631\u0648\u0628\u0627\u0631\u06cc \u0642\u0648\u0627\u0646\u06cc\u0646 \u06a9\u0648 \u0646\u0638\u0631\u0627\u0646\u062f\u0627\u0632 \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba \u0627\u0648\u0631 \u0628\u06c1\u0627\u0624 \u06a9\u0648 \u0645\u062a\u062d\u0631\u06a9 \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0646 \u06a9\u06cc \u0627\u0646 \u06a9\u06cc \u0635\u0648\u0631\u062a\u062d\u0627\u0644 \u0645\u06cc\u06ba \u06a9\u0628\u06be\u06cc \u0627\u062c\u0627\u0632\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u0646\u06cc \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/p>\n<p>\u0633\u06cc\u0644\u0632 \u0627\u06cc\u062c\u0646\u0679 \u06a9\u0648\u0631\u06cc\u062c \u0627\u06cc\u0631\u06cc\u0627 \u0633\u06d2 \u0628\u0627\u06c1\u0631 \u06a9\u0633\u06cc \u06af\u0627\u06c1\u06a9 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0633\u06cc\u0644 \u062a\u06cc\u0627\u0631 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0633\u06cc\u0644 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0646\u0642\u0637\u06c1 \u0646\u06d2 \u062a\u0635\u062f\u06cc\u0642 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc \u06c1\u06d2 \u06a9\u06c1 \u06a9\u0648\u0631\u06cc\u062c \u0645\u0648\u062c\u0648\u062f \u06c1\u06d2\u06d4 \u06a9\u0627\u0631\u0648\u0628\u0627\u0631\u06cc \u0627\u0635\u0648\u0644 \u06a9\u06cc \u062e\u0644\u0627\u0641 \u0648\u0631\u0632\u06cc \u06a9\u06cc \u06af\u0626\u06cc \u06c1\u06d2\u06d4 \u0645\u0627\u0644\u06cc \u0644\u062d\u0627\u0638 \u0633\u06d2 \u0646\u0642\u0635\u0627\u0646\u0627\u062a \u06c1\u06cc\u06ba\u06d4 \u0639\u0645\u0644\u06cc \u0637\u0648\u0631 \u067e\u0631\u060c \u0627\u0633 \u0633\u06d2 \u0645\u0633\u0627\u0626\u0644 \u067e\u06cc\u062f\u0627 \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0646\u06c1\u06cc\u06ba \u062d\u0644 \u06c1\u0648\u0646\u06d2 \u0645\u06cc\u06ba \u0645\u06c1\u06cc\u0646\u0648\u06ba \u0644\u06af \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h3 id=\"heading-the-engineering-failure\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06cc \u0646\u0627\u06a9\u0627\u0645\u06cc<\/h3>\n<p>\u06a9\u0627\u0631\u0648\u0628\u0627\u0631\u06cc \u0645\u0646\u0637\u0642 \u06a9\u06cc \u0634\u0646\u0627\u062e\u062a \u0646\u06c1\u06cc\u06ba \u06a9\u06cc \u06af\u0626\u06cc \u06c1\u06d2 \u0627\u0648\u0631 \u0688\u0648\u0645\u06cc\u0646 \u067e\u0631\u062a \u067e\u0631 \u0627\u0633\u06d2 \u0646\u0627\u0641\u0630 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u06d4 \u0688\u0648\u0645\u06cc\u0646 \u0633\u06d2 \u0686\u0644\u0646\u06d2 \u0648\u0627\u0644\u0627 \u0688\u06cc\u0632\u0627\u0626\u0646 \u0627\u0633\u06cc \u0648\u062c\u06c1 \u0633\u06d2 \u0645\u0648\u062c\u0648\u062f \u06c1\u06d2\u06d4 \u06a9\u0627\u0631\u0648\u0628\u0627\u0631\u06cc \u0645\u0646\u0637\u0642 \u0679\u0648\u0679 \u062c\u0627\u062a\u06cc \u06c1\u06d2 \u06cc\u0627 \u0627\u06cc\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646 \u0628\u0646\u0627\u062a\u06cc \u06c1\u06d2\u06d4 \u0627\u06af\u0631 \u0688\u0648\u0645\u06cc\u0646 \u06a9\u06cc \u067e\u0631\u062a \u062e\u0631\u0627\u0628 \u0688\u06cc\u0632\u0627\u0626\u0646 \u06a9\u06cc \u06af\u0626\u06cc \u06c1\u06d2 \u0627\u0648\u0631 \u06a9\u0627\u0631\u0648\u0628\u0627\u0631\u06cc \u0642\u0648\u0627\u0639\u062f \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u0627\u0646\u06a9\u0648\u0688 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u06d2 \u06af\u0626\u06d2 \u06c1\u06cc\u06ba\u060c \u062a\u0648 \u0635\u0627\u0631\u0641 \u0627\u0646\u06c1\u06cc\u06ba \u0646\u0638\u0631\u0627\u0646\u062f\u0627\u0632 \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u0648\u06c1\u0627\u06ba \u06a9\u0648\u0626\u06cc \u06af\u0627\u0631\u0688\u0631\u06cc\u0644 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0632 \u06a9\u0648 \u0645\u0639\u0644\u0648\u0645 \u0646\u06c1\u06cc\u06ba \u062a\u06be\u0627 \u06a9\u06c1 \u0648\u06c1 \u0648\u06c1\u0627\u06ba \u0645\u0648\u062c\u0648\u062f \u06c1\u06cc\u06ba\u06d4 \u06cc\u06c1 \u0627\u06cc\u06a9 \u062a\u06a9\u0646\u06cc\u06a9\u06cc \u0645\u0633\u0626\u0644\u06c1 \u0627\u0648\u0631 \u0688\u0648\u0645\u06cc\u0646 \u06a9\u06d2 \u0639\u0644\u0645 \u06a9\u0627 \u0645\u0633\u0626\u0644\u06c1 \u062f\u0648\u0646\u0648\u06ba \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-engineering-fix\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u0679\u06be\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba<\/h3>\n<p>\u06a9\u0627\u0631\u0648\u0628\u0627\u0631\u06cc \u0642\u0648\u0627\u0646\u06cc\u0646 \u06a9\u0627 \u062a\u0639\u0644\u0642 \u0688\u0648\u0645\u06cc\u0646 \u067e\u0631\u062a \u0633\u06d2 \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0648\u06c1\u06cc \u06c1\u06d2 \u062c\u0648 \u0642\u062f\u0631 \u0622\u0628\u062c\u06cc\u06a9\u0679 \u0627\u0648\u0631 \u0688\u0648\u0645\u06cc\u0646 \u0627\u062f\u0627\u0631\u0648\u06ba \u06a9\u0627 \u0627\u0637\u0644\u0627\u0642 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u06af\u0631 \u06a9\u0648\u0631\u06cc\u062c \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc \u062c\u0627\u062a\u06cc \u06c1\u06d2 \u062a\u0648\u060c \u0641\u0631\u0648\u062e\u062a \u0646\u06c1\u06cc\u06ba \u06a9\u06cc \u062c\u0627 \u0633\u06a9\u062a\u06cc. \u0627\u0646 \u0627\u0635\u0648\u0644\u0648\u06ba \u06a9\u0648 \u0688\u0648\u0645\u06cc\u0646\u0632 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0627\u0646\u06a9\u0648\u0688 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u060c \u0646\u06c1 \u06a9\u06c1 API \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679\u0633 \u06cc\u0627 UI\u06d4<\/p>\n<p><strong>\u0688\u0627\u0631\u0679:<\/strong><\/p>\n<pre><code class=\"language-dart\">class Sale {\n  final String agentId;\n  final String customerId;\n  final CoverageArea coverageArea;\n  final SaleStatus status;\n\n  Sale._({\n    required this.agentId,\n    required this.customerId,\n    required this.coverageArea,\n    required this.status,\n  });\n\n  \/\/ business rule enforced at domain creation - no coverage, no sale\n  static Result<sale domainexception=\"\"> create({\n    required String agentId,\n    required String customerId,\n    required CoverageArea coverageArea,\n  }) {\n    if (!coverageArea.hasActiveCoverage) {\n      return Result.failure(\n        DomainException('Cannot create sale: customer area has no active coverage'),\n      );\n    }\n\n    return Result.success(Sale._(\n      agentId: agentId,\n      customerId: customerId,\n      coverageArea: coverageArea,\n      status: SaleStatus.pending,\n    ));\n  }\n}\n<\/sale><\/code><\/pre>\n<p><strong>aspirate#:<\/strong><\/p>\n<pre><code class=\"language-csharp\">public class Sale\n{\n    private Sale(string agentId, string customerId, CoverageArea area)\n    {\n        AgentId = agentId;\n        CustomerId = customerId;\n        CoverageArea = area;\n        Status = SaleStatus.Pending;\n    }\n\n    public string AgentId { get; }\n    public string CustomerId { get; }\n    public CoverageArea CoverageArea { get; }\n    public SaleStatus Status { get; private set; }\n\n    \/\/ factory enforces the business rule no coverage, no sale\n    public static Result<sale> Create(\n        string agentId,\n        string customerId,\n        CoverageArea coverageArea)\n    {\n        if (!coverageArea.HasActiveCoverage)\n            return Result.Failure<sale>(\n                \"Cannot create sale: no active coverage in this area\");\n\n        return Result.Success(new Sale(agentId, customerId, coverageArea));\n    }\n}\n<\/sale><\/sale><\/code><\/pre>\n<p>\u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0646\u0642\u0637\u06c1 \u062c\u0648 \u0641\u0631\u0648\u062e\u062a \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u0688\u0648\u0645\u06cc\u0646 \u0641\u06cc\u06a9\u0679\u0631\u06cc \u06a9\u0648 \u06a9\u0627\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0688\u0648\u0645\u06cc\u0646 \u0641\u06cc\u06a9\u0679\u0631\u06cc\u0627\u06ba \u06a9\u0627\u0631\u0648\u0628\u0627\u0631\u06cc \u0642\u0648\u0627\u0646\u06cc\u0646 \u0646\u0627\u0641\u0630 \u06a9\u0631\u062a\u06cc \u06c1\u06cc\u06ba\u06d4 \u0642\u0648\u0627\u0639\u062f \u06a9\u0648 API \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0646\u0638\u0631\u0627\u0646\u062f\u0627\u0632 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 APIs \u0641\u06cc\u06a9\u0679\u0631\u06cc \u06a9\u0648 \u0646\u0638\u0631\u0627\u0646\u062f\u0627\u0632 \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u06cc \u0633\u06cc\u0644\u0632 \u067e\u06cc\u062f\u0627 \u0646\u06c1\u06cc\u06ba \u06a9\u0631 \u0633\u06a9\u062a\u06d2\u06d4<\/p>\n<h2 id=\"heading-7-security-misconfiguration\">7. \u063a\u0644\u0637 \u0633\u06cc\u06a9\u0648\u0631\u0679\u06cc \u06a9\u0646\u0641\u06cc\u06af\u0631\u06cc\u0634\u0646<\/h2>\n<h3 id=\"heading-what-it-is\">\u06cc\u06c1 \u06a9\u06cc\u0627 \u06c1\u06d2<\/h3>\n<p>\u0688\u0648\u06cc\u0644\u067e\u0631 \u06a9\u06d2 \u0630\u0627\u062a\u06cc \u0688\u06cc\u0628\u06af\u0646\u06af \u06a9\u06d2 \u0639\u0645\u0644 \u06a9\u0648 \u067e\u0631\u0648\u0688\u06a9\u0634\u0646 \u0645\u06cc\u06ba \u0644\u06d2 \u062c\u0627\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u0633\u0679\u06cc\u06a9 \u0679\u0631\u06cc\u0633 \u06a9\u0648 \u0638\u0627\u06c1\u0631 \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u0627 \u0627\u06cc\u06a9 \u062a\u0641\u0635\u06cc\u0644\u06cc \u062e\u0631\u0627\u0628\u06cc \u06a9\u0627 \u067e\u06cc\u063a\u0627\u0645\u06d4 \u0688\u06cc\u0628\u06af \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679 \u0641\u0639\u0627\u0644 \u0631\u06c1\u062a\u0627 \u06c1\u06d2\u06d4 CORS \u06a9\u0648 \u06a9\u0633\u06cc \u0628\u06be\u06cc \u0627\u0635\u0644 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u0646\u06d2 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u06ba\u06d4 \u0646\u0648\u0634\u062a\u06c1 \u062c\u0627\u062a \u0645\u06cc\u06ba \u062d\u0633\u0627\u0633 \u0688\u06cc\u0679\u0627\u06d4 \u06cc\u06c1 \u0688\u0648\u06cc\u0644\u067e\u0631 \u06a9\u06cc \u0645\u0642\u0627\u0645\u06cc \u062a\u0631\u062a\u06cc\u0628 \u06c1\u06d2 \u062c\u0648 \u067e\u06cc\u062f\u0627\u0648\u0627\u0631 \u0645\u06cc\u06ba \u0686\u0644 \u0631\u06c1\u06cc \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-engineering-failure\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06cc \u0646\u0627\u06a9\u0627\u0645\u06cc<\/h3>\n<p>\u0627\u0633 \u0642\u0633\u0645 \u06a9\u06d2 \u0645\u0633\u0627\u0626\u0644 \u0627\u0633 \u0648\u0642\u062a \u067e\u06cc\u0634 \u0622\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0628 \u062a\u0631\u0642\u06cc\u060c \u0627\u0633\u0679\u06cc\u062c\u0646\u06af \u0627\u0648\u0631 \u067e\u0631\u0648\u0688\u06a9\u0634\u0646 \u06a9\u0646\u0641\u06cc\u06af\u0631\u06cc\u0634\u0646\u0632 \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u06a9\u0648\u0626\u06cc \u0641\u0631\u0642 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 \u067e\u06cc\u062f\u0627\u0648\u0627\u0631 \u062a\u06a9 \u067e\u06c1\u0646\u0686\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u063a\u0644\u0637 \u06a9\u0646\u0641\u06cc\u06af\u0631\u06cc\u0634\u0646\u0632 \u06a9\u0648 \u067e\u06a9\u0691\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0648\u0626\u06cc \u067e\u0627\u0626\u067e \u0644\u0627\u0626\u0646 \u06af\u06cc\u0679 \u0646\u06c1\u06cc\u06ba \u06c1\u06cc\u06ba\u06d4 \u06c1\u0631 \u0688\u0648\u06cc\u0644\u067e\u0631 \u0627\u067e\u0646\u06cc \u062a\u0631\u062a\u06cc\u0628 \u06a9\u0627 \u062e\u0648\u062f \u0627\u0646\u062a\u0638\u0627\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u0633 \u06a9\u0627 \u0645\u0637\u0644\u0628 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u06c1\u0631 \u0688\u0648\u06cc\u0644\u067e\u0631 \u06a9\u06cc \u0639\u0627\u062f\u0627\u062a \u0627\u0648\u0631 \u0688\u06cc\u0628\u06af\u0646\u06af \u06a9\u06cc \u062a\u0631\u062c\u06cc\u062d\u0627\u062a \u06a9\u0648 \u0628\u0627\u0644\u0622\u062e\u0631 \u067e\u06cc\u062f\u0627\u0648\u0627\u0631 \u067e\u0631 \u0644\u0627\u06af\u0648 \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-engineering-fix\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u0679\u06be\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba<\/h3>\n<p>\u06c1\u0631 \u0645\u0627\u062d\u0648\u0644 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0645\u062e\u062a\u0644\u0641 \u0648\u0631\u06a9 \u0641\u0644\u0648 \u062a\u0631\u062a\u06cc\u0628 \u062f\u06cc\u06ba\u06d4 \u067e\u0631\u0648\u0688\u06a9\u0634\u0646 \u067e\u0627\u0626\u067e \u0644\u0627\u0626\u0646 \u0645\u06cc\u06ba \u062c\u0627\u0645\u062f \u062a\u062c\u0632\u06cc\u06c1\u060c \u06a9\u0646\u0641\u06cc\u06af\u0631\u06cc\u0634\u0646 \u06a9\u06cc \u062a\u0648\u062b\u06cc\u0642\u060c \u0688\u06cc\u0628\u06af \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679\u0633 \u06a9\u0648 \u06a9\u06cc\u067e\u0686\u0631 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0644\u0646\u0679\u0646\u06af\u060c CORS \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a\u060c \u062a\u0641\u0635\u06cc\u0644\u06cc \u063a\u0644\u0637\u06cc \u0644\u0627\u06af\u0646\u06af\u060c \u0627\u0648\u0631 \u0627\u0646\u0636\u0645\u0627\u0645 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0628\u06d2 \u0646\u0642\u0627\u0628 \u0631\u0627\u0632 \u0634\u0627\u0645\u0644 \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/p>\n<p><strong>\u0688\u0627\u0631\u0679 (\u0645\u0627\u062d\u0648\u0644 \u0633\u06d2 \u0622\u06af\u0627\u06c1\u06cc \u06a9\u06cc \u062e\u0631\u0627\u0628\u06cc \u0633\u06d2 \u0646\u0645\u0679\u0646\u06d2):<\/strong><\/p>\n<pre><code class=\"language-dart\">class ErrorHandler {\n  final Environment _environment;\n\n  ErrorHandler(this._environment);\n\n  Response handleException(Object error, StackTrace stackTrace) {\n \n    logger.error('Unhandled exception', error: error, stackTrace: stackTrace);\n\n    if (_environment.isProduction) {\n      \n      return Response.internalServerError(\n        body: jsonEncode({'error': 'An internal error occurred'}),\n      );\n    }\n\n    \n    return Response.internalServerError(\n      body: jsonEncode({\n        'error': error.toString(),\n        'stackTrace': stackTrace.toString(),\n      }),\n    );\n  }\n}\n<\/code><\/pre>\n<p><strong>aspirate#:<\/strong><\/p>\n<pre><code class=\"language-csharp\">\napp.UseExceptionHandler(errorApp =>\n{\n    errorApp.Run(async context =>\n    {\n        context.Response.StatusCode = 500;\n        context.Response.ContentType = \"application\/json\";\n\n        var error = context.Features.Get<iexceptionhandlerfeature>();\n        if (error != null)\n        {\n            \/\/ log internally with full details\n            logger.LogError(error.Error, \"Unhandled exception\");\n        }\n\n        \/\/ return generic message to caller\n        await context.Response.WriteAsync(\n            JsonSerializer.Serialize(new { error = \"An internal error occurred\" })\n        );\n    });\n});\n\n\/\/ CORS - explicit allowed origins, never wildcard in production\nbuilder.Services.AddCors(options =>\n{\n    options.AddPolicy(\"ProductionPolicy\", policy =>\n    {\n        policy.WithOrigins(\n            \"https:\/\/app.yourproduct.com\",\n            \"https:\/\/admin.yourproduct.com\"\n        )\n        .AllowedMethods(\"GET\", \"POST\", \"PUT\", \"DELETE\")\n        .AllowedHeaders(\"Authorization\", \"Content-Type\");\n        \n    });\n});\n<\/iexceptionhandlerfeature><\/code><\/pre>\n<p>\u067e\u06cc\u062f\u0627\u0648\u0627\u0631 \u0645\u06cc\u06ba CORS \u06a9\u0648 \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u0627\u062c\u0627\u0632\u062a \u0634\u062f\u06c1 \u0630\u0631\u0627\u0626\u0639 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4 \u067e\u0631\u0648\u0688\u06a9\u0634\u0646 \u0645\u06cc\u06ba \u0648\u0627\u0626\u0644\u0688 \u06a9\u0627\u0631\u0688 CORS \u0627\u06cc\u06a9 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u062d\u0641\u0627\u0638\u062a\u06cc \u062e\u0627\u0645\u06cc \u06c1\u06d2 \u062c\u0648 \u0627\u0646\u0679\u0631\u0646\u06cc\u0679 \u067e\u0631 \u06a9\u0633\u06cc \u0628\u06be\u06cc \u0648\u06cc\u0628 \u067e\u06cc\u062c \u06a9\u0648 \u06a9\u0633\u06cc API \u0633\u06d2 \u062a\u0635\u062f\u06cc\u0642 \u0634\u062f\u06c1 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0648\u0632\u06cc\u0679\u0631 \u06a9\u06cc \u0627\u0633\u0646\u0627\u062f \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u062a\u06cc \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-8-improper-inventory-management\">8. \u0627\u0646\u0648\u06cc\u0646\u0679\u0631\u06cc \u06a9\u0627 \u063a\u0644\u0637 \u0627\u0646\u062a\u0638\u0627\u0645<\/h2>\n<h3 id=\"heading-what-it-is\">\u06cc\u06c1 \u06a9\u06cc\u0627 \u06c1\u06d2<\/h3>\n<p>\u0641\u0631\u0633\u0648\u062f\u06c1 APIs\u060c \u0641\u0631\u0633\u0648\u062f\u06c1 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u067e\u0648\u0627\u0626\u0646\u0679\u0633\u060c \u0627\u0648\u0631 \u067e\u0631\u0627\u0646\u06d2 API \u0648\u0631\u0698\u0646 \u0627\u0628 \u0628\u06be\u06cc \u0622\u067e \u06a9\u06d2 \u0633\u0631\u0648\u0631\u0632 \u067e\u0631 \u0686\u0644 \u0631\u06c1\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06a9\u0648\u0626\u06cc \u0646\u06c1\u06cc\u06ba \u062c\u0627\u0646\u062a\u0627 \u06a9\u06c1 \u06cc\u06c1 \u0645\u0648\u062c\u0648\u062f \u06c1\u06d2 \u0627\u0648\u0631 \u0646\u06c1 \u06a9\u0648\u0626\u06cc \u0627\u0633 \u06a9\u0627 \u0645\u0627\u0644\u06a9 \u06c1\u06d2\u06d4 \u062a\u0627\u06c1\u0645\u060c \u0645\u06cc\u0631\u0627\u062b\u06cc \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679\u0633 \u0627\u06a9\u062b\u0631 \u0645\u0648\u062c\u0648\u062f\u06c1 \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679\u0633 \u06a9\u06d2 \u0645\u0642\u0627\u0628\u0644\u06d2 \u0645\u06cc\u06ba \u06a9\u0645 \u0645\u062d\u0641\u0648\u0638 \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062c\u0646\u06c1\u06cc\u06ba \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u062a\u0644\u0627\u0634 \u06a9\u0631\u062a\u06d2 \u0627\u0648\u0631 \u0627\u0633\u062a\u062d\u0635\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h3 id=\"heading-the-engineering-failure\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06cc \u0646\u0627\u06a9\u0627\u0645\u06cc<\/h3>\n<p>API \u0644\u0627\u0626\u0641 \u0633\u0627\u0626\u06cc\u06a9\u0644 \u0645\u06cc\u0646\u062c\u0645\u0646\u0679 \u06a9\u0633\u06cc \u06a9\u06cc \u0631\u0633\u0645\u06cc \u0630\u0645\u06c1 \u062f\u0627\u0631\u06cc \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u0627\u06cc\u06a9 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0646\u0642\u0637\u06c1 \u0628\u0646\u0627\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u0627\u0633 \u06a9\u06cc \u0641\u0639\u0627\u0644\u06cc\u062a \u06a9\u0648 \u062a\u0628\u062f\u06cc\u0644 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u067e\u0631\u0627\u0646\u06d2 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0648\u0631\u0698\u0646 \u0631\u06cc\u0679\u0627\u0626\u0631 \u06c1\u0648\u0646\u06d2 \u06a9\u06d2 \u0628\u062c\u0627\u0626\u06d2 \u0628\u06be\u0648\u0644 \u062c\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0648\u0642\u062a \u06af\u0632\u0631\u0646\u06d2 \u06a9\u06d2 \u0633\u0627\u062a\u06be\u060c API \u06a9\u06cc \u0633\u0637\u062d \u06a9\u0627 \u0631\u0642\u0628\u06c1 \u0688\u06cc\u0688 \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679\u0633 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0628\u0691\u06be\u062a\u0627 \u06c1\u06d2 \u062c\u0648 \u0627\u0628 \u0628\u06be\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u0648\u06ba \u06a9\u0627 \u062c\u0648\u0627\u0628 \u062f\u06cc\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0627\u0648\u0631 \u0627\u06a9\u062b\u0631 \u062c\u062f\u06cc\u062f \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679\u0633 \u067e\u0631 \u06a9\u0648\u0626\u06cc \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u06a9\u0646\u0679\u0631\u0648\u0644 \u0644\u0627\u06af\u0648 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-engineering-fix\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u0679\u06be\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba<\/h3>\n<p>\u06a9\u0633\u06cc \u06a9\u0648 API \u0627\u0646\u0648\u06cc\u0646\u0679\u0631\u06cc \u06a9\u06d2 \u0645\u0627\u0644\u06a9 \u06c1\u0648\u0646\u06d2 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06cc \u0627\u06cc\u06a9 \u0631\u0633\u0645\u06cc \u0630\u0645\u06c1 \u062f\u0627\u0631\u06cc \u06c1\u06d2 \u0627\u0648\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631\u06cc \u0646\u06c1\u06cc\u06ba\u06d4 \u062a\u0645\u0627\u0645 API \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679\u0633 \u06a9\u0648 \u062f\u0633\u062a\u0627\u0648\u06cc\u0632\u06cc\u060c \u0648\u0631\u0698\u0646\u060c \u0627\u0648\u0631 \u0627\u06cc\u06a9 \u0645\u062a\u0639\u06cc\u0646 \u0644\u0627\u0626\u0641 \u0633\u0627\u0626\u06cc\u06a9\u0644 \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2: \u0641\u0639\u0627\u0644\u060c \u0641\u0631\u0633\u0648\u062f\u06c1\u060c \u06cc\u0627 \u0631\u06cc\u0679\u0627\u0626\u0631\u0688\u06d4<\/p>\n<p>\u0641\u0631\u0633\u0648\u062f\u06c1 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0646\u0642\u0637\u06c1 \u06a9\u0648 \u0627\u06cc\u06a9 \u062c\u0648\u0627\u0628\u06cc \u06c1\u06cc\u0688\u0631 \u0648\u0627\u067e\u0633 \u06a9\u0631\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2 \u062c\u0648 \u0627\u0633 \u062a\u0627\u0631\u06cc\u062e \u06a9\u06cc \u0646\u0634\u0627\u0646\u062f\u06c1\u06cc \u06a9\u0631\u06d2 \u062c\u0628 \u0627\u0633\u06d2 \u0641\u0631\u0633\u0648\u062f\u06c1 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u062a\u06be\u0627\u06d4 \u062e\u062a\u0645 \u0634\u062f\u06c1 \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679 \u06a9\u0648 \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u0648\u06ba \u067e\u0631 \u06a9\u0627\u0631\u0631\u0648\u0627\u0626\u06cc \u062c\u0627\u0631\u06cc \u0646\u06c1\u06cc\u06ba \u0631\u06a9\u06be\u0646\u06cc \u0686\u0627\u06c1\u06cc\u06d2 \u0627\u0648\u0631 410 Gone \u06a9\u0648 \u0648\u0627\u067e\u0633 \u06a9\u0631\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/p>\n<p><strong>\u0688\u0627\u0631\u0679:<\/strong><\/p>\n<pre><code class=\"language-dart\">\/\/ deprecated endpoint wrapper\nHandler deprecatedEndpoint({\n  required Handler handler,\n  required DateTime removalDate,\n  required String replacementEndpoint,\n}) {\n  return (Request request) async {\n    final response = await handler(request);\n\n    \/\/ add deprecation headers so clients know to migrate\n    return response.change(headers: {\n      'Deprecation': 'true',\n      'Sunset': HttpDate.format(removalDate),\n      'Link': '<$replacementEndpoint>; rel=\"successor-version\"',\n      'Warning': '299 - \"This endpoint is deprecated and will be removed on ${removalDate.toIso8601String()}\"',\n    });\n  };\n}\n\n\/\/ decommissioned endpoint\nFuture<response> decommissionedEndpoint(Request request) async {\n  return Response(\n    410,\n    body: jsonEncode({\n      'error': 'This endpoint has been permanently removed',\n      'replacement': '\/api\/v2\/accounts',\n    }),\n  );\n}\n<\/response><\/code><\/pre>\n<p><strong>aspirate#:<\/strong><\/p>\n<pre><code class=\"language-csharp\">\/\/ mark endpoints as deprecated using ApiVersion attributes\n[ApiController]\n[ApiVersion(\"1.0\", Deprecated = true)]\n[Route(\"api\/v{version:apiVersion}\/accounts\")]\npublic class AccountsV1Controller : ControllerBase\n{\n    [HttpGet(\"{id}\")]\n    public IActionResult GetAccount(string id)\n    {\n        Response.Headers.Add(\"Deprecation\", \"true\");\n        Response.Headers.Add(\"Sunset\", \"Sat, 01 Jan 2027 00:00:00 GMT\");\n        Response.Headers.Add(\"Link\", \"; rel=\\\"successor-version\\\"\");\n\n        \/\/ still process the request during deprecation period\n        return Ok(_service.GetAccount(id));\n    }\n}\n\n\/\/ gone - permanent removal\n[ApiController]\n[Route(\"api\/v1\/legacy\/accounts\")]\npublic class LegacyAccountsController : ControllerBase\n{\n    [HttpGet]\n    public IActionResult GetAll()\n    {\n        return StatusCode(410, new { error = \"This endpoint has been permanently removed\", replacement = \"\/api\/v2\/accounts\" });\n    }\n}\n<\/code><\/pre>\n<h2 id=\"heading-9-unsafe-consumption-of-apis\">9. APIs \u06a9\u0627 \u063a\u06cc\u0631 \u0645\u062d\u0641\u0648\u0638 \u0627\u0633\u062a\u0639\u0645\u0627\u0644<\/h2>\n<h3 id=\"heading-what-it-is\">\u06cc\u06c1 \u06a9\u06cc\u0627 \u06c1\u06d2<\/h3>\n<p>\u0622\u067e \u06a9\u06cc \u0627\u06cc\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646 \u0641\u0631\u06cc\u0642 \u062b\u0627\u0644\u062b \u06a9\u06cc \u062e\u062f\u0645\u0627\u062a \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0636\u0645 \u06c1\u0648\u062c\u0627\u062a\u06cc \u06c1\u06d2 \u0627\u0648\u0631 \u0628\u063a\u06cc\u0631 \u062a\u0635\u062f\u06cc\u0642 \u06cc\u0627 \u0686\u0648\u06a9\u06cc\u0648\u06ba \u06a9\u06d2 \u0627\u0646 \u06a9\u06d2 \u0688\u06cc\u0679\u0627 \u067e\u0631 \u0628\u06be\u0631\u0648\u0633\u06c1 \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u06d4 \u062c\u0648 \u0628\u06be\u06cc \u0628\u06cc\u0631\u0648\u0646\u06cc API \u0648\u0627\u067e\u0633 \u0622\u062a\u0627 \u06c1\u06d2\u060c \u0622\u067e \u06a9\u06cc \u0627\u06cc\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646 \u0627\u0633\u06d2 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u06c1\u06cc\u0646\u0688\u0644 \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u06d4<\/p>\n<p>\u0641\u0631\u06cc\u0642 \u062b\u0627\u0644\u062b \u06a9\u06cc \u0627\u062f\u0627\u0626\u06cc\u06af\u06cc \u06a9\u0627 \u06a9\u0627\u0644 \u0628\u06cc\u06a9 \u0644\u06cc\u0646 \u062f\u06cc\u0646 \u06a9\u06cc \u062d\u06cc\u062b\u06cc\u062a \u0644\u0648\u0679\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u0622\u067e \u06a9\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u062f\u0633\u062a\u062e\u0637 \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06a9\u06cc\u06d2 \u0628\u063a\u06cc\u0631 \u06cc\u0627 \u0688\u06cc\u0679\u0627 \u06a9\u06d2 \u0688\u06be\u0627\u0646\u0686\u06d2 \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06a9\u06cc\u06d2 \u0628\u063a\u06cc\u0631 \u0627\u0633 \u067e\u0631 \u0628\u06be\u0631\u0648\u0633\u06c1 \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u06d4 \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u06a9\u0627\u0644 \u0628\u06cc\u06a9 \u06cc\u0648 \u0622\u0631 \u0627\u06cc\u0644 \u067e\u0631 \u062c\u0639\u0644\u06cc \u06a9\u0627\u0644 \u0628\u06cc\u06a9 \u0628\u06be\u06cc\u062c\u062a\u0627 \u06c1\u06d2\u06d4 \u0622\u067e \u06a9\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0627\u0633\u06d2 \u062c\u0627\u0626\u0632 \u0633\u0645\u062c\u06be\u06d2 \u06af\u06cc\u06d4<\/p>\n<h3 id=\"heading-the-engineering-failure\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06cc \u0646\u0627\u06a9\u0627\u0645\u06cc<\/h3>\n<p>\u0628\u06cc\u0631\u0648\u0646\u06cc \u062e\u062f\u0645\u0627\u062a \u06a9\u0648 \u0628\u0637\u0648\u0631 \u0688\u06cc\u0641\u0627\u0644\u0679 \u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f \u062e\u062f\u0645\u0627\u062a \u0633\u0645\u062c\u06be\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u0628\u06cc\u0631\u0648\u0646\u06cc \u062e\u062f\u0645\u0627\u062a \u06a9\u0627 \u062f\u0631\u0633\u062a \u0688\u06cc\u0679\u0627 \u06a9\u06cc\u0633\u0627 \u0644\u06af\u062a\u0627 \u06c1\u06d2 \u0627\u0633 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0648\u0626\u06cc \u0645\u062a\u0639\u06cc\u0646 \u0645\u0639\u0627\u06c1\u062f\u06c1 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u0628\u06cc\u0631\u0648\u0646\u06cc \u0633\u0631\u0648\u0633 \u06a9\u06d2 \u062c\u0648\u0627\u0628 \u0627\u0648\u0631 \u0622\u067e \u06a9\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u06cc \u067e\u0631\u0648\u0633\u06cc\u0633\u0646\u06af \u0645\u0646\u0637\u0642 \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u06a9\u0648\u0626\u06cc \u062a\u0648\u062b\u06cc\u0642 \u06a9\u06cc \u067e\u0631\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/p>\n<p>\u0627\u0639\u062a\u0645\u0627\u062f \u062b\u0627\u0628\u062a \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0628\u062c\u0627\u0626\u06d2 \u0641\u0631\u0636 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-engineering-fix\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u0679\u06be\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba<\/h3>\n<p>\u0628\u06cc\u0631\u0648\u0646\u06cc \u062e\u062f\u0645\u0627\u062a \u06a9\u06d2 \u0633\u0627\u062a\u06be \u062a\u0645\u0627\u0645 \u0627\u0646\u0636\u0645\u0627\u0645 \u06a9\u0627 \u0627\u06cc\u06a9 \u0645\u062a\u0639\u06cc\u0646 \u0645\u0639\u0627\u06c1\u062f\u06c1 \u06c1\u0648\u0646\u0627 \u0636\u0631\u0648\u0631\u06cc \u06c1\u06d2\u06d4 \u0645\u0639\u0627\u06c1\u062f\u06c1 \u0628\u062a\u0627\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u062f\u0631\u0633\u062a \u0688\u06cc\u0679\u0627 \u06a9\u06cc\u0633\u0627 \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u060c \u06a9\u0648\u0646 \u0633\u06d2 \u0641\u06cc\u0644\u0688\u0632 \u062f\u0631\u06a9\u0627\u0631 \u06c1\u06cc\u06ba\u060c \u06a9\u0648\u0646 \u0633\u06cc \u0631\u06cc\u0646\u062c\u0632 \u062f\u0631\u0633\u062a \u06c1\u06cc\u06ba\u060c \u0627\u0648\u0631 \u06a9\u0648\u0646 \u0633\u0627 \u0641\u0627\u0631\u0645\u06cc\u0679\u06d4 \u067e\u0631\u0648\u0633\u06cc\u0633\u0646\u06af \u06c1\u0648\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0628\u06cc\u0631\u0648\u0646\u06cc \u062e\u062f\u0645\u0627\u062a \u06a9\u06d2 \u062a\u0645\u0627\u0645 \u062c\u0648\u0627\u0628\u0627\u062a \u0627\u0633 \u0645\u0639\u0627\u06c1\u062f\u06d2 \u06a9\u06d2 \u062e\u0644\u0627\u0641 \u062a\u0635\u062f\u06cc\u0642 \u0634\u062f\u06c1 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p><strong>\u0688\u0627\u0631\u0679:<\/strong><\/p>\n<pre><code class=\"language-dart\">class PaymentCallbackService {\n  final String _webhookSecret;\n\n  PaymentCallbackService(this._webhookSecret);\n\n  Future<result appexception=\"\">> processCallback(\n    Map<string dynamic=\"\"> payload,\n    String signature,\n    String rawBody,\n  ) async {\n    \/\/ step 1: verify the signature before processing anything\n    final isValid = _verifySignature(rawBody, signature, _webhookSecret);\n    if (!isValid) {\n      logger.warning('Invalid webhook signature received');\n      return Result.failure(\n        AppException.unauthorized('Invalid webhook signature'),\n      );\n    }\n\n    \/\/ step 2: validate the payload structure against our contract\n    final validationResult = _validateCallbackPayload(payload);\n    if (validationResult.isFailure) {\n      logger.warning('Invalid callback payload: ${validationResult.error}');\n      return Result.failure(validationResult.error!);\n    }\n\n    \/\/ step 3: only now do we trust and process the data\n    final status = PaymentStatus.fromString(payload['status'] as String);\n    return Result.success(status);\n  }\n\n  bool _verifySignature(String body, String signature, String secret) {\n    final hmac = Hmac(sha256, utf8.encode(secret));\n    final digest = hmac.convert(utf8.encode(body));\n    final expectedSignature=\"sha256=${base64.encode(digest.bytes)}\";\n    return expectedSignature == signature;\n  }\n\n  Result<void appexception=\"\"> _validateCallbackPayload(\n    Map<string dynamic=\"\"> payload,\n  ) {\n    if (!payload.containsKey('transaction_id')) {\n      return Result.failure(\n        AppException.validation('Missing required field: transaction_id'),\n      );\n    }\n    if (!payload.containsKey('status')) {\n      return Result.failure(\n        AppException.validation('Missing required field: status'),\n      );\n    }\n    final validStatuses = {'success', 'failed', 'pending'};\n    if (!validStatuses.contains(payload['status'])) {\n      return Result.failure(\n        AppException.validation('Invalid status value: ${payload['status']}'),\n      );\n    }\n    return Result.success(null);\n  }\n}\n<\/string><\/void><\/string><\/result><\/code><\/pre>\n<p><strong>aspirate#:<\/strong><\/p>\n<pre><code class=\"language-csharp\">public class PaymentCallbackService\n{\n    private readonly string _webhookSecret;\n    private readonly ILogger<paymentcallbackservice> _logger;\n\n    public async Task<result>> ProcessCallback(\n        string rawBody,\n        string signature,\n        PaymentCallbackDto payload)\n    {\n        \/\/ verify signature first\n        if (!VerifySignature(rawBody, signature))\n        {\n            _logger.LogWarning(\"Invalid webhook signature received\");\n            return Result.Failure<paymentstatus>(\"Invalid webhook signature\");\n        }\n\n        \/\/ validate payload\n        if (string.IsNullOrEmpty(payload.TransactionId))\n            return Result.Failure<paymentstatus>(\"Missing transaction_id\");\n\n        var validStatuses = new[] { \"success\", \"failed\", \"pending\" };\n        if (!validStatuses.Contains(payload.Status))\n            return Result.Failure<paymentstatus>($\"Invalid status: {payload.Status}\");\n\n        return Result.Success(Enum.Parse<paymentstatus>(payload.Status, true));\n    }\n\n    private bool VerifySignature(string body, string signature)\n    {\n        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(_webhookSecret));\n        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(body));\n        var expectedSignature = $\"sha256={Convert.ToBase64String(hash)}\";\n        return CryptographicOperations.FixedTimeEquals(\n            Encoding.UTF8.GetBytes(expectedSignature),\n            Encoding.UTF8.GetBytes(signature)\n        );\n    }\n}\n<\/paymentstatus><\/paymentstatus><\/paymentstatus><\/paymentstatus><\/result><\/paymentcallbackservice><\/code><\/pre>\n<p>\u0627\u0646\u0636\u0645\u0627\u0645 \u0634\u0631\u0648\u0639 \u06c1\u0648\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0628\u06cc\u0631\u0648\u0646\u06cc \u062e\u062f\u0645\u0627\u062a \u06a9\u06d2 \u0633\u0627\u062a\u06be \u062a\u0648\u062b\u06cc\u0642 \u0634\u062f\u06c1 \u0645\u0639\u0627\u06c1\u062f\u06d2 \u0628\u0646\u0627\u0646\u0627 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u0627 \u0645\u0639\u06cc\u0627\u0631 \u0628\u0646 \u062c\u0627\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4 \u06a9\u0628\u06be\u06cc \u0628\u06be\u0631\u0648\u0633\u06c1 \u0646\u06c1 \u06a9\u0631\u06cc\u06ba\u060c \u06c1\u0645\u06cc\u0634\u06c1 \u0686\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<h2 id=\"heading-10-server-side-request-forgery-ssrf\">10. \u0633\u0631\u0648\u0631 \u0633\u0627\u0626\u06cc\u0688 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u062c\u0639\u0644\u0633\u0627\u0632\u06cc (SSRF)<\/h2>\n<h3 id=\"heading-what-it-is\">\u06cc\u06c1 \u06a9\u06cc\u0627 \u06c1\u06d2<\/h3>\n<p>API \u0627\u06cc\u06a9 URL \u06a9\u0648 \u0628\u0637\u0648\u0631 \u0627\u0646 \u067e\u0679 \u0642\u0628\u0648\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u0627\u0633 URL \u06a9\u06d2 \u0644\u06cc\u06d2 \u0633\u0631\u0648\u0631 \u06a9\u06cc \u0637\u0631\u0641 \u0633\u06d2 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0628\u06be\u06cc\u062c\u062a\u0627 \u06c1\u06d2\u06d4 \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u0627\u06cc\u06a9 URL \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u062c\u0648 \u0627\u0646\u062f\u0631\u0648\u0646\u06cc \u0627\u0646\u0641\u0631\u0627\u0633\u0679\u0631\u06a9\u0686\u0631 \u06a9\u06cc \u0637\u0631\u0641 \u0627\u0634\u0627\u0631\u06c1 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 <code>http:\/\/169.254.169.254\/latest\/meta-data\/<\/code> (AWS \u0645\u06cc\u0679\u0627 \u0688\u06cc\u0679\u0627 \u0633\u0631\u0648\u0633) <code>http:\/\/internal-database:5432<\/code>\u06cc\u0627 <code>http:\/\/admin-panel.internal<\/code>. \u0633\u0631\u0648\u0631 \u0628\u06cc\u0631\u0648\u0646\u06cc \u0641\u0627\u0626\u0631 \u0648\u0627\u0644 \u06a9\u0648 \u0646\u0638\u0631\u0627\u0646\u062f\u0627\u0632 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u06a9\u06d2 \u0627\u0646\u062f\u0631 \u0633\u06d2 \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u06cc\u06ba \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 \u0627\u062f\u0627\u0626\u06cc\u06af\u06cc \u06a9\u06d2 \u0646\u0638\u0627\u0645 \u0627\u067e\u0646\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u0648\u06ba \u0645\u06cc\u06ba \u06a9\u0627\u0644 \u0628\u06cc\u06a9 URL \u06cc\u0627 \u0631\u06cc \u0688\u0627\u0626\u0631\u06cc\u06a9\u0679 URL \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0627\u06af\u0631 \u0622\u067e \u06a9\u0627 API \u0628\u063a\u06cc\u0631 \u062a\u0635\u062f\u06cc\u0642 \u06a9\u06d2 \u0627\u0633 URL \u06a9\u0648 \u0627\u06cc\u06a9 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0628\u06be\u06cc\u062c\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 \u06cc\u06c1 \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u06a9\u06cc \u062c\u0627\u0646\u0628 \u0633\u06d2 \u062e\u0648\u0634\u06cc \u0633\u06d2 \u0622\u067e \u06a9\u06d2 \u0627\u0646\u062f\u0631\u0648\u0646\u06cc \u0627\u0646\u0641\u0631\u0627\u0633\u0679\u0631\u06a9\u0686\u0631 \u06a9\u0648 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0628\u06be\u06cc\u062c \u062f\u06d2 \u06af\u0627\u06d4<\/p>\n<h3 id=\"heading-the-engineering-failure\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06cc \u0646\u0627\u06a9\u0627\u0645\u06cc<\/h3>\n<p>\u06cc\u06c1 \u0627\u06cc\u06a9 \u0688\u06cc\u0632\u0627\u0626\u0646 \u06a9\u06cc \u062e\u0627\u0645\u06cc \u06c1\u06d2 \u062c\u0633\u06d2 \u0622\u0631\u06a9\u06cc\u0679\u06cc\u06a9\u0686\u0631 \u067e\u0631\u062a \u067e\u0631 \u067e\u06a9\u0691\u0627 \u062c\u0627\u0646\u0627 \u0686\u0627\u06c1\u0626\u06d2\u060c \u06a9\u0648\u0688 \u067e\u0631\u062a \u067e\u0631 \u0646\u06c1\u06cc\u06ba\u06d4 \u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc API \u062c\u0648 \u06a9\u0633\u06cc URL \u06a9\u0648 \u0628\u0637\u0648\u0631 \u0627\u0646 \u067e\u0679 \u0642\u0628\u0648\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u0627\u0633 URL \u06a9\u06d2 \u0644\u06cc\u06d2 \u0633\u0631\u0648\u0631 \u06a9\u06cc \u0637\u0631\u0641 \u0633\u06d2 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u0627\u06cc\u06a9 \u0645\u0645\u06a9\u0646\u06c1 SSRF \u06c1\u062f\u0641 \u06c1\u06d2\u06d4 \u0635\u0648\u0627\u0628\u062f\u06cc\u062f\u06cc URLs \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u0646\u06d2 \u06a9\u06d2 \u0688\u06cc\u0632\u0627\u0626\u0646 \u06a9\u06d2 \u0641\u06cc\u0635\u0644\u06d2 \u06a9\u0648 \u0627\u0646 URLs \u06a9\u06cc \u0633\u062e\u062a\u06cc \u0633\u06d2 \u062a\u0648\u062b\u06cc\u0642 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0688\u06cc\u0632\u0627\u0626\u0646 \u06a9\u06d2 \u0641\u06cc\u0635\u0644\u06d2 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0645\u0644\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/p>\n<h3 id=\"heading-the-engineering-fix\">\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u0679\u06be\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba<\/h3>\n<p>\u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc API \u062c\u0648 URL \u0642\u0628\u0648\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u0627\u0633\u06d2 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0648\u0627\u0626\u0679 \u0644\u0633\u0679 \u0634\u062f\u06c1 \u0688\u0648\u0645\u06cc\u0646\u0632 \u06a9\u06cc \u0641\u06c1\u0631\u0633\u062a \u06a9\u06d2 \u062e\u0644\u0627\u0641 URL \u06a9\u06cc \u062a\u0648\u062b\u06cc\u0642 \u06a9\u0631\u0646\u06cc \u0686\u0627\u06c1\u06cc\u06d2\u06d4 \u06cc\u06c1 \u0627\u06cc\u06a9 \u0688\u06cc\u0632\u0627\u0626\u0646 \u06a9\u0627 \u0641\u06cc\u0635\u0644\u06c1 \u06c1\u06d2\u06d4 \u0648\u0627\u0626\u0679 \u0644\u0633\u0679\u0646\u06af API \u062a\u0641\u0635\u06cc\u0644\u0627\u062a \u06a9\u0627 \u062d\u0635\u06c1 \u06c1\u06d2\u060c \u0633\u0648\u0686\u0646\u06d2 \u06a9\u06d2 \u0628\u0639\u062f \u0646\u06c1\u06cc\u06ba\u06d4<\/p>\n<p><strong>\u0688\u0627\u0631\u0679:<\/strong><\/p>\n<pre><code class=\"language-dart\">class WebhookService {\n  \/\/ only these domains are allowed to receive callbacks\n  static const _allowedDomains = {\n    'api.yourpartner.com',\n    'hooks.yourintegration.com',\n    'callbacks.trustedservice.io',\n  };\n\n  Future<result appexception=\"\">> registerCallbackUrl(String url) async {\n    \/\/ validate before storing or using\n    final validationResult = _validateCallbackUrl(url);\n    if (validationResult.isFailure) {\n      return Result.failure(validationResult.error!);\n    }\n\n    await _webhookRepository.save(url);\n    return Result.success(null);\n  }\n\n  Result<void appexception=\"\"> _validateCallbackUrl(String url) {\n    final uri = Uri.tryParse(url);\n\n    if (uri == null) {\n      return Result.failure(AppException.validation('Invalid URL format'));\n    }\n\n    \/\/ must be HTTPS in production\n    if (uri.scheme != 'https') {\n      return Result.failure(\n        AppException.validation('Callback URL must use HTTPS'),\n      );\n    }\n\n    \/\/ must be in the allowlist\n    if (!_allowedDomains.contains(uri.host)) {\n      return Result.failure(\n        AppException.validation(\n          'Callback URL domain is not in the approved list',\n        ),\n      );\n    }\n\n    \/\/ block internal IP ranges explicitly\n    if (_isInternalAddress(uri.host)) {\n      return Result.failure(\n        AppException.validation('Callback URL cannot point to internal addresses'),\n      );\n    }\n\n    return Result.success(null);\n  }\n\n  bool _isInternalAddress(String host) {\n    final privateRanges = [\n      '127.', '10.', '172.16.', '172.17.', '172.18.',\n      '192.168.', '169.254.', 'localhost', '0.0.0.0',\n    ];\n    return privateRanges.any((range) => host.startsWith(range));\n  }\n}\n<\/void><\/result><\/code><\/pre>\n<p><strong>aspirate#:<\/strong><\/p>\n<pre><code class=\"language-csharp\">public class WebhookService\n{\n    private static readonly HashSet<string> AllowedDomains = new()\n    {\n        \"api.yourpartner.com\",\n        \"hooks.yourintegration.com\",\n        \"callbacks.trustedservice.io\"\n    };\n\n    public async Task<result>> RegisterCallbackUrl(string url)\n    {\n        var validationResult = ValidateCallbackUrl(url);\n        if (!validationResult.IsSuccess)\n            return Result.Failure<bool>(validationResult.Error);\n\n        await _repository.SaveCallbackUrl(url);\n        return Result.Success(true);\n    }\n\n    private Result<bool> ValidateCallbackUrl(string url)\n    {\n        if (!Uri.TryCreate(url, UriKind.Absolute, out var uri))\n            return Result.Failure<bool>(\"Invalid URL format\");\n\n        if (uri.Scheme != \"https\")\n            return Result.Failure<bool>(\"Callback URL must use HTTPS\");\n\n        if (!AllowedDomains.Contains(uri.Host))\n            return Result.Failure<bool>(\"Domain not in approved list\");\n\n        if (IsInternalAddress(uri.Host))\n            return Result.Failure<bool>(\"Internal addresses are not permitted\");\n\n        return Result.Success(true);\n    }\n\n    private bool IsInternalAddress(string host)\n    {\n        var internalPrefixes = new[]\n        {\n            \"127.\", \"10.\", \"172.16.\", \"192.168.\",\n            \"169.254.\", \"localhost\", \"0.0.0.0\"\n        };\n        return internalPrefixes.Any(p => host.StartsWith(p));\n    }\n}\n<\/bool><\/bool><\/bool><\/bool><\/bool><\/bool><\/result><\/string><\/code><\/pre>\n<h2 id=\"heading-engineering-vulnerabilities-beyond-the-owasp-list\">OWASP \u0641\u06c1\u0631\u0633\u062a \u0633\u06d2 \u0628\u0627\u06c1\u0631 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06cc \u06a9\u0645\u0632\u0648\u0631\u06cc\u0627\u06ba<\/h2>\n<p>OWASP \u0641\u06c1\u0631\u0633\u062a \u0645\u06cc\u06ba \u0633\u0628 \u0633\u06d2 \u0627\u06c1\u0645 \u0627\u0648\u0631 \u0633\u0628 \u0633\u06d2 \u0639\u0627\u0645 API \u06a9\u0645\u0632\u0648\u0631\u06cc\u0627\u06ba \u0634\u0627\u0645\u0644 \u06c1\u06cc\u06ba\u06d4 \u062a\u0627\u06c1\u0645\u060c \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06d2 \u062a\u062c\u0631\u0628\u06d2 \u0646\u06d2 \u0627\u0636\u0627\u0641\u06cc \u0646\u0645\u0648\u0646\u0648\u06ba \u06a9\u0627 \u0627\u0646\u06a9\u0634\u0627\u0641 \u06a9\u06cc\u0627 \u06c1\u06d2 \u062c\u0648 \u0633\u0646\u06af\u06cc\u0646 \u062d\u0641\u0627\u0638\u062a\u06cc \u0633\u0648\u0631\u0627\u062e \u0628\u0646\u0627 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h3 id=\"heading-apis-called-by-multiple-clients-without-domain-allowlisting\">\u0688\u0648\u0645\u06cc\u0646 \u0648\u0627\u0626\u0679 \u0644\u0633\u0679 \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u0645\u062a\u0639\u062f\u062f \u06a9\u0644\u0627\u0626\u0646\u0679\u0633 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06c1 \u0628\u0644\u0627\u06cc\u0627 \u06af\u06cc\u0627 API<\/h3>\n<p>\u06a9\u0686\u06be APIs \u062c\u0646 \u06a9\u0648 \u0627\u06cc\u06a9 \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u06a9\u0644\u0627\u0626\u0646\u0679\u0633 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06c1 \u06a9\u0627\u0644 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2 \u0648\u06c1 \u0688\u0648\u0645\u06cc\u0646\u0632 \u06a9\u0648 \u0646\u0627\u0641\u0630 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u06c1\u0627\u06ba \u0633\u06d2 \u0627\u0646\u06c1\u06cc\u06ba \u06a9\u0627\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0644\u0648\u06af\u0648\u06ba \u06a9\u0648 API \u06a9\u06cc\u0632 \u06a9\u0627 \u0627\u0634\u062a\u0631\u0627\u06a9 \u06a9\u0631\u0646\u06d2 \u0627\u0648\u0631 \u063a\u06cc\u0631 \u0645\u062c\u0627\u0632 \u0630\u0631\u0627\u0626\u0639 \u0633\u06d2 \u0648\u0633\u0627\u0626\u0644 \u062a\u06a9 \u0631\u0633\u0627\u0626\u06cc \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0628\u0691\u06cc \u062a\u0646\u0638\u06cc\u0645\u0648\u06ba \u0645\u06cc\u06ba\u060c \u06cc\u06c1 \u0627\u06cc\u06a9 \u0628\u0691\u0627 \u0633\u06cc\u06a9\u0648\u0631\u0679\u06cc \u06c1\u0648\u0644 \u06c1\u06d2 \u062c\u0633 \u067e\u0631 \u0627\u06a9\u062b\u0631 \u06a9\u0633\u06cc \u06a9\u0627 \u062f\u06be\u06cc\u0627\u0646 \u0646\u06c1\u06cc\u06ba \u062c\u0627\u062a\u0627 \u06c1\u06d2 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 API \u062a\u06a9\u0646\u06cc\u06a9\u06cc \u0637\u0648\u0631 \u067e\u0631 \u062a\u0645\u0627\u0645 \u06a9\u0644\u0627\u0626\u0646\u0679\u0633 \u067e\u0631 \u0635\u062d\u06cc\u062d \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2 \u06a9\u0627\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u062d\u0644: \u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc API \u062c\u0648 API \u06a9\u06cc\u0632 \u06a9\u0648 \u0642\u0628\u0648\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u0627\u0633\u06d2 \u06a9\u0627\u0644\u0646\u06af \u0688\u0648\u0645\u06cc\u0646 \u06a9\u06cc \u0628\u06be\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0631\u0646\u06cc \u06c1\u0648\u06af\u06cc\u06d4 API \u06a9\u06cc\u0632 \u0627\u0648\u0631 \u0648\u0627\u0626\u0679 \u0644\u0633\u0679\u0688 \u0688\u0648\u0645\u06cc\u0646\u0632 \u06a9\u0648 \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u062c\u0648\u0691\u0627 \u0628\u0646\u0627\u06cc\u0627 \u062c\u0627\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/p>\n<h3 id=\"heading-exposing-secrets-in-code-and-logs\">\u06a9\u0648\u0688 \u0627\u0648\u0631 \u0644\u0627\u06af\u0632 \u06a9\u06d2 \u0631\u0627\u0632\u0648\u06ba \u06a9\u0648 \u0628\u06d2 \u0646\u0642\u0627\u0628 \u06a9\u0631\u0646\u0627<\/h3>\n<p>\u0688\u0648\u06cc\u0644\u067e\u0631\u0632 \u0627\u067e\u0646\u06cc \u062e\u0641\u06cc\u06c1 \u0686\u0627\u0628\u06cc\u0627\u06ba\u060c \u0639\u0648\u0627\u0645\u06cc \u0686\u0627\u0628\u06cc\u0627\u06ba\u060c \u0627\u0648\u0631 \u0627\u0633\u0646\u0627\u062f \u0627\u067e\u0646\u06d2 \u06a9\u0648\u0688\u060c \u0631\u06cc\u067e\u0648\u0632\u0679\u0631\u06cc \u06cc\u0627 \u06a9\u0645\u067e\u06cc\u0648\u0679\u0631 \u0645\u06cc\u06ba \u0686\u06be\u0648\u0691 \u062f\u06cc\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0641\u0627\u0626\u0644 \u0634\u0627\u0645\u0644 \u06a9\u0631\u06cc\u06ba\u06d4 <code>.gitignore<\/code> \u06cc\u06c1 \u06a9\u0627\u0641\u06cc \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0688\u06cc\u0679\u0627 \u0633\u06cc\u0679 \u0631\u0646 \u0679\u0627\u0626\u0645 \u06a9\u06d2 \u0648\u0642\u062a \u06a9\u0633\u06cc \u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f \u062e\u0641\u06cc\u06c1 \u0645\u06cc\u0646\u06cc\u062c\u0631 \u0633\u06d2 \u062d\u0627\u0635\u0644 \u06a9\u06cc\u06d2 \u062c\u0627\u0646\u06d2 \u0686\u0627\u06c1\u0626\u06cc\u06ba \u0627\u0648\u0631 \u0627\u0646\u06c1\u06cc\u06ba \u0633\u0648\u0631\u0633 \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u0645\u062d\u0641\u0648\u0638 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/p>\n<p>\u0622\u067e \u06a9\u06cc \u062a\u0646\u0638\u06cc\u0645 \u06a9\u0648 \u0633\u0679\u0648\u0631\u06cc\u062c\u060c Azure \u0627\u06cc\u067e \u06a9\u0646\u0641\u06cc\u06af\u0631\u06cc\u0634\u0646\u060c AWS Secrets Manager\u060c \u06cc\u0627 \u0645\u0633\u0627\u0648\u06cc \u0646\u0638\u0627\u0645 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4 \u06cc\u06c1 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u0627 \u0645\u0639\u06cc\u0627\u0631 \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u060c \u0688\u0648\u06cc\u0644\u067e\u0631 \u06a9\u06cc \u062a\u0631\u062c\u06cc\u062d \u0646\u06c1\u06cc\u06ba\u06d4 \u0648\u0627\u0644\u0679 \u062a\u06a9 \u0631\u0633\u0627\u0626\u06cc \u06a9\u06d2 \u0646\u0645\u0648\u0646\u0648\u06ba \u06a9\u0648 \u0645\u0639\u06cc\u0627\u0631\u06cc \u0628\u0646\u0627\u0646\u06d2 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2 \u062a\u0627\u06a9\u06c1 \u0688\u0648\u06cc\u0644\u067e\u0631\u0632 \u06a9\u0648 \u067e\u0631\u0648\u062c\u06cc\u06a9\u0679 \u0628\u06c1 \u067e\u0631\u0648\u062c\u06cc\u06a9\u0679 \u06a9\u06cc \u0628\u0646\u06cc\u0627\u062f \u067e\u0631 \u0627\u0646 \u06a9\u0627 \u067e\u062a\u06c1 \u0644\u06af\u0627\u0646\u06d2 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u0646\u06c1 \u06c1\u0648\u06d4<\/p>\n<h3 id=\"heading-microservices-talking-to-each-other-without-a-gateway\">\u0645\u0627\u0626\u06cc\u06a9\u0631\u0648 \u0633\u0631\u0648\u0633\u0632 \u06af\u06cc\u0679 \u0648\u06d2 \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u0627\u06cc\u06a9 \u062f\u0648\u0633\u0631\u06d2 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0628\u0627\u062a \u0686\u06cc\u062a \u06a9\u0631\u062a\u06cc \u06c1\u06cc\u06ba\u06d4<\/h3>\n<p>\u0645\u0627\u0626\u06cc\u06a9\u0631\u0648 \u0633\u0631\u0648\u0633\u0632 \u0628\u0646\u0627\u062a\u06d2 \u0648\u0642\u062a\u060c \u0633\u0631\u0648\u0633\u0632 \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u062a\u0645\u0627\u0645 \u0645\u0648\u0627\u0635\u0644\u0627\u062a \u06a9\u0648 \u062d\u0633\u0627\u0633 \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2 \u0628\u0631\u062a\u0627 \u062c\u0627\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4 \u0622\u067e \u06a9\u06d2 \u067e\u0627\u0633 \u0627\u06cc\u06a9 API \u06af\u06cc\u0679 \u0648\u06d2 \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2 \u062c\u0648 \u062a\u0645\u0627\u0645 \u0633\u0631\u0648\u0633\u0632 \u06a9\u06d2 \u0644\u06cc\u06d2 \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0648 \u06c1\u06cc\u0646\u0688\u0644 \u06a9\u0631\u06d2\u06d4 \u062e\u062f\u0645\u0627\u062a \u06a9\u0648 \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u0627\u06cc\u06a9 \u062f\u0648\u0633\u0631\u06d2 \u067e\u0631 \u0628\u06be\u0631\u0648\u0633\u06c1 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4 \u062a\u0645\u0627\u0645 \u0633\u0631\u0648\u0633 \u0679\u0648 \u0633\u0631\u0648\u0633 \u06a9\u0627\u0644\u0632 \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06c1\u0648\u0646\u06cc \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/p>\n<p>\u0645\u0627\u0626\u06cc\u06a9\u0631\u0648 \u0633\u0631\u0648\u0633\u0632 \u06a9\u06d2 \u062f\u0631\u0645\u06cc\u0627\u0646 \u0645\u0648\u0627\u0635\u0644\u062a \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06cc\u0648\u0646\u0679 \u0628\u0631\u0648\u06a9\u0631 \u06a9\u06d2 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u060c \u062c\u06cc\u0633\u06d2 \u06a9\u0627\u0641\u06a9\u0627 \u063a\u06cc\u0631 \u0645\u0637\u0627\u0628\u0642\u062a \u067e\u0630\u06cc\u0631 \u0628\u06c1\u0627\u0624 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06cc\u0627 \u0627\u06cc\u0645 \u0679\u06cc \u0627\u06cc\u0644 \u0627\u06cc\u0633 \u06c1\u0645 \u0622\u06c1\u0646\u06af \u0628\u06c1\u0627\u0624 \u06a9\u06d2 \u0644\u06cc\u06d2\u06d4 \u0645\u0627\u0626\u06cc\u06a9\u0631\u0648 \u0633\u0631\u0648\u0633\u0632 \u06a9\u0648 \u06af\u06cc\u0679 \u0648\u06d2 \u0633\u06d2 \u06af\u0632\u0631\u06d2 \u0628\u063a\u06cc\u0631 \u0627\u0646\u0679\u0631\u0646\u06cc\u0679 \u0633\u06d2 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u0642\u0627\u0628\u0644 \u0631\u0633\u0627\u0626\u06cc \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/p>\n<h3 id=\"heading-encryption-without-organizational-standards\">\u062a\u0646\u0638\u06cc\u0645\u06cc \u0645\u0639\u06cc\u0627\u0631\u0627\u062a \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u062e\u0641\u06cc\u06c1 \u06a9\u0627\u0631\u06cc<\/h3>\n<p>\u062a\u0646\u0638\u06cc\u0645\u0648\u06ba \u06a9\u06d2 \u067e\u0627\u0633 \u0645\u0639\u06cc\u0627\u0631\u06cc \u062e\u0641\u06cc\u06c1 \u06a9\u0627\u0631\u06cc \u0627\u0644\u06af\u0648\u0631\u062a\u06be\u0645 \u06c1\u0648\u0646\u0627 \u0636\u0631\u0648\u0631\u06cc \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0648\u06c1 \u0627\u0644\u06af\u0648\u0631\u062a\u06be\u0645 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2 \u062c\u0633\u06d2 \u0688\u0648\u06cc\u0644\u067e\u0631 \u0646\u06d2 \u0645\u0646\u062a\u062e\u0628 \u06a9\u06cc\u0627 \u06c1\u06d2\u060c \u06cc\u06c1 \u06c1\u0641\u062a\u06d2 \u06a9\u0627 \u0627\u0644\u06af\u0648\u0631\u062a\u06be\u0645 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u060c \u0627\u0648\u0631 \u06cc\u06c1 \u0648\u06c1 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2 \u062c\u0648 \u0688\u0648\u06cc\u0644\u067e\u0631 \u0646\u06d2 Stack Overflow \u06a9\u06d2 \u062c\u0648\u0627\u0628 \u0645\u06cc\u06ba \u067e\u0627\u06cc\u0627\u06d4 \u0627\u0633\u0679\u0627\u0641 \u06a9\u06cc \u0633\u0637\u062d \u06a9\u06d2 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06d2 \u0641\u06cc\u0635\u0644\u0648\u06ba \u06a9\u0648 \u06cc\u06c1 \u0628\u062a\u0627\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2 \u06a9\u06c1 \u06a9\u0648\u0646 \u0633\u06d2 \u0627\u0644\u06af\u0648\u0631\u062a\u06be\u0645\u060c \u0645\u0648\u0688\u0632\u060c \u0627\u0648\u0631 \u06a9\u0644\u06cc\u062f\u06cc \u0644\u0645\u0628\u0627\u0626\u06cc \u062a\u0646\u0638\u06cc\u0645\u06cc \u0645\u0639\u06cc\u0627\u0631\u0627\u062a \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u0627\u06cc\u0688\u06c1\u0627\u06a9 \u062e\u0641\u06cc\u06c1 \u06a9\u0627\u0631\u06cc \u06a9\u06d2 \u0627\u0646\u062a\u062e\u0627\u0628 \u0633\u06d2 \u067e\u06cc\u062f\u0627 \u06c1\u0648\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u062e\u0637\u0631\u0627\u062a \u0633\u0646\u06af\u06cc\u0646 \u06c1\u06cc\u06ba\u06d4 \u0627\u0646 \u0645\u06cc\u06ba \u067e\u06cc\u0688\u0646\u06af \u0627\u0648\u0631\u06cc\u06a9\u0644 \u0627\u0679\u06cc\u06a9\u060c \u06a9\u0645\u0632\u0648\u0631 \u06a9\u0644\u06cc\u062f \u06a9\u06cc \u0644\u0645\u0628\u0627\u0626\u06cc\u060c IV \u06a9\u0627 \u062f\u0648\u0628\u0627\u0631\u06c1 \u0627\u0633\u062a\u0639\u0645\u0627\u0644\u060c \u0627\u0648\u0631 \u0627\u0646\u06a9\u0631\u067e\u0634\u0646 \u0646\u0627\u06a9\u0627\u0645 \u06c1\u0648\u0646\u06d2 \u067e\u0631 \u0627\u0633\u0679\u06cc\u06a9 \u0679\u0631\u06cc\u0633 \u0634\u0627\u0645\u0644 \u06c1\u06cc\u06ba \u062c\u0648 \u06a9\u0627\u0644 \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u06a9\u0648 \u0627\u0646\u062f\u0631\u0648\u0646\u06cc \u0646\u0641\u0627\u0630 \u06a9\u06cc \u062a\u0641\u0635\u06cc\u0644\u0627\u062a \u0638\u0627\u06c1\u0631 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u0646\u0679\u0631\u0648\u0644\u0632: \u0627\u0646\u06a9\u0631\u067e\u0634\u0646 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0646\u062f\u0631\u0648\u0646\u06cc \u0637\u0648\u0631 \u067e\u0631 \u0628\u0646\u0627\u0626\u06d2 \u06af\u0626\u06d2 \u067e\u06cc\u06a9\u062c\u0632 \u06cc\u0627 \u06a9\u0644\u0627\u0624\u0688 \u0641\u0646\u06a9\u0634\u0646\u0632 \u06a9\u0648 \u0628\u06d2 \u0646\u0642\u0627\u0628 \u06a9\u0631\u06cc\u06ba \u062c\u0646\u06c1\u06cc\u06ba \u067e\u0631\u0648\u062c\u06cc\u06a9\u0679 \u0644\u0627\u06af\u0648 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0628\u062c\u0627\u0626\u06d2 \u062f\u0631\u0622\u0645\u062f \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0688\u0648\u06cc\u0644\u067e\u0631\u0632 \u067e\u06cc\u06a9\u062c\u0632 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06c1\u0645 \u06c1\u0631 \u067e\u0631\u0648\u062c\u06cc\u06a9\u0679 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0634\u0631\u0648\u0639 \u0633\u06d2 \u062e\u0641\u06cc\u06c1 \u06a9\u0627\u0631\u06cc \u0646\u06c1\u06cc\u06ba \u0644\u06a9\u06be\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h3 id=\"heading-sql-injection\">\u0627\u06cc\u0633 \u06a9\u06cc\u0648 \u0627\u06cc\u0644 \u0627\u0646\u062c\u06cc\u06a9\u0634\u0646<\/h3>\n<p>\u0627\u06cc\u0633 \u06a9\u06cc\u0648 \u0627\u06cc\u0644 \u0627\u0646\u062c\u06cc\u06a9\u0634\u0646 \u0644\u06af \u0628\u06be\u06af 25 \u0633\u0627\u0644 \u0633\u06d2 \u06c1\u06d2\u06d4 \u06cc\u06c1 1998 \u0633\u06d2 \u0645\u0648\u062c\u0648\u062f \u06c1\u06d2\u06d4 \u062a\u0627\u06c1\u0645\u060c \u06cc\u06c1 \u0627\u0628 \u0628\u06be\u06cc \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06d2 \u0645\u0639\u06cc\u0627\u0631\u0627\u062a \u0646\u0627\u0641\u0630 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u0627\u06cc\u0633\u0627 \u0627\u0633 \u0644\u06cc\u06d2 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u0688\u0648\u06cc\u0644\u067e\u0631\u0632 \u0627\u0633\u062a\u0641\u0633\u0627\u0631\u0627\u062a \u0644\u06a9\u06be\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0633\u0679\u0631\u0646\u06af \u06a9\u0646\u06a9\u0679\u0646\u06cc\u0634\u0646 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0635\u0627\u0631\u0641 \u06a9\u0627 \u0627\u0646 \u067e\u0679 \u0644\u06cc\u062a\u06d2 \u06c1\u06cc\u06ba \u0627\u0648\u0631 \u0627\u0633\u06d2 SQL \u0633\u0679\u0631\u0646\u06af \u0645\u06cc\u06ba \u062c\u0648\u0691\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u062a\u0631\u0645\u06cc\u0645 \u06c1\u0645\u06cc\u0634\u06c1 \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0627\u0626\u0632\u0688 \u0633\u0648\u0627\u0644\u0627\u062a \u06cc\u0627 \u062a\u06cc\u0627\u0631 \u0628\u06cc\u0627\u0646\u0627\u062a \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u062e\u0627\u0645 SQL \u0633\u0679\u0631\u0646\u06af\u0632 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2 \u062c\u0633 \u0645\u06cc\u06ba \u0635\u0627\u0631\u0641 \u06a9\u06d2 \u0627\u0646 \u067e\u0679 \u06a9\u0648 \u0645\u0631\u0628\u0648\u0637 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u06d4<\/p>\n<p><strong>\u0688\u0627\u0631\u0679:<\/strong><\/p>\n<pre><code class=\"language-dart\">\/\/Wrong  string concatenation \u2014 SQL injection vulnerability\nFuture<user> findUser(String email) async {\n  final query = \"SELECT * FROM users WHERE email=\"$email\"\";\n  \/\/ attacker passes: admin@example.com' OR '1'='1\n  \/\/ query becomes: SELECT * FROM users WHERE email=\"admin@example.com\" OR '1'='1'\n  \/\/ returns all users\n  return await database.rawQuery(query);\n}\n\n\/\/ parameterized query \u2014 injection proof\nFuture<user> findUser(String email) async {\n  final results = await database.query(\n    'users',\n    where: 'email = ?',    \n    whereArgs: [email],     \n  );\n  return results.isNotEmpty ? User.fromMap(results.first) : null;\n}\n<\/user><\/user><\/code><\/pre>\n<p><strong>aspirate#:<\/strong><\/p>\n<pre><code class=\"language-csharp\">\/\/ Wrong string concatenation\npublic async Task<user> FindUser(string email)\n{\n    var query = $\"SELECT * FROM Users WHERE Email=\"{email}\"\";\n    return await _context.Users.FromSqlRaw(query).FirstOrDefaultAsync();\n}\n\n\/\/ Correct parameterized query using EF Core\npublic async Task<user> FindUser(string email)\n{\n    return await _context.Users\n        .Where(u => u.Email == email)\n        .FirstOrDefaultAsync();\n}\n\n\/\/ Correct parameterized raw SQL when needed\npublic async Task<user> FindUserRaw(string email)\n{\n    return await _context.Users\n        .FromSqlRaw(\"SELECT * FROM Users WHERE Email = {0}\", email)\n        .FirstOrDefaultAsync();\n}\n<\/user><\/user><\/user><\/code><\/pre>\n<p>\u06cc\u06c1 \u0627\u06cc\u06a9 \u0628\u0691\u0627 \u062e\u0637\u0631\u06c1 \u06c1\u06d2 \u062c\u0648 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06d2 \u0628\u0646\u06cc\u0627\u062f\u06cc \u0641\u06cc\u0635\u0644\u0648\u06ba \u0633\u06d2 \u067e\u06cc\u062f\u0627 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u062c\u0648 \u0633\u062e\u062a \u062d\u06a9\u0645\u0631\u0627\u0646\u06cc \u0627\u0648\u0631 \u062a\u0639\u0645\u06cc\u0644 \u06a9\u06d2 \u0627\u0635\u0648\u0644\u0648\u06ba \u06a9\u06d2 \u062a\u0627\u0628\u0639 \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4 \u06cc\u06c1 \u0627\u0635\u0648\u0644 \u0645\u0646\u0635\u0648\u0628\u0648\u06ba \u0627\u0648\u0631 \u062a\u0646\u0638\u06cc\u0645\u0648\u06ba \u06a9\u06d2 \u0644\u06cc\u06d2 \u062a\u0631\u0642\u06cc\u0627\u062a\u06cc \u0645\u0639\u06cc\u0627\u0631 \u0642\u0627\u0626\u0645 \u06a9\u0631\u0646\u06d2 \u0645\u06cc\u06ba \u0645\u062f\u062f \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u0627\u0633\u06d2 CI CD \u06a9\u06cc \u0633\u0637\u062d \u067e\u0631 \u0628\u06be\u06cc \u0644\u0627\u06af\u0648 \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u06af\u0631 \u0622\u067e \u06a9\u06cc CI\/CD \u067e\u0627\u0626\u067e \u0644\u0627\u0626\u0646 \u06a9\u0627 \u062c\u0627\u0645\u062f \u062a\u062c\u0632\u06cc\u06c1 \u062e\u0627\u0645 SQL \u0633\u0679\u0631\u0646\u06af \u06a9\u0646\u06a9\u0679\u0646\u06cc\u0634\u0646 \u06a9\u0648 \u062d\u0627\u0635\u0644 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 \u0622\u067e \u06a9\u06cc \u0679\u06cc\u0645 \u06a9\u0648 \u0627\u0633\u06d2 \u0634\u0627\u0645\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u06af\u06cc\u06d4 \u06cc\u06c1 \u06a9\u0645\u0632\u0648\u0631\u06cc\u0648\u06ba \u06a9\u0627 \u0627\u06cc\u06a9 \u0637\u0628\u0642\u06c1 \u06c1\u06d2 \u062c\u0648 \u06a9\u0628\u06be\u06cc \u0628\u06be\u06cc \u067e\u06cc\u062f\u0627\u0648\u0627\u0631 \u062a\u06a9 \u0646\u06c1\u06cc\u06ba \u067e\u06c1\u0646\u0686\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/p>\n<h2 id=\"heading-conclusion\">\u0646\u062a\u06cc\u062c\u06c1<\/h2>\n<p>\u0627\u0633 \u0641\u06c1\u0631\u0633\u062a \u0645\u06cc\u06ba \u0645\u0648\u062c\u0648\u062f \u062a\u0645\u0627\u0645 \u062e\u0637\u0631\u0627\u062a \u0645\u06cc\u06ba \u0627\u06cc\u06a9 \u0686\u06cc\u0632 \u0645\u0634\u062a\u0631\u06a9 \u06c1\u06d2: \u0631\u0648\u06a9 \u062a\u06be\u0627\u0645 \u0645\u0645\u06a9\u0646 \u06c1\u06d2\u06d4 \u06cc\u06c1 \u062d\u0642\u06cc\u0642\u062a \u06a9\u06d2 \u0628\u0639\u062f \u0644\u0627\u06af\u0648 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0679\u0648\u0644\u0632 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06c1 \u0646\u06c1\u06cc\u06ba \u0628\u0644\u06a9\u06c1 \u0688\u06cc\u0632\u0627\u0626\u0646 \u0627\u0648\u0631 \u062a\u0631\u0642\u06cc \u06a9\u06d2 \u062f\u0648\u0631\u0627\u0646 \u0644\u0627\u06af\u0648 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06d2 \u0645\u0636\u0627\u0645\u06cc\u0646 \u0633\u06d2 \u062d\u0627\u0635\u0644 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<ul>\n<li>\n<p>BOLA \u06a9\u0648 \u0633\u0631\u0648\u0633 \u0644\u06cc\u0626\u0631 \u067e\u0631 \u0634\u0646\u0627\u062e\u062a \u0633\u06d2 \u0622\u06af\u0627\u06c1 \u062a\u0648\u062b\u06cc\u0642 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0631\u0648\u06a9\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0645\u0646\u0627\u0633\u0628 \u0679\u0648\u06a9\u0646 \u0688\u06cc\u0632\u0627\u0626\u0646 \u0627\u0648\u0631 \u0634\u0631\u062d \u06a9\u0648 \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u0633\u0645\u062c\u06be\u0648\u062a\u06c1 \u0634\u062f\u06c1 \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0648 \u0631\u0648\u06a9\u0646\u06d2 \u0645\u06cc\u06ba \u0645\u062f\u062f \u0645\u0644 \u0633\u06a9\u062a\u06cc \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>BOPLA \u06a9\u0648 \u0627\u06cc\u06a9 \u0648\u0627\u0636\u062d \u062c\u0648\u0627\u0628 DTO \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0631\u0648\u06a9\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u06af\u06cc\u0679 \u0648\u06d2 \u067e\u0631 \u0631\u06cc\u0679 \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u0646\u0627 \u0648\u0633\u0627\u0626\u0644 \u06a9\u06d2 \u063a\u06cc\u0631 \u0645\u062d\u062f\u0648\u062f \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0648 \u0631\u0648\u06a9\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>BFLA \u06a9\u0648 \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u0631\u0648\u0644 \u0686\u06cc\u06a9\u0646\u06af \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0631\u0648\u06a9\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u060c UI \u0645\u06cc\u06ba \u0646\u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u062d\u0633\u0627\u0633 \u06a9\u0627\u0631\u0648\u0628\u0627\u0631\u06cc \u0628\u06c1\u0627\u0624 \u06a9\u06cc \u0646\u0645\u0627\u0626\u0634 \u06a9\u0648 \u0688\u0648\u0645\u06cc\u0646 \u0645\u0631\u06a9\u0648\u0632 \u0688\u06cc\u0632\u0627\u0626\u0646 \u0627\u0648\u0631 \u0645\u0646\u0627\u0633\u0628 \u06a9\u0627\u0631\u0648\u0628\u0627\u0631\u06cc \u0627\u0635\u0648\u0644 \u06a9\u06d2 \u0646\u0641\u0627\u0630 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0631\u0648\u06a9\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u062d\u0641\u0627\u0638\u062a\u06cc \u063a\u0644\u0637 \u06a9\u0646\u0641\u06cc\u06af\u0631\u06cc\u0634\u0646\u0632 \u06a9\u0648 \u062e\u0648\u062f\u06a9\u0627\u0631 \u06af\u06cc\u0679\u0633 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0645\u0627\u062d\u0648\u0644 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0645\u062e\u0635\u0648\u0635 \u067e\u0627\u0626\u067e \u0644\u0627\u0626\u0646\u0648\u06ba \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0631\u0648\u06a9\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0631\u0633\u0645\u06cc API \u0644\u0627\u0626\u0641 \u0633\u0627\u0626\u06cc\u06a9\u0644 \u0645\u0644\u06a9\u06cc\u062a \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0627\u0646\u0648\u06cc\u0646\u0679\u0631\u06cc \u06a9\u06d2 \u063a\u0644\u0637 \u0627\u0646\u062a\u0638\u0627\u0645 \u06a9\u0648 \u0631\u0648\u06a9\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0645\u0639\u0627\u06c1\u062f\u06d2 \u06a9\u06d2 \u067e\u06c1\u0644\u06d2 \u0628\u06cc\u0631\u0648\u0646\u06cc \u0627\u0646\u0636\u0645\u0627\u0645 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u063a\u06cc\u0631 \u0645\u062d\u0641\u0648\u0638 APIs \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u06af\u0631\u06cc\u0632 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>SSRF \u06a9\u0648 \u0688\u06cc\u0632\u0627\u0626\u0646 \u06a9\u06d2 \u0641\u06cc\u0635\u0644\u06d2 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 URL \u0648\u0627\u0626\u0679 \u0644\u0633\u0679\u0646\u06af \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0631\u0648\u06a9\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<\/ul>\n<p>\u067e\u06cc\u0679\u0631\u0646 \u0645\u0633\u0644\u0633\u0644 \u06c1\u06d2. \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0627\u06cc\u0633\u06cc \u0686\u06cc\u0632 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2 \u062c\u0633\u06d2 \u0622\u067e \u0627\u067e\u0646\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0645\u06cc\u06ba \u0634\u0627\u0645\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06cc\u06c1 \u0648\u06c1 \u0686\u06cc\u0632 \u06c1\u06d2 \u062c\u0633\u06d2 \u06c1\u0645 \u0632\u0645\u06cc\u0646 \u0633\u06d2 \u0627\u067e\u0646\u06d2 \u0641\u0646 \u062a\u0639\u0645\u06cc\u0631 \u0645\u06cc\u06ba \u0627\u0646\u062c\u06cc\u0646\u0626\u0631 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0627\u0633 \u062f\u0633\u062a\u0627\u0648\u06cc\u0632 \u0645\u06cc\u06ba \u062a\u0645\u0627\u0645 \u0641\u06cc\u0635\u0644\u06d2 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06d2 \u0641\u06cc\u0635\u0644\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06cc\u06c1 \u0686\u06cc\u06a9 \u0641\u0646 \u062a\u0639\u0645\u06cc\u0631 \u0645\u06cc\u06ba \u06a9\u06c1\u0627\u06ba \u0633\u06d2 \u062a\u0639\u0644\u0642 \u0631\u06a9\u06be\u062a\u0627 \u06c1\u06d2\u061f \u0627\u0633 \u062a\u0635\u062f\u06cc\u0642 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0648\u0646 \u0633\u06cc \u067e\u0631\u062a \u0630\u0645\u06c1 \u062f\u0627\u0631 \u06c1\u06d2\u061f \u0688\u0648\u0645\u06cc\u0646 \u06a9\u06cc\u0627 \u0646\u0627\u0641\u0630 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u061f \u06af\u06cc\u0679 \u0648\u06d2 \u06a9\u06cc\u0627 \u0646\u0627\u0641\u0630 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u061f \u067e\u0627\u0626\u067e \u0644\u0627\u0626\u0646 \u06a9\u06cc\u0627 \u067e\u06a9\u0691\u062a\u06cc \u06c1\u06d2\u061f<\/p>\n<p>\u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0688\u06cc\u0632\u0627\u0626\u0646 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0679\u06cc\u0645 \u06a9\u06cc \u0630\u0645\u06c1 \u062f\u0627\u0631\u06cc \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u0679\u06cc\u0645 \u06a9\u06cc \u0630\u0645\u06c1 \u062f\u0627\u0631\u06cc \u06c1\u06d2\u06d4 \u0627\u0648\u0631 \u06cc\u06c1 \u0627\u0633 \u0628\u0627\u062a \u06a9\u0648 \u0633\u0645\u062c\u06be\u0646\u06d2 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0634\u0631\u0648\u0639 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u06cc\u06c1 \u06a9\u0645\u0632\u0648\u0631\u06cc\u0627\u06ba \u06a9\u06cc\u0627 \u06c1\u06cc\u06ba\u060c \u06cc\u06c1 \u06a9\u06c1\u0627\u06ba \u0633\u06d2 \u0622\u062a\u06cc \u06c1\u06cc\u06ba\u060c \u0627\u0648\u0631 \u0627\u0646 \u06a9\u0648 \u0631\u0648\u06a9\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0646\u06af \u06a9\u06d2 \u06a9\u0648\u0646 \u0633\u06d2 \u0645\u0639\u06cc\u0627\u0631\u0627\u062a \u0645\u0648\u062c\u0648\u062f \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u0633\u0627\u0641\u0679 \u0648\u06cc\u0626\u0631 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0632 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631\u060c \u0627\u0633 \u0642\u0633\u0645 \u06a9\u06cc \u0627\u06af\u0644\u06cc \u0633\u0637\u062d \u06a9\u06cc \u0633\u0648\u0686 \u0627\u0633 \u0628\u0627\u062a \u06a9\u0648 \u06cc\u0642\u06cc\u0646\u06cc \u0628\u0646\u0627\u062a\u06cc \u06c1\u06d2 \u06a9\u06c1 \u06c1\u0645\u0627\u0631\u0627 \u06a9\u0648\u0688 \u0627\u0646 \u062d\u0641\u0627\u0638\u062a\u06cc \u0679\u06cc\u0633\u0679\u0648\u06ba \u0645\u06cc\u06ba \u06a9\u0628\u06be\u06cc \u0646\u0627\u06a9\u0627\u0645 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0645\u062d\u0641\u0648\u0638 \u06a9\u0648\u0688\u0646\u06af \u06a9\u0627 \u0644\u0637\u0641 \u0627\u0679\u06be\u0627\u0626\u06cc\u06ba!<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>\u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0645\u0636\u0627\u0645\u06cc\u0646 \u062e\u0637\u0631\u06d2 \u06a9\u06cc \u0631\u067e\u0648\u0631\u0679\u0648\u06ba \u06a9\u06cc \u0637\u0631\u062d \u067e\u0691\u06be\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06cc\u06c1 \u0628\u0627\u06c1\u0631 \u0633\u06d2 \u0627\u0646\u062f\u0631 \u062f\u06cc\u06a9\u06be \u06a9\u0631 \u06a9\u0645\u0632\u0648\u0631\u06cc\u0648\u06ba \u06a9\u06cc \u0648\u0636\u0627\u062d\u062a \u06a9\u0631\u062a\u0627 \u06c1\u06d2: \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u06a9\u06cc\u0627 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0627\u0633 \u06a9\u0627 \u06a9\u06cc\u0627 \u0627\u062b\u0631 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0639\u0627\u0644\u0645\u06cc \u0633\u0637\u062d \u067e\u0631 \u06a9\u062a\u0646\u06d2 \u0646\u0638\u0627\u0645 \u0645\u062a\u0627\u062b\u0631 \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06cc\u06c1 \u0645\u0641\u06cc\u062f \u0633\u06cc\u0627\u0642 \u0648 \u0633\u0628\u0627\u0642 \u06c1\u06d2\u060c \u0644\u06cc\u06a9\u0646 \u06cc\u06c1 \u0627\u0646\u062c\u06cc\u0646\u0626\u0631\u0632 \u06a9\u0648 \u0628\u06c1\u062a\u0631 \u0646\u0638\u0627\u0645 \u0628\u0646\u0627\u0646\u06d2 [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-30479","post","type-post","status-publish","format-standard","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/posts\/30479","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/comments?post=30479"}],"version-history":[{"count":0,"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/posts\/30479\/revisions"}],"wp:attachment":[{"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/media?parent=30479"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/categories?post=30479"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/tags?post=30479"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}