19. Security Basics for System Design

Header.Payload.Signature

Header:   {"alg": "RS256", "typ": "JWT"}
Payload:  {"sub": "user-123", "role": "admin", "exp": 1705312800}
Signature: HMAC-SHA256(base64(header) + "." + base64(payload), secret)

Client → Login (username/password) → Auth Service
Auth Service → Verify credentials → Issue JWT → Client
Client → Request + JWT (Authorization: Bearer <token>) → API Service
API Service → Verify JWT signature → Extract claims → Process request

Authorization Code Flow:
1. Client → Auth Server: "User wants to log in" (redirect)
2. Auth Server → User: "Enter credentials" (login page)
3. User → Auth Server: Credentials
4. Auth Server → Client: Authorization Code (redirect)
5. Client → Auth Server: Exchange code for tokens (server-side)
6. Auth Server → Client: Access Token + Refresh Token

Roles:
  admin  → [read, write, delete, manage_users]
  editor → [read, write]
  viewer → [read]

Users:
  Alice → admin
  Bob   → editor
  Carol → viewer

Request: Bob tries to DELETE /resource/123
→ Bob has role "editor" → "editor" doesn't have "delete" → 403 Forbidden

Application → Plaintext → [Encryption (AES-256)] → Ciphertext → Disk
Disk → Ciphertext → [Decryption] → Plaintext → Application

Client ←─[TLS 1.3]─→ Server
Service A ←─[mTLS]─→ Service B

-- Vulnerable:
query = "SELECT * FROM users WHERE id = " + user_input
-- Attacker input: "1; DROP TABLE users;--"

-- Safe: Parameterized queries
query = "SELECT * FROM users WHERE id = $1"
params = [user_input]

<!-- Vulnerable: -->
<p>Welcome, ${user_input}</p>
<!-- Attacker input: <script>steal_cookies()</script> -->

<!-- Safe: Escape output -->
<p>Welcome, ${escape(user_input)}</p>

Attacker site → Hidden form → POST to victim.com/transfer?amount=10000
  (using victim's authenticated session cookie)

Mitigation: CSRF tokens, SameSite cookies, checking Origin header.

Millions of requests → Your server → Overloaded → Legitimate users can't access

Mitigation:
- CDN (Cloudflare, AWS Shield)
- Rate limiting
- Auto-scaling
- WAF (Web Application Firewall)
- Anycast routing (distribute attack traffic)

Client ←─[unencrypted]─→ Attacker ←─→ Server

Mitigation: TLS everywhere, certificate pinning, HSTS.

Internet → [WAF] → [Load Balancer] → [Security Group: Allow port 443]
                                          ↓
                                    [App Servers]
                                    [SG: Allow port 8080 from LB only]
                                          ↓
                                    [Database]
                                    [SG: Allow port 5432 from App only]