prikaz prve stranice dokumenta Sigurna komunikacija između Web programa
No public access
master's thesis
Sigurna komunikacija između Web programa
Zagreb: University of Zagreb, Faculty of Electrical Engineering and Computing, 2019. urn:nbn:hr:168:412957
Žigrović, Dominik
University of Zagreb
Faculty of Electrical Engineering and Computing

Institutional repository: FER Repository

Cite this document

Žigrović, D. (2019). Sigurna komunikacija između Web programa (Master's thesis). Zagreb: University of Zagreb, Faculty of Electrical Engineering and Computing. Retrieved from https://urn.nsk.hr/urn:nbn:hr:168:412957

Žigrović, Dominik. "Sigurna komunikacija između Web programa." Master's thesis, University of Zagreb, Faculty of Electrical Engineering and Computing, 2019. https://urn.nsk.hr/urn:nbn:hr:168:412957

Žigrović, Dominik. "Sigurna komunikacija između Web programa." Master's thesis, University of Zagreb, Faculty of Electrical Engineering and Computing, 2019. https://urn.nsk.hr/urn:nbn:hr:168:412957

Žigrović, D. (2019). 'Sigurna komunikacija između Web programa', Master's thesis, University of Zagreb, Faculty of Electrical Engineering and Computing, accessed 24 June 2024, https://urn.nsk.hr/urn:nbn:hr:168:412957

Žigrović D. Sigurna komunikacija između Web programa [Master's thesis]. Zagreb: University of Zagreb, Faculty of Electrical Engineering and Computing; 2019 [cited 2024 June 24] Available at: https://urn.nsk.hr/urn:nbn:hr:168:412957

D. Žigrović, "Sigurna komunikacija između Web programa", Master's thesis, University of Zagreb, Faculty of Electrical Engineering and Computing, Zagreb, 2019. Available at: https://urn.nsk.hr/urn:nbn:hr:168:412957

Metadata
TitleSigurna komunikacija između Web programa
Title (english)Secure Communication between Web Applications
AuthorDominik Žigrović
MentorMarin Golub (mentor)
Committee memberMarin Golub (predsjednik povjerenstva)
Committee memberDomagoj Jakobović (član povjerenstva)
Committee memberStjepan Groš (član povjerenstva)
GranterUniversity of Zagreb
Faculty of Electrical Engineering and Computing
Zagreb
Defense date and country2019-07-04, Croatia
Scientific / art field,
discipline and subdiscipline		TECHNICAL SCIENCES
Computing
Abstract
Jedan od temelja sigurnosti Web-a je politika jednake izvornosti. Po njoj, stranice smiju komunicirati jedino ako imaju zajednički protokol, vrata i host. Međutim, to može u nekim slučajevima biti vrlo ograničavajuće za stranice. U ovom radu je prvo objašnjena politika jednake izvornosti, a zatim dani načini njezinog zaobilaženja. Ovisno o aspektu na koji se oni odnose, koriste se različite metode: za komunikaciju između stranica svojstvo stranice document.domain i funkcija window.postMessage, a za komunikaciju preko HTTP zahtjeva metoda JSONP i protokol CORS. Oni su također objašnjeni u ovom radu. Nakon toga je dan pregled najčešćih napada vezanih za politiku jednake izvornosti i objašnjenja na koji način ih korištenje ovih metoda može omogućiti. Kao dodatak radu, razvijena je i biblioteka koja omogućuje sigurnu komunikaciju između aplikacije i drugih aplikacija na različitim izvornostima (koristeći metodu window.postMessage), kao i aplikacija koja demonstrira korištenje te biblioteke. Obje aplikacije su javno dostupne, a u radu su opisane njihove tehničke specifikacije.
Abstract (english)
One of the cornerstones of Web security is the Same-origin policy. It allows Web pages to communicate only if they share the same protocol, host and port. However, in some cases, this can be quite limiting. This thesis firstly explains the Same-origin policy and then gives ways of achieving cross-origin access. Depending on the aspect of the Web this relates to, different methods can be used: for communication between Web pages, the document.domain property and the window.postMessage function, and for HTTP communication the JSONP and CORS protocols can be used. These are also covered in this thesis. After that, an overview of attacks connected to the Same-origin policy is given, as well as an explanation of how using the cross-origin communication methods can make the application vulnerable to them. In addition to this thesis, a library for secure communication between an application and other applications having different origins (using the window.postMessage method) was created, as well as an application to demonstrate its usage. Both of these applications are freely available, and their technical specifications are given in this thesis.
Keywords
Keywords (english)
Languagecroatian
URN:NBNurn:nbn:hr:168:412957
Study programmeTitle: Computing
Study programme type: university
Study level: graduate
Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
Type of resourceText
File originBorn digital
Access conditionsClosed access
Terms of useLicence In copyright icon
Public note
Created on2020-01-07 23:11:49