Modern yaz\u0131l\u0131m d\u00fcnyas\u0131nda, uygulamalar\u0131n g\u00fcvenli\u011fi her zamankinden daha kritik bir \u00f6neme sahip. Bu g\u00fcvenli\u011fin temel ta\u015flar\u0131ndan biri de \u015f\u00fcphesiz kimlik do\u011frulamad\u0131r. Geli\u015ftiriciler olarak, kullan\u0131c\u0131lar\u0131m\u0131z\u0131n kimli\u011fini g\u00fcvenli bir \u015fekilde nas\u0131l do\u011frulayaca\u011f\u0131m\u0131z\u0131 anlamak, yaln\u0131zca veri ihlallerini \u00f6nlemekle kalmaz, ayn\u0131 zamanda kullan\u0131c\u0131lar\u0131m\u0131za g\u00fcvenilir bir deneyim sunmam\u0131z\u0131 sa\u011flar. Bu rehber, kimlik do\u011frulaman\u0131n temel prensiplerinden modern yakla\u015f\u0131mlar\u0131na kadar uzanan geni\u015f bir yelpazeyi ele alarak, bu karma\u015f\u0131k konuyu basitle\u015ftirmeyi hedefliyor.<\/p>\n
Kimlik do\u011frulama (Authentication), bir kullan\u0131c\u0131n\u0131n, sistemin veya servisin iddia etti\u011fi ki\u015fi veya varl\u0131k oldu\u011funu kan\u0131tlama s\u00fcrecidir. Bu s\u00fcre\u00e7 genellikle bir kimlik (kullan\u0131c\u0131 ad\u0131, e-posta) ve bir do\u011frulay\u0131c\u0131 (\u015fifre, biyometrik veri, OTP) kombinasyonu ile ger\u00e7ekle\u015ftirilir. Ama\u00e7, sisteme eri\u015fim talep eden taraf\u0131n ger\u00e7ekten yetkili olup olmad\u0131\u011f\u0131n\u0131 teyit etmektir. K\u0131sacas\u0131, “Sen kim oldu\u011funu iddia ediyorsan, o musun?” sorusuna yan\u0131t arar.<\/p>\n
Kimlik do\u011frulama, bir uygulaman\u0131n g\u00fcvenlik mimarisinin ilk savunma hatt\u0131d\u0131r. Yanl\u0131\u015f veya zay\u0131f bir kimlik do\u011frulama mekanizmas\u0131, yetkisiz eri\u015fime, veri ihlallerine, doland\u0131r\u0131c\u0131l\u0131\u011fa ve itibar kayb\u0131na yol a\u00e7abilir. Kullan\u0131c\u0131 verilerinin gizlili\u011fini ve b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc korumak, yasal d\u00fczenlemelere (GDPR, KVKK vb.) uyum sa\u011flamak ve genel sistem g\u00fcvenli\u011fini sa\u011flamak i\u00e7in sa\u011flam bir kimlik do\u011frulama altyap\u0131s\u0131 vazge\u00e7ilmezdir. G\u00fcvenli bir kimlik do\u011frulama, kullan\u0131c\u0131lar\u0131n uygulamaya olan g\u00fcvenini de art\u0131r\u0131r.<\/p>\n
Tipik bir kimlik do\u011frulama ak\u0131\u015f\u0131 a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 i\u00e7erir:<\/p>\n
En yayg\u0131n ve bilinen kimlik do\u011frulama y\u00f6ntemidir. Kullan\u0131c\u0131lar bir kullan\u0131c\u0131 ad\u0131 (veya e-posta) ve bu kimli\u011fe \u00f6zel bir \u015fifre belirler. Sisteme giri\u015f yaparken bu bilgileri sunarlar. G\u00fcvenli\u011fi, b\u00fcy\u00fck \u00f6l\u00e7\u00fcde \u015fifrelerin karma\u015f\u0131kl\u0131\u011f\u0131na, kullan\u0131c\u0131lar\u0131n \u015fifrelerini nas\u0131l y\u00f6netti\u011fine ve sistemin \u015fifreleri nas\u0131l saklad\u0131\u011f\u0131na ba\u011fl\u0131d\u0131r. \u015eifrelerin asla d\u00fcz metin olarak saklanmamas\u0131, bunun yerine g\u00fc\u00e7l\u00fc tek y\u00f6nl\u00fc hash algoritmalar\u0131 (bcrypt, Argon2 gibi) ile hashlenip tuzlanarak (salting) depolanmas\u0131 esast\u0131r.<\/p>\n
\/\/ \u00d6rnek: Node.js'te bcrypt ile \u015fifre hashleme\nconst bcrypt = require('bcrypt');\nconst saltRounds = 10; \/\/ Tuzlama turu say\u0131s\u0131\n\nasync function hashPassword(plainPassword) {\n try {\n const hashedPassword = await bcrypt.hash(plainPassword, saltRounds);\n return hashedPassword;\n } catch (error) {\n console.error(\"\u015eifre hashlenirken hata olu\u015ftu:\", error);\n throw error;\n }\n}\n\nasync function comparePassword(plainPassword, hashedPassword) {\n try {\n const match = await bcrypt.compare(plainPassword, hashedPassword);\n return match;\n } catch (error) {\n console.error(\"\u015eifre kar\u015f\u0131la\u015ft\u0131r\u0131l\u0131rken hata olu\u015ftu:\", error);\n throw error;\n }\n}\n\n\/\/ Kullan\u0131m \u00f6rne\u011fi\n\/\/ hashPassword(\"gizliSifre123!\").then(hash => console.log(hash));\n\/\/ comparePassword(\"gizliSifre123!\", \"$2b$10$EXAMPLEHASH\").then(match => console.log(match));\n<\/pre>\n<\/code><\/p>\n
API Anahtarlar\u0131 (API Keys)<\/h3>\n
Genellikle sunucudan sunucuya veya uygulama entegrasyonlar\u0131nda kullan\u0131lan basit bir kimlik do\u011frulama y\u00f6ntemidir. Bir API anahtar\u0131, genellikle uzun, rastgele olu\u015fturulmu\u015f bir dizedir ve bir istemcinin belirli bir API'ye eri\u015fim yetkisini temsil eder. Anahtarlar HTTP ba\u015fl\u0131klar\u0131nda, sorgu parametrelerinde veya istek g\u00f6vdesinde g\u00f6nderilebilir. Ancak, anahtarlar\u0131n do\u011frudan yetkilendirme bilgisi i\u00e7ermesi ve kolayca \u00e7al\u0131nabilme riski nedeniyle dikkatli kullan\u0131lmal\u0131, \u00f6zellikle hassas i\u015flemler i\u00e7in daha g\u00fc\u00e7l\u00fc y\u00f6ntemler tercih edilmelidir.<\/p>\n
Temel HTTP Kimlik Do\u011frulama (Basic HTTP Authentication)<\/h3>\n
HTTP protokol\u00fcn\u00fcn bir par\u00e7as\u0131 olan bu y\u00f6ntem, kullan\u0131c\u0131 ad\u0131 ve \u015fifrenin Base64 ile kodlanarak HTTP Authorization<\/code> ba\u015fl\u0131\u011f\u0131nda g\u00f6nderilmesine dayan\u0131r (Authorization: Basic <\/code>). Basitli\u011fi nedeniyle baz\u0131 durumlarda kullan\u0131lsa da, Base64 bir \u015fifreleme y\u00f6ntemi de\u011fil, sadece kodlama y\u00f6ntemidir. Bu nedenle, hassas bilgilerin aktar\u0131m\u0131 i\u00e7in mutlaka HTTPS ile birlikte kullan\u0131lmal\u0131d\u0131r, aksi takdirde kolayca ele ge\u00e7irilebilir.<\/p>\nModern Kimlik Do\u011frulama Protokolleri ve Ak\u0131\u015flar\u0131<\/h2>\nOAuth 2.0 ve OpenID Connect<\/h3>\n
OAuth 2.0, yetkilendirme i\u00e7in bir \u00e7er\u00e7evedir, kimlik do\u011frulama i\u00e7in de\u011fil. Kullan\u0131c\u0131n\u0131n, bir uygulaman\u0131n ba\u015fka bir servisteki (\u00f6rne\u011fin Google, Facebook) kaynaklar\u0131na eri\u015fmesine izin vermesini sa\u011flar. OpenID Connect (OIDC) ise OAuth 2.0 \u00fczerine in\u015fa edilmi\u015f bir kimlik do\u011frulama katman\u0131d\u0131r. OIDC, kullan\u0131c\u0131lar\u0131n kimli\u011fini do\u011frulamak ve bu kimlik hakk\u0131nda temel profil bilgilerini (ad\u0131, e-postas\u0131 vb.) g\u00fcvenli bir \u015fekilde almak i\u00e7in kullan\u0131l\u0131r. \"Google ile Giri\u015f Yap\" veya \"Facebook ile Giri\u015f Yap\" gibi se\u00e7enekler genellikle OIDC kullan\u0131r.<\/p>\n
JSON Web Token (JWT)<\/h3>\n
JWT, taraflar aras\u0131nda g\u00fcvenli bir \u015fekilde bilgi iletmek i\u00e7in kullan\u0131lan s\u0131k\u0131\u015ft\u0131r\u0131lm\u0131\u015f, URL g\u00fcvenli bir belirte\u00e7tir. \u00dc\u00e7 b\u00f6l\u00fcmden olu\u015fur: Ba\u015fl\u0131k (Header), Y\u00fck (Payload) ve \u0130mza (Signature). Ba\u015fl\u0131k, belirtecin t\u00fcr\u00fcn\u00fc ve kullan\u0131lan \u015fifreleme algoritmas\u0131n\u0131 i\u00e7erir. Y\u00fck, kullan\u0131c\u0131n\u0131n kimli\u011fi, yetkileri gibi iddialar\u0131 (claims) bar\u0131nd\u0131r\u0131r. \u0130mza ise belirtecin b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc do\u011frulamak i\u00e7in kullan\u0131l\u0131r ve bir gizli anahtar ile olu\u015fturulur. JWT'ler, \u00f6zellikle API tabanl\u0131 uygulamalarda ve mikroservis mimarilerinde oturum y\u00f6netimi i\u00e7in pop\u00fclerdir.<\/p>\n
\/\/ \u00d6rnek JWT yap\u0131s\u0131 (Ba\u015fl\u0131k ve Y\u00fck)\n\/\/ Ba\u015fl\u0131k (Header)\n{\n \"alg\": \"HS256\", \/\/ Algoritma: HMAC SHA256\n \"typ\": \"JWT\" \/\/ Tip: JSON Web Token\n}\n\n\/\/ Y\u00fck (Payload)\n{\n \"sub\": \"1234567890\", \/\/ Konu (Subject): Kullan\u0131c\u0131 ID'si\n \"name\": \"Jane Doe\", \/\/ Kullan\u0131c\u0131 Ad\u0131\n \"iat\": 1516239022, \/\/ Yay\u0131nlanma Zaman\u0131 (Issued At)\n \"exp\": 1516242622, \/\/ Son Kullanma Zaman\u0131 (Expiration Time)\n \"isAdmin\": true \/\/ \u00d6zel iddia (Custom Claim)\n}\n<\/pre>\n<\/code><\/p>\n
\u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA)<\/h3>\n
MFA, bir kullan\u0131c\u0131n\u0131n kimli\u011fini do\u011frulamak i\u00e7in birden fazla ba\u011f\u0131ms\u0131z do\u011frulama fakt\u00f6r\u00fc gerektiren bir g\u00fcvenlik mekanizmas\u0131d\u0131r. Genellikle \"bildi\u011fin bir \u015fey\" (\u015fifre), \"sahip oldu\u011fun bir \u015fey\" (telefon, donan\u0131m belirteci) ve \"oldu\u011fun bir \u015fey\" (parmak izi, y\u00fcz tan\u0131ma) kategorilerinden en az ikisini birle\u015ftirir. MFA, tek bir fakt\u00f6r\u00fcn ele ge\u00e7irilmesi durumunda bile hesab\u0131n g\u00fcvende kalmas\u0131n\u0131 sa\u011flayarak g\u00fcvenlik seviyesini \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131r\u0131r. SMS OTP, do\u011frulay\u0131c\u0131 uygulamalar (Google Authenticator), biyometrikler yayg\u0131n MFA \u00f6rnekleridir.<\/p>\n
Kimlik Do\u011frulama G\u00fcvenli\u011fi \u0130\u00e7in En \u0130yi Uygulamalar<\/h2>\n\u015eifre Y\u00f6netimi ve G\u00fcvenli\u011fi<\/h3>\n\n- G\u00fc\u00e7l\u00fc \u015eifre Politikalar\u0131:<\/strong> Kullan\u0131c\u0131lardan karma\u015f\u0131k, uzun ve benzersiz \u015fifreler olu\u015fturmalar\u0131n\u0131 isteyin.<\/li>\n
- \u015eifre Hashleme ve Tuzlama:<\/strong> \u015eifreleri asla d\u00fcz metin olarak saklamay\u0131n. bcrypt, Argon2 gibi algoritmalarla hashleyip tuzlayarak depolay\u0131n.<\/li>\n
- \u015eifre S\u0131f\u0131rlama Mekanizmalar\u0131:<\/strong> G\u00fcvenli ve tek kullan\u0131ml\u0131k token'lar ile \u015fifre s\u0131f\u0131rlama ak\u0131\u015flar\u0131 tasarlay\u0131n.<\/li>\n
- \u015eifre Deneme Limiti:<\/strong> Brute-force sald\u0131r\u0131lar\u0131n\u0131 \u00f6nlemek i\u00e7in belirli bir s\u00fcre i\u00e7inde ba\u015far\u0131s\u0131z giri\u015f denemesi say\u0131s\u0131n\u0131 s\u0131n\u0131rlay\u0131n.<\/li>\n<\/ul>\n
G\u00fcvenli Oturum Y\u00f6netimi<\/h3>\n\n- K\u0131sa \u00d6m\u00fcrl\u00fc Oturumlar:<\/strong> Oturum belirte\u00e7lerinin \u00f6mr\u00fcn\u00fc s\u0131n\u0131rlay\u0131n ve d\u00fczenli olarak yenileyin.<\/li>\n
- HTTPS Kullan\u0131m\u0131:<\/strong> T\u00fcm ileti\u015fimde HTTPS kullanarak verilerin \u015fifreli iletilmesini sa\u011flay\u0131n.<\/li>\n
- Oturum Sabitleme Korumas\u0131:<\/strong> Oturum belirte\u00e7lerinin URL'de veya referer ba\u015fl\u0131klar\u0131nda g\u00f6r\u00fcnmemesini sa\u011flay\u0131n.<\/li>\n
- XSS ve CSRF Korumas\u0131:<\/strong> Oturum \u00e7erezlerini
HttpOnly<\/code> ve SameSite<\/code> nitelikleriyle koruyun.<\/li>\n<\/ul>\nBrute-Force ve Di\u011fer Sald\u0131r\u0131lara Kar\u015f\u0131 Koruma<\/h3>\n
Ba\u015far\u0131s\u0131z giri\u015f denemeleri i\u00e7in gecikmeler eklemek, CAPTCHA kullanmak ve belirli IP adreslerinden gelen anormal denemeleri engellemek gibi y\u00f6ntemlerle brute-force sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma sa\u011flay\u0131n. Ayr\u0131ca, SQL enjeksiyonu ve XSS gibi yayg\u0131n web zafiyetlerine kar\u015f\u0131 giri\u015f formlar\u0131n\u0131 ve sunucu taraf\u0131 kodunu dikkatlice kontrol edin ve sanitize edin.<\/p>\n
Kimlik Do\u011frulama ve Yetkilendirme: Kar\u0131\u015f\u0131kl\u0131\u011f\u0131 Gidermek<\/h2>\nKimlik Do\u011frulama (Authentication) Nedir?<\/h3>\n
Kimlik do\u011frulama, \"Sen kimsin?\" sorusuna cevap verir. Bir kullan\u0131c\u0131n\u0131n kimli\u011fini do\u011frular. \u00d6rne\u011fin, bir web sitesine kullan\u0131c\u0131 ad\u0131 ve \u015fifrenizle giri\u015f yapman\u0131z kimlik do\u011frulamad\u0131r.<\/p>\n
Yetkilendirme (Authorization) Nedir?<\/h3>\n
Yetkilendirme, \"Ne yapmana izin var?\" sorusuna cevap verir. Kimli\u011fi do\u011frulanm\u0131\u015f bir kullan\u0131c\u0131n\u0131n belirli bir kayna\u011fa veya i\u015fleme eri\u015fim hakk\u0131 olup olmad\u0131\u011f\u0131n\u0131 belirler. \u00d6rne\u011fin, bir y\u00f6netici kullan\u0131c\u0131n\u0131n t\u00fcm ayarlar\u0131 de\u011fi\u015ftirebilmesi, normal bir kullan\u0131c\u0131n\u0131n ise sadece kendi profilini g\u00fcncelleyebilmesi yetkilendirmedir.<\/p>\n
Neden Farkl\u0131d\u0131rlar ve Birlikte Nas\u0131l \u00c7al\u0131\u015f\u0131rlar?<\/h3>\n
Bu iki kavram birbirini tamamlar ancak farkl\u0131 ama\u00e7lara hizmet eder. \u00d6nce kimlik do\u011frulamas\u0131 yap\u0131l\u0131r, ard\u0131ndan yetkilendirme gelir. Bir kullan\u0131c\u0131 kimli\u011fini do\u011frulad\u0131ktan sonra, sistem o kullan\u0131c\u0131n\u0131n hangi kaynaklara eri\u015febilece\u011fini veya hangi eylemleri ger\u00e7ekle\u015ftirebilece\u011fini yetkilendirme kurallar\u0131na g\u00f6re belirler. A\u015fa\u011f\u0131daki tablo bu fark\u0131 \u00f6zetlemektedir:<\/p>\n
\n\n\n\u00d6zellik<\/th>\n Kimlik Do\u011frulama (Authentication)<\/th>\n Yetkilendirme (Authorization)<\/th>\n<\/tr>\n<\/thead>\n \n\nAma\u00e7<\/td>\n Kullan\u0131c\u0131n\u0131n kimli\u011fini do\u011frulamak<\/td>\n Kullan\u0131c\u0131n\u0131n eri\u015fim haklar\u0131n\u0131 belirlemek<\/td>\n<\/tr>\n \nSoru<\/td>\n \"Sen kimsin?\"<\/td>\n \"Ne yapmana izin var?\"<\/td>\n<\/tr>\n \n\u00d6rnek<\/td>\n Kullan\u0131c\u0131 ad\u0131 ve \u015fifre ile giri\u015f yapmak<\/td>\n Y\u00f6netici panelindeki bir \u00f6zelli\u011fi kullanmak<\/td>\n<\/tr>\n \nGer\u00e7ekle\u015fme S\u0131ras\u0131<\/td>\n \u00d6nce<\/td>\n Sonra (Kimlik do\u011fruland\u0131ktan sonra)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nUygulaman\u0131z \u0130\u00e7in Do\u011fru Kimlik Do\u011frulama \u00c7\u00f6z\u00fcm\u00fcn\u00fc Se\u00e7mek<\/h2>\n\u0130htiya\u00e7 Analizi<\/h3>\n
Uygulaman\u0131z\u0131n t\u00fcr\u00fc, hedef kitlesi, g\u00fcvenlik gereksinimleri ve \u00f6l\u00e7eklenebilirlik ihtiya\u00e7lar\u0131, do\u011fru kimlik do\u011frulama \u00e7\u00f6z\u00fcm\u00fcn\u00fc se\u00e7erken g\u00f6z \u00f6n\u00fcnde bulundurman\u0131z gereken temel fakt\u00f6rlerdir. \u00d6rne\u011fin, basit bir blog sitesi ile bir bankac\u0131l\u0131k uygulamas\u0131 farkl\u0131 g\u00fcvenlik seviyeleri gerektirir. Kullan\u0131c\u0131 say\u0131n\u0131z\u0131n ve hassas veri miktar\u0131n\u0131z\u0131n artmas\u0131yla g\u00fcvenlik \u00f6nlemlerinizin de artmas\u0131 gerekecektir.<\/p>\n
Kullan\u0131c\u0131 Deneyimi ve G\u00fcvenlik Dengesi<\/h3>\n
G\u00fcvenlik her zaman \u00f6ncelikli olsa da, a\u015f\u0131r\u0131 karma\u015f\u0131k kimlik do\u011frulama s\u00fcre\u00e7leri kullan\u0131c\u0131 deneyimini olumsuz etkileyebilir. MFA gibi g\u00fc\u00e7l\u00fc g\u00fcvenlik \u00f6nlemleri sunarken, kullan\u0131c\u0131lar\u0131n kolayca kullanabilece\u011fi ve anlayabilece\u011fi ak\u0131\u015flar tasarlamak \u00f6nemlidir. \u00d6rne\u011fin, tek oturum a\u00e7ma (SSO) \u00e7\u00f6z\u00fcmleri, kullan\u0131c\u0131lar\u0131n birden fazla uygulamaya tek bir kimlik do\u011frulama ile eri\u015fmesini sa\u011flayarak hem g\u00fcvenli\u011fi hem de kullan\u0131c\u0131 deneyimini iyile\u015ftirebilir.<\/p>\n
\u00dc\u00e7\u00fcnc\u00fc Taraf \u00c7\u00f6z\u00fcmler mi, Kendi \u00c7\u00f6z\u00fcm\u00fcn\u00fcz m\u00fc?<\/h3>\n
Kimlik do\u011frulama sistemini s\u0131f\u0131rdan geli\u015ftirmek, y\u00fcksek maliyetli, zaman al\u0131c\u0131 ve hata yapmaya a\u00e7\u0131k bir s\u00fcre\u00e7 olabilir. AWS Cognito, Auth0, Firebase Authentication gibi \u00fc\u00e7\u00fcnc\u00fc taraf kimlik sa\u011flay\u0131c\u0131lar\u0131, g\u00fc\u00e7l\u00fc g\u00fcvenlik \u00f6zellikleri, \u00f6l\u00e7eklenebilirlik ve kolay entegrasyon imkanlar\u0131 sunar. Bu t\u00fcr \u00e7\u00f6z\u00fcmler, geli\u015ftiricilerin g\u00fcvenlik endi\u015felerini azaltarak ana i\u015f mant\u0131\u011f\u0131na odaklanmalar\u0131n\u0131 sa\u011flar. Ancak, kendi \u00e7\u00f6z\u00fcm\u00fcn\u00fcz\u00fc geli\u015ftirmeniz, \u00f6zel gereksinimleriniz varsa veya veri egemenli\u011fi gibi konularda kat\u0131 politikalar\u0131n\u0131z varsa daha uygun olabilir.<\/p>\n
Sonu\u00e7<\/h2>\n
Kimlik do\u011frulama, modern yaz\u0131l\u0131m geli\u015ftirmenin ayr\u0131lmaz bir par\u00e7as\u0131d\u0131r ve asla g\u00f6z ard\u0131 edilmemelidir. Bu rehberde ele ald\u0131\u011f\u0131m\u0131z temellerden modern protokollere, en iyi g\u00fcvenlik uygulamalar\u0131ndan kimlik do\u011frulama ve yetkilendirme aras\u0131ndaki farklara kadar t\u00fcm konular, geli\u015ftiricilerin daha g\u00fcvenli ve sa\u011flam uygulamalar in\u015fa etmeleri i\u00e7in bir yol haritas\u0131 sunmaktad\u0131r. Unutmay\u0131n, g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir; bu nedenle en son tehditler ve teknolojiler hakk\u0131nda bilgi sahibi olmak, uygulamalar\u0131n\u0131z\u0131 gelece\u011fe haz\u0131r tutman\u0131n anahtar\u0131d\u0131r. Kullan\u0131c\u0131lar\u0131n\u0131z\u0131n g\u00fcvenli\u011fini ve verilerini korumak, geli\u015ftirici olarak en \u00f6nemli sorumluluklar\u0131m\u0131zdan biridir.<\/p>\n
S\u0131k\u00e7a Sorulan Sorular (SSS)<\/h2>\n\n- Kimlik do\u011frulama ile yetkilendirme aras\u0131ndaki temel fark nedir?<\/dt>\n
- Kimlik do\u011frulama (Authentication), bir kullan\u0131c\u0131n\u0131n kim oldu\u011funu do\u011frular (\"Sen kimsin?\"). Yetkilendirme (Authorization) ise kimli\u011fi do\u011frulanm\u0131\u015f bir kullan\u0131c\u0131n\u0131n hangi kaynaklara veya i\u015flemlere eri\u015febilece\u011fini belirler (\"Ne yapmana izin var?\"). \u00d6nce kimlik do\u011frulama, sonra yetkilendirme gelir.<\/dd>\n
- MFA neden bu kadar \u00f6nemlidir?<\/dt>\n
- \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA), yaln\u0131zca bir \u015fifreye dayanmak yerine, kullan\u0131c\u0131n\u0131n kimli\u011fini do\u011frulamak i\u00e7in birden fazla ba\u011f\u0131ms\u0131z kan\u0131t (\u00f6rne\u011fin, \u015fifre ve telefonunuzdaki bir kod) gerektirir. Bu, tek bir g\u00fcvenlik fakt\u00f6r\u00fcn\u00fcn ele ge\u00e7irilmesi durumunda bile hesab\u0131n g\u00fcvende kalmas\u0131n\u0131 sa\u011flayarak g\u00fcvenli\u011fi \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131r\u0131r.<\/dd>\n
- JWT'ler oturum y\u00f6netimi i\u00e7in g\u00fcvenli midir?<\/dt>\n
- JWT'ler do\u011fru kullan\u0131ld\u0131\u011f\u0131nda g\u00fcvenli olabilir. \u0130mza, belirtecin b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc garanti eder. Ancak, JWT'ler \u015fifrelenmedi\u011fi i\u00e7in hassas bilgileri do\u011frudan y\u00fckte ta\u015f\u0131mamal\u0131d\u0131r. Ayr\u0131ca, JWT'lerin \u00e7al\u0131nmas\u0131 durumunda iptal mekanizmalar\u0131n\u0131n olmamas\u0131 bir dezavantajd\u0131r; bu nedenle k\u0131sa \u00f6m\u00fcrl\u00fc JWT'ler ve refresh token mekanizmalar\u0131 kullanmak \u00f6nemlidir.<\/dd>\n
- Kullan\u0131c\u0131 \u015fifrelerini nas\u0131l g\u00fcvenli bir \u015fekilde saklamal\u0131y\u0131m?<\/dt>\n
- Kullan\u0131c\u0131 \u015fifrelerini asla d\u00fcz metin olarak saklamay\u0131n. Bunun yerine, bcrypt, Argon2 veya scrypt gibi modern, tek y\u00f6nl\u00fc hash algoritmalar\u0131 kullanarak hashleyip tuzlayarak (salting) depolay\u0131n. Tuzlama, ayn\u0131 \u015fifreye sahip farkl\u0131 kullan\u0131c\u0131lar\u0131n farkl\u0131 hash de\u011ferlerine sahip olmas\u0131n\u0131 sa\u011flayarak g\u00f6kku\u015fa\u011f\u0131 tablosu sald\u0131r\u0131lar\u0131n\u0131 \u00f6nler.<\/dd>\n
- OAuth 2.0 sadece sosyal medya giri\u015fleri i\u00e7in mi kullan\u0131l\u0131r?<\/dt>\n
- Hay\u0131r, OAuth 2.0 sadece sosyal medya giri\u015fleri i\u00e7in de\u011fildir. Bir yetkilendirme \u00e7er\u00e7evesi olarak, bir kullan\u0131c\u0131n\u0131n bir uygulamaya ba\u015fka bir servisteki (\u00f6rne\u011fin bir bulut depolama hizmeti, bir \u00f6deme a\u011f ge\u00e7idi) kaynaklar\u0131na s\u0131n\u0131rl\u0131 eri\u015fim izni vermesini sa\u011flar. Sosyal medya giri\u015fleri (\u00f6rne\u011fin \"Google ile Giri\u015f Yap\") ise genellikle OAuth 2.0 \u00fczerine in\u015fa edilmi\u015f OpenID Connect (OIDC) protokol\u00fcn\u00fc kullan\u0131r.<\/dd>\n<\/dl>\n","protected":false},"excerpt":{"rendered":"Modern yaz\u0131l\u0131m d\u00fcnyas\u0131nda, uygulamalar\u0131n g\u00fcvenli\u011fi her zamankinden daha kritik bir \u00f6neme sahip. Bu g\u00fcvenli\u011fin temel ta\u015flar\u0131ndan biri de \u015f\u00fcphesiz kimlik do\u011frulamad\u0131r.","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-40840","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-genel","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\n
Temellere D\u00f6n\u00fc\u015f: Geli\u015ftiriciler \u0130\u00e7in Kimlik Do\u011frulama Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Temellere D\u00f6n\u00fc\u015f: Geli\u015ftiriciler \u0130\u00e7in Kimlik Do\u011frulama Rehberi\" \/>\n<meta property=\"og:description\" content=\"Modern yaz\u0131l\u0131m d\u00fcnyas\u0131nda, uygulamalar\u0131n g\u00fcvenli\u011fi her zamankinden daha kritik bir \u00f6neme sahip. Bu g\u00fcvenli\u011fin temel ta\u015flar\u0131ndan biri de \u015f\u00fcphesiz kimlik do\u011frulamad\u0131r.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-03-01T13:00:38+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Temellere D\u00f6n\u00fc\u015f: Geli\u015ftiriciler \u0130\u00e7in Kimlik Do\u011frulama Rehberi\",\"datePublished\":\"2026-03-01T13:00:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/\"},\"wordCount\":2265,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/\",\"name\":\"Temellere D\u00f6n\u00fc\u015f: Geli\u015ftiriciler \u0130\u00e7in Kimlik Do\u011frulama Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-03-01T13:00:38+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Temellere D\u00f6n\u00fc\u015f: Geli\u015ftiriciler \u0130\u00e7in Kimlik Do\u011frulama Rehberi\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Temellere D\u00f6n\u00fc\u015f: Geli\u015ftiriciler \u0130\u00e7in Kimlik Do\u011frulama Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/","og_locale":"tr_TR","og_type":"article","og_title":"Temellere D\u00f6n\u00fc\u015f: Geli\u015ftiriciler \u0130\u00e7in Kimlik Do\u011frulama Rehberi","og_description":"Modern yaz\u0131l\u0131m d\u00fcnyas\u0131nda, uygulamalar\u0131n g\u00fcvenli\u011fi her zamankinden daha kritik bir \u00f6neme sahip. Bu g\u00fcvenli\u011fin temel ta\u015flar\u0131ndan biri de \u015f\u00fcphesiz kimlik do\u011frulamad\u0131r.","og_url":"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-03-01T13:00:38+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"12 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Temellere D\u00f6n\u00fc\u015f: Geli\u015ftiriciler \u0130\u00e7in Kimlik Do\u011frulama Rehberi","datePublished":"2026-03-01T13:00:38+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/"},"wordCount":2265,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/","url":"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/","name":"Temellere D\u00f6n\u00fc\u015f: Geli\u015ftiriciler \u0130\u00e7in Kimlik Do\u011frulama Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-03-01T13:00:38+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/temellere-donus-gelistiriciler-icin-kimlik-dogrulama-rehberi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Temellere D\u00f6n\u00fc\u015f: Geli\u015ftiriciler \u0130\u00e7in Kimlik Do\u011frulama Rehberi"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/40840","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=40840"}],"version-history":[{"count":0,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/40840\/revisions"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=40840"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=40840"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=40840"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}