G\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla dijitalle\u015fen d\u00fcnyas\u0131nda, yaz\u0131l\u0131m uygulamalar\u0131n\u0131n g\u00fcvenli\u011fi her zamankinden daha kritik bir hale gelmi\u015ftir. \u00d6zellikle Go (Golang) gibi modern ve performans odakl\u0131 dillerle geli\u015ftirilen uygulamalar, do\u011fru g\u00fcvenlik \u00f6nlemleri al\u0131nmad\u0131\u011f\u0131nda ciddi riskler ta\u015f\u0131yabilir. Bu makale, Go uygulamalar\u0131n\u0131z\u0131 \u00fcretime g\u00f6ndermeden \u00f6nce kar\u015f\u0131la\u015fabilece\u011finiz olas\u0131 g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 belirlemenize, \u00f6nlemenize ve uygulaman\u0131z\u0131n genel g\u00fcvenlik duru\u015funu g\u00fc\u00e7lendirmenize yard\u0131mc\u0131 olacak kapsaml\u0131 bir rehber sunmaktad\u0131r.<\/p>\n
Go, y\u00fcksek performans, e\u015fzamanl\u0131l\u0131k (concurrency) yetenekleri ve basit s\u00f6zdizimi (syntax) sayesinde h\u0131zla pop\u00fclerlik kazanan bir programlama dilidir. Mikroservisler, API’ler ve bulut tabanl\u0131 uygulamalar geli\u015ftirmek i\u00e7in s\u0131kl\u0131kla tercih edilmektedir. Ancak bu pop\u00fclerlik ve yayg\u0131n kullan\u0131m, Go uygulamalar\u0131n\u0131 siber sald\u0131rganlar i\u00e7in cazip bir hedef haline getirebilir. Bir uygulaman\u0131n g\u00fcvenli\u011fi, sadece kodun do\u011fru \u00e7al\u0131\u015fmas\u0131ndan ibaret de\u011fildir; ayn\u0131 zamanda k\u00f6t\u00fc niyetli akt\u00f6rlerin sisteme s\u0131zmas\u0131n\u0131, veri \u00e7almas\u0131n\u0131 veya hizmeti kesintiye u\u011fratmas\u0131n\u0131 engellemeyi de kapsar. \u00dcretim ortam\u0131na \u00e7\u0131kar\u0131lan g\u00fcvenlik a\u00e7\u0131klar\u0131, itibar kayb\u0131ndan b\u00fcy\u00fck finansal zararlara kadar uzanan ciddi sonu\u00e7lar do\u011furabilir.<\/p>\n
G\u00fcvenlik, geli\u015ftirme ya\u015fam d\u00f6ng\u00fcs\u00fcn\u00fcn (Software Development Life Cycle – SDLC) ayr\u0131lmaz bir par\u00e7as\u0131 olmal\u0131d\u0131r, sonradan eklenen bir \u00f6zellik de\u011fil. Erken a\u015famada g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tespit etmek ve d\u00fczeltmek, \u00fcretimde ortaya \u00e7\u0131kan sorunlara g\u00f6re \u00e7ok daha uygun maliyetli ve etkilidir. \u00d6rne\u011fin, bir Go web uygulamas\u0131nda girdi do\u011frulama eksikli\u011fi, SQL enjeksiyonu (SQL Injection) veya siteler aras\u0131 komut \u00e7al\u0131\u015ft\u0131rma (Cross-Site Scripting – XSS) gibi yayg\u0131n sald\u0131r\u0131lara zemin haz\u0131rlayabilir. Veritaban\u0131 ba\u011flant\u0131 bilgilerinin veya API anahtarlar\u0131n\u0131n kod i\u00e7ine g\u00f6m\u00fclmesi (hardcoding), yetkisiz eri\u015fime yol a\u00e7abilir. Bu t\u00fcr zafiyetler, uygulaman\u0131n kritik verilerine eri\u015fimi tehlikeye atabilir ve kullan\u0131c\u0131 g\u00fcvenini sarsabilir. Bu nedenle, Go geli\u015ftiricileri ve DevOps ekipleri, uygulamalar\u0131n\u0131 tasarlarken, kodlarken, test ederken ve da\u011f\u0131t\u0131rken g\u00fcvenlik prensiplerini s\u00fcrekli g\u00f6z \u00f6n\u00fcnde bulundurmal\u0131d\u0131r. G\u00fcvenli kodlama al\u0131\u015fkanl\u0131klar\u0131, ba\u011f\u0131ml\u0131l\u0131k (dependency) y\u00f6netimi, yap\u0131land\u0131rma g\u00fcvenli\u011fi ve s\u00fcrekli g\u00fcvenlik testleri, sa\u011flam bir g\u00fcvenlik duru\u015fu i\u00e7in temel ta\u015flard\u0131r. Bu ad\u0131mlar, uygulaman\u0131z\u0131n sadece performansl\u0131 de\u011fil, ayn\u0131 zamanda d\u0131\u015f tehditlere kar\u015f\u0131 diren\u00e7li olmas\u0131n\u0131 sa\u011flar.<\/p>\n
Go uygulamalar\u0131 da di\u011fer yaz\u0131l\u0131m dilleri gibi \u00e7e\u015fitli g\u00fcvenlik a\u00e7\u0131klar\u0131na maruz kalabilir. Bu zafiyetleri anlamak, onlar\u0131 proaktif bir \u015fekilde \u00f6nlemek i\u00e7in ilk ad\u0131md\u0131r. En yayg\u0131n ve tehlikeli g\u00fcvenlik a\u00e7\u0131klar\u0131ndan baz\u0131lar\u0131 \u015funlard\u0131r:<\/p>\n
* Girdi Do\u011frulama Eksikli\u011fi (Missing Input Validation):<\/strong> Kullan\u0131c\u0131dan al\u0131nan t\u00fcm verilerin (URL parametreleri, form girdileri, HTTP ba\u015fl\u0131klar\u0131 vb.) g\u00fcvenli bir \u015fekilde i\u015flenmeden \u00f6nce do\u011frulanmamas\u0131, SQL enjeksiyonu, XSS, komut enjeksiyonu (command injection) ve dizin ge\u00e7i\u015fi (directory traversal) gibi sald\u0131r\u0131lara yol a\u00e7abilir. Go’da Bu zafiyetlerin fark\u0131nda olmak ve her birine kar\u015f\u0131 proaktif \u00f6nlemler almak, Go uygulaman\u0131z\u0131n \u00fcretim ortam\u0131nda kar\u015f\u0131la\u015fabilece\u011fi riskleri \u00f6nemli \u00f6l\u00e7\u00fcde azaltacakt\u0131r.<\/p>\n Go uygulamalar\u0131nda girdi do\u011frulama ve g\u00fcvenli veri i\u015fleme, uygulaman\u0131n d\u0131\u015f d\u00fcnyadan gelen verilerle etkile\u015fimini g\u00fcvenli hale getirmenin temelidir. Kullan\u0131c\u0131 girdileri, URL parametreleri, HTTP ba\u015fl\u0131klar\u0131 ve API istek g\u00f6vdeleri (request bodies) gibi her t\u00fcrl\u00fc harici veri, potansiyel bir tehdit vekt\u00f6r\u00fcd\u00fcr. Bu verilerin do\u011fru bir \u015fekilde do\u011frulanmamas\u0131 ve temizlenmemesi, SQL enjeksiyonu, XSS, komut enjeksiyonu ve di\u011fer bir\u00e7ok sald\u0131r\u0131ya kap\u0131 aralayabilir.<\/p>\n Ad\u0131m Ad\u0131m Girdi Do\u011frulama:<\/strong><\/p>\n 1. Her Girdiyi G\u00fcvenli Kabul Etme (Assume All Input is Malicious):<\/strong> Geli\u015ftirme s\u00fcrecinde temel prensip, d\u0131\u015far\u0131dan gelen her verinin k\u00f6t\u00fc niyetli olabilece\u011fi varsay\u0131m\u0131yla hareket etmektir. Bu yakla\u015f\u0131m, t\u00fcm girdilerin titizlikle kontrol edilmesini sa\u011flar. <\/code>\n<\/div>\n Yukar\u0131daki Go kod \u00f6rne\u011finde, G\u00fcvenli Veri \u0130\u015fleme:<\/strong><\/p>\n 1. \u00c7\u0131k\u0131\u015f Kodlamas\u0131 (Output Encoding):<\/strong> Veriyi bir \u00e7\u0131kt\u0131 ortam\u0131na (HTML, URL, JavaScript, SQL) g\u00f6ndermeden \u00f6nce o ortama \u00f6zel kodlama veya ka\u00e7\u0131\u015f (escaping) i\u015flemlerini uygulay\u0131n. Bu, XSS ve di\u011fer enjeksiyon sald\u0131r\u0131lar\u0131n\u0131 \u00f6nler. Go'nun Bu prensipleri uygulayarak, Go uygulaman\u0131z\u0131n girdi i\u015fleme ve veri y\u00f6netimi s\u00fcre\u00e7lerini \u00f6nemli \u00f6l\u00e7\u00fcde daha g\u00fcvenli hale getirebilirsiniz.<\/p>\n Kimlik do\u011frulama (Authentication) ve yetkilendirme (Authorization), bir uygulaman\u0131n g\u00fcvenli\u011finin temel ta\u015flar\u0131ndand\u0131r. Kimlik do\u011frulama, bir kullan\u0131c\u0131n\u0131n kim oldu\u011funu do\u011frulamakla ilgilenirken, yetkilendirme kullan\u0131c\u0131n\u0131n belirli bir kayna\u011fa veya i\u015fleme eri\u015fim izni olup olmad\u0131\u011f\u0131n\u0131 belirler. Go uygulamalar\u0131nda bu mekanizmalar\u0131 do\u011fru bir \u015fekilde uygulamak, yetkisiz eri\u015fimi engellemek ve veri b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc korumak i\u00e7in hayati \u00f6neme sahiptir.<\/p>\n 1. G\u00fc\u00e7l\u00fc Kimlik Do\u011frulama Mekanizmalar\u0131:<\/strong><\/p>\n * Parola Y\u00f6netimi:<\/strong> <\/code>\n<\/div>\n Yukar\u0131daki Go kod \u00f6rne\u011fi, bcrypt kullanarak parola hash'leme, UUID (Evrensel Tekil Tan\u0131mlay\u0131c\u0131 - Universally Unique Identifier) ile g\u00fcvenli oturum kimlikleri olu\u015fturma ve HTTP-only, Secure, SameSite niteliklerine sahip \u00e7erezler kullanarak oturum y\u00f6netimini g\u00f6stermektedir. Ayr\u0131ca, bir 2. Sa\u011flam Yetkilendirme Mekanizmalar\u0131:<\/strong><\/p>\n * Rol Tabanl\u0131 Eri\u015fim Kontrol\u00fc (Role-Based Access Control - RBAC):<\/strong> Kullan\u0131c\u0131lara do\u011frudan bireysel izinler vermek yerine, rollere (y\u00f6netici, edit\u00f6r, okuyucu vb.) atay\u0131n ve bu rollere belirli izinler tan\u0131mlay\u0131n. Kullan\u0131c\u0131lar bu rollere atanarak yetkilendirilir. Bu, yetkilendirme y\u00f6netimini basitle\u015ftirir ve hata yapma olas\u0131l\u0131\u011f\u0131n\u0131 azalt\u0131r. Ek \u0130pu\u00e7lar\u0131:<\/strong><\/p>\n * JWT (JSON Web Token) Kullan\u0131m\u0131:<\/strong> API tabanl\u0131 uygulamalarda JWT'ler pop\u00fcler bir se\u00e7enektir. JWT kullan\u0131rken, token'lar\u0131n g\u00fcvenli bir \u015fekilde imzaland\u0131\u011f\u0131ndan (signed), \u015fifrelendi\u011finden (encrypted) (hassas veri i\u00e7eriyorsa), ge\u00e7erlilik s\u00fcrelerinin k\u0131sa oldu\u011fundan ve yenileme token'lar\u0131n\u0131n (refresh tokens) g\u00fcvenli bir \u015fekilde y\u00f6netildi\u011finden emin olun. JWT'lerin sunucu taraf\u0131nda iptal edilememesi (revocation) nedeniyle dikkatli kullan\u0131lmal\u0131d\u0131r. Bu prensipleri uygulayarak, Go uygulaman\u0131z\u0131n kimlik do\u011frulama ve yetkilendirme mekanizmalar\u0131n\u0131 \u00f6nemli \u00f6l\u00e7\u00fcde g\u00fc\u00e7lendirebilir ve yetkisiz eri\u015fim riskini en aza indirebilirsiniz.<\/p>\n Modern yaz\u0131l\u0131m geli\u015ftirme, genellikle \u00fc\u00e7\u00fcnc\u00fc taraf k\u00fct\u00fcphanelerin ve mod\u00fcllerin yo\u011fun kullan\u0131m\u0131n\u0131 i\u00e7erir. Go projeleri de bu durumdan farkl\u0131 de\u011fildir; bir\u00e7ok geli\u015ftirici, karma\u015f\u0131k i\u015flevsellikleri h\u0131zl\u0131ca entegre etmek i\u00e7in haz\u0131r paketlere g\u00fcvenir. Ancak bu ba\u011f\u0131ml\u0131l\u0131klar, projenize b\u00fcy\u00fck kolayl\u0131klar sa\u011flarken ayn\u0131 zamanda ciddi g\u00fcvenlik riskleri de getirebilir. Bir ba\u011f\u0131ml\u0131l\u0131ktaki tek bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 (vulnerability), t\u00fcm uygulaman\u0131z\u0131n g\u00fcvenli\u011fini tehlikeye atabilir. Bu nedenle, ba\u011f\u0131ml\u0131l\u0131k y\u00f6netimi ve d\u00fczenli g\u00fcvenlik g\u00fcncellemeleri, Go uygulamalar\u0131n\u0131n \u00fcretim \u00f6ncesi g\u00fcvenli\u011fini sa\u011flaman\u0131n kritik bir par\u00e7as\u0131d\u0131r.<\/p>\n Ba\u011f\u0131ml\u0131l\u0131k G\u00fcvenlik A\u00e7\u0131klar\u0131n\u0131n Riskleri:<\/strong><\/p>\n * Geni\u015f Sald\u0131r\u0131 Y\u00fczeyi:<\/strong> Bir ba\u011f\u0131ml\u0131l\u0131kta ke\u015ffedilen bir zafiyet, o ba\u011f\u0131ml\u0131l\u0131\u011f\u0131 kullanan binlerce veya milyonlarca uygulamay\u0131 etkileyebilir. Bu, sald\u0131rganlar i\u00e7in geni\u015f bir hedef yelpazesi sunar. \u00d6rne\u011fin, pop\u00fcler bir web \u00e7er\u00e7evesindeki (framework) bir zafiyet, o \u00e7er\u00e7eveyi kullanan t\u00fcm siteleri riske atabilir. G\u00fcvenli Ba\u011f\u0131ml\u0131l\u0131k Y\u00f6netimi \u0130\u00e7in Ad\u0131mlar:<\/strong><\/p>\n 1. Ba\u011f\u0131ml\u0131l\u0131k Denetimi (Dependency Auditing):<\/strong> <\/code>\n <\/div>\n Bu kom<\/p>\n","protected":false},"excerpt":{"rendered":"Go Uygulamalar\u0131n\u0131z\u0131 \u00dcretime \u00c7\u0131karmadan \u00d6nce Nas\u0131l G\u00fcvenli Hale Getirirsiniz? G\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla dijitalle\u015fen d\u00fcnyas\u0131nda, yaz\u0131l\u0131m uygulamalar\u0131n\u0131n g\u00fcvenli\u011fi her zamankinden daha kritik bir hale gelmi\u015ftir.","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-41711","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-genel","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nnet\/http<\/code> paketi ile web uygulamalar\u0131 geli\u015ftirirken, gelen t\u00fcm isteklerin i\u00e7eri\u011fini dikkatlice kontrol etmek hayati \u00f6nem ta\u015f\u0131r. \u00d6rne\u011fin, bir kullan\u0131c\u0131 ad\u0131 alan\u0131na SQL sorgusu enjekte etmeye \u00e7al\u0131\u015fan k\u00f6t\u00fc niyetli bir giri\u015f, do\u011fru do\u011frulama ve sanitasyon (temizleme) olmadan veritaban\u0131n\u0131za zarar verebilir.
\n* Kimlik Do\u011frulama ve Yetkilendirme Zafiyetleri (Authentication and Authorization Vulnerabilities):<\/strong> Zay\u0131f veya eksik kimlik do\u011frulama mekanizmalar\u0131 (\u00f6rne\u011fin, zay\u0131f parola politikalar\u0131, oturum y\u00f6netimi sorunlar\u0131) veya hatal\u0131 yetkilendirme kontrolleri, yetkisiz kullan\u0131c\u0131lar\u0131n ayr\u0131cal\u0131kl\u0131 kaynaklara eri\u015fmesine neden olabilir. Go uygulamalar\u0131nda JWT (JSON Web Token) veya oturum tabanl\u0131 kimlik do\u011frulama kullan\u0131rken, token’lar\u0131n g\u00fcvenli bir \u015fekilde sakland\u0131\u011f\u0131ndan, iletildi\u011finden ve ge\u00e7erlilik s\u00fcrelerinin do\u011fru ayarland\u0131\u011f\u0131ndan emin olunmal\u0131d\u0131r. Yetkilendirme i\u00e7in rol tabanl\u0131 eri\u015fim kontrol\u00fc (Role-Based Access Control – RBAC) gibi sa\u011flam modeller kullanmak, her iste\u011fin kullan\u0131c\u0131n\u0131n gerekli yetkilere sahip olup olmad\u0131\u011f\u0131n\u0131 kontrol etmesini sa\u011flamal\u0131d\u0131r.
\n* Ba\u011f\u0131ml\u0131l\u0131k G\u00fcvenlik A\u00e7\u0131klar\u0131 (Dependency Vulnerabilities):<\/strong> Go projeleri genellikle \u00fc\u00e7\u00fcnc\u00fc taraf k\u00fct\u00fcphaneleri ve mod\u00fclleri kullan\u0131r. Bu ba\u011f\u0131ml\u0131l\u0131klar kendi i\u00e7lerinde g\u00fcvenlik a\u00e7\u0131klar\u0131 bar\u0131nd\u0131rabilir. Bu t\u00fcr zafiyetler, uygulaman\u0131z\u0131n genel g\u00fcvenli\u011fini tehlikeye atabilir. \u00d6rne\u011fin, pop\u00fcler bir JSON ayr\u0131\u015ft\u0131rma k\u00fct\u00fcphanesindeki bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131, uygulaman\u0131z\u0131n bir hizmet reddi (Denial of Service – DoS) sald\u0131r\u0131s\u0131na maruz kalmas\u0131na neden olabilir. Bu nedenle, kullan\u0131lan t\u00fcm ba\u011f\u0131ml\u0131l\u0131klar\u0131n d\u00fczenli olarak g\u00fcncellenmesi ve bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131na kar\u015f\u0131 taranmas\u0131 kritik \u00f6neme sahiptir.
\n* Bilgi \u0130f\u015fas\u0131 (Information Disclosure):<\/strong> Hata mesajlar\u0131nda hassas bilgilerin (veritaban\u0131 \u015femas\u0131, sunucu yollar\u0131, API anahtarlar\u0131) a\u00e7\u0131klanmas\u0131, sald\u0131rganlara sistem hakk\u0131nda de\u011ferli bilgiler sa\u011flayabilir. \u00dcretim ortam\u0131nda ayr\u0131nt\u0131l\u0131 hata mesajlar\u0131 yerine genel hata mesajlar\u0131 sunmak ve g\u00fcnl\u00fck (log) dosyalar\u0131n\u0131 g\u00fcvenli bir \u015fekilde y\u00f6netmek bu riski azalt\u0131r.
\n* G\u00fcvenli Olmayan Konfig\u00fcrasyon (Insecure Configuration):<\/strong> Varsay\u0131lan veya zay\u0131f yap\u0131land\u0131rmalar (\u00f6rne\u011fin, a\u00e7\u0131k portlar, varsay\u0131lan kimlik bilgileri, gereksiz hizmetlerin \u00e7al\u0131\u015fmas\u0131) sald\u0131r\u0131 y\u00fczeyini art\u0131r\u0131r. Go uygulamalar\u0131nda yap\u0131land\u0131rma dosyalar\u0131 (YAML, JSON, TOML) veya ortam de\u011fi\u015fkenleri (environment variables) kullan\u0131larak hassas bilgilerin g\u00fcvenli bir \u015fekilde y\u00f6netilmesi \u00f6nemlidir.
\n* \u015eifreleme Zay\u0131fl\u0131klar\u0131 (Weak Cryptography):<\/strong> Zay\u0131f \u015fifreleme algoritmalar\u0131, yetersiz anahtar y\u00f6netimi veya \u015fifrelemenin yanl\u0131\u015f uygulanmas\u0131, hassas verilerin a\u00e7\u0131\u011fa \u00e7\u0131kmas\u0131na neden olabilir. Go’nun standart k\u00fct\u00fcphanesi (\u00f6rne\u011fin, crypto\/aes<\/code>, crypto\/rsa<\/code>, golang.org\/x\/crypto\/bcrypt<\/code>) g\u00fc\u00e7l\u00fc \u015fifreleme mekanizmalar\u0131 sunar, ancak bunlar\u0131n do\u011fru ve g\u00fcncel standartlara uygun \u015fekilde kullan\u0131lmas\u0131 gerekir. \u00d6rne\u011fin, parolalar\u0131 do\u011frudan saklamak yerine bcrypt gibi g\u00fcvenli hashing algoritmalar\u0131 kullanmak zorunludur.<\/p>\nGirdi Do\u011frulama ve G\u00fcvenli Veri \u0130\u015fleme Nas\u0131l Yap\u0131l\u0131r?<\/h3>\n
\n2. Veri T\u00fcr\u00fc ve Format\u0131 Do\u011frulama:<\/strong> Gelen verinin beklenen t\u00fcrde (say\u0131, metin, tarih vb.) ve formatta olup olmad\u0131\u011f\u0131n\u0131 kontrol edin. \u00d6rne\u011fin, bir ya\u015f alan\u0131 i\u00e7in sadece say\u0131sal de\u011ferler bekliyorsan\u0131z, gelen verinin say\u0131 olup olmad\u0131\u011f\u0131n\u0131 kontrol edin.
\n3. Uzunluk K\u0131s\u0131tlamalar\u0131:<\/strong> Metin tabanl\u0131 girdiler i\u00e7in minimum ve maksimum uzunluk k\u0131s\u0131tlamalar\u0131 belirleyin. Bu, tampon ta\u015fmas\u0131 (buffer overflow) sald\u0131r\u0131lar\u0131n\u0131 veya a\u015f\u0131r\u0131 b\u00fcy\u00fck veri y\u00fcklemelerini \u00f6nlemeye yard\u0131mc\u0131 olabilir.
\n4. Karakter K\u00fcmeleri ve D\u00fczenli \u0130fadeler (Regex):<\/strong> \u0130zin verilen karakter k\u00fcmelerini belirleyin ve d\u00fczenli ifadeler kullanarak girdinin belirli bir desene (\u00f6rne\u011fin, e-posta adresi format\u0131, telefon numaras\u0131) uyup uymad\u0131\u011f\u0131n\u0131 do\u011frulay\u0131n. \u00d6rne\u011fin, bir kullan\u0131c\u0131 ad\u0131 sadece alfan\u00fcmerik karakterler ve belirli \u00f6zel karakterler i\u00e7erebilir.<\/p>\n\npackage main\n\nimport (\n\t\"fmt\"\n\t\"regexp\"\n\t\"net\/http\"\n\t\"html\/template\"\n)\n\n\/\/ isValidEmail, temel bir e-posta format\u0131 do\u011frulamas\u0131 yapar.\nfunc isValidEmail(email string) bool {\n\temailRegex := regexp.MustCompile(^[a-z0-9._%+\\-]+@[a-z0-9.\\-]+\\.[a-z]{2,4}$<\/code>)\n\treturn emailRegex.MatchString(email)\n}\n\n\/\/ sanitizeInput, basit bir HTML temizleme i\u015flevi \u00f6rne\u011fi.\n\/\/ Ger\u00e7ek uygulamalarda daha geli\u015fmi\u015f k\u00fct\u00fcphaneler kullan\u0131lmal\u0131d\u0131r.\nfunc sanitizeInput(input string) string {\n\t\/\/ HTML etiketlerini kald\u0131rma veya ka\u00e7\u0131\u015f karakterlerine d\u00f6n\u00fc\u015ft\u00fcrme\n\t\/\/ Bu basit \u00f6rnekte, kullan\u0131c\u0131 girdisini do\u011frudan HTML'e basmadan \u00f6nce\n\t\/\/ template.HTMLEscapeString kullanarak ka\u00e7\u0131\u015f karakterlerine d\u00f6n\u00fc\u015ft\u00fcr\u00fcyoruz.\n\treturn template.HTMLEscapeString(input)\n}\n\nfunc registerHandler(w http.ResponseWriter, r *http.Request) {\n\tif r.Method == http.MethodPost {\n\t\temail := r.FormValue(\"email\")\n\t\tpassword := r.FormValue(\"password\")\n\t\tusername := r.FormValue(\"username\")\n\n\t\t\/\/ 1. E-posta do\u011frulama\n\t\tif !isValidEmail(email) {\n\t\t\thttp.Error(w, \"Ge\u00e7ersiz e-posta format\u0131\", http.StatusBadRequest)\n\t\t\treturn\n\t\t}\n\n\t\t\/\/ 2. Parola uzunluk kontrol\u00fc (basit \u00f6rnek)\n\t\tif len(password) < 8 {\n\t\t\thttp.Error(w, \"Parola en az 8 karakter olmal\u0131\", http.StatusBadRequest)\n\t\t\treturn\n\t\t}\n\n\t\t\/\/ 3. Kullan\u0131c\u0131 ad\u0131 temizleme (XSS \u00f6nleme)\n\t\t\/\/ Kullan\u0131c\u0131 ad\u0131n\u0131 veritaban\u0131na kaydetmeden \u00f6nce veya HTML'de g\u00f6stermeden \u00f6nce temizle.\n\t\t\/\/ Burada sadece HTML'e basarken ka\u00e7\u0131\u015f karakterlerine d\u00f6n\u00fc\u015ft\u00fcrmek i\u00e7in sanitizeInput kullan\u0131l\u0131yor.\n\t\tsanitizedUsername := sanitizeInput(username)\n\n\t\t\/\/ G\u00fcvenli parola hash'leme (ger\u00e7ek uygulamada bcrypt kullan\u0131lmal\u0131)\n\t\t\/\/ hashedPassword, _ := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)\n\n\t\tfmt.Fprintf(w, \"Kay\u0131t ba\u015far\u0131l\u0131! E-posta: %s, Kullan\u0131c\u0131 Ad\u0131: %s\\n\", email, sanitizedUsername)\n\t\t\/\/ Veritaban\u0131na kaydetme vb. i\u015flemler burada yap\u0131labilir.\n\n\t} else {\n\t\thttp.Error(w, \"Sadece POST istekleri kabul edilir\", http.StatusMethodNotAllowed)\n\t}\n}\n\nfunc main() {\n\thttp.HandleFunc(\"\/register\", registerHandler)\n\tfmt.Println(\"Sunucu 8080 portunda dinliyor...\")\n\thttp.ListenAndServe(\":8080\", nil)\n}\n <\/pre>\nisValidEmail<\/code> fonksiyonu d\u00fczenli ifadeler kullanarak basit bir e-posta format\u0131 do\u011frulamas\u0131 yapar. sanitizeInput<\/code> fonksiyonu ise, html\/template<\/code> paketinden HTMLEscapeString<\/code> kullanarak HTML i\u00e7eri\u011findeki \u00f6zel karakterleri ka\u00e7\u0131\u015f dizilerine d\u00f6n\u00fc\u015ft\u00fcr\u00fcr. Bu, XSS sald\u0131r\u0131lar\u0131n\u0131 \u00f6nlemek i\u00e7in kritik bir ad\u0131md\u0131r. Ger\u00e7ek d\u00fcnya senaryolar\u0131nda, daha karma\u015f\u0131k temizleme i\u015flemleri i\u00e7in \"OWASP ESAPI\" veya \"Bluemonday\" gibi k\u00fct\u00fcphaneler kullan\u0131labilir.<\/p>\nhtml\/template<\/code> paketi, HTML \u00e7\u0131kt\u0131s\u0131n\u0131 otomatik olarak ka\u00e7\u0131\u015f karakterlerine d\u00f6n\u00fc\u015ft\u00fcrerek bu konuda b\u00fcy\u00fck kolayl\u0131k sa\u011flar.
\n2. Parametreli Sorgular (Parameterized Queries):<\/strong> Veritaban\u0131 etkile\u015fimlerinde asla dizge birle\u015ftirme (string concatenation) ile SQL sorgular\u0131 olu\u015fturmay\u0131n. Bunun yerine, Go'nun database\/sql<\/code> paketi ile parametreli sorgular veya haz\u0131r ifadeler (prepared statements) kullan\u0131n. Bu, SQL enjeksiyonunun en etkili \u00f6nleme y\u00f6ntemidir.
\n3. Hassas Veri \u015eifrelemesi:<\/strong> Veritaban\u0131nda veya dosya sisteminde saklanan hassas verileri (parolalar, kredi kart\u0131 bilgileri) \u015fifreleyin. Parolalar i\u00e7in tek y\u00f6nl\u00fc hashing algoritmalar\u0131 (\u00f6rne\u011fin, bcrypt) kullan\u0131n ve tuzlama (salting) i\u015flemini unutmay\u0131n.
\n4. Minimum Ayr\u0131cal\u0131k Prensibi (Principle of Least Privilege):<\/strong> Uygulaman\u0131z\u0131n ve veritaban\u0131 kullan\u0131c\u0131lar\u0131n\u0131z\u0131n sadece ihtiya\u00e7 duyduklar\u0131 ayr\u0131cal\u0131klara sahip oldu\u011fundan emin olun. \u00d6rne\u011fin, bir web uygulamas\u0131n\u0131n veritaban\u0131 kullan\u0131c\u0131s\u0131n\u0131n sadece SELECT<\/code> ve INSERT<\/code> yetkilerine sahip olmas\u0131, DROP TABLE<\/code> gibi kritik i\u015flemleri ger\u00e7ekle\u015ftirmesini engeller.<\/p>\nKimlik Do\u011frulama ve Yetkilendirme Mekanizmalar\u0131n\u0131 Go'da Nas\u0131l Sa\u011flamla\u015ft\u0131r\u0131r\u0131z?<\/h3>\n
\n * Hashing:<\/strong> Parolalar\u0131 asla d\u00fcz metin olarak saklamay\u0131n. Bunun yerine, Go'nun golang.org\/x\/crypto\/bcrypt<\/code> paketi gibi g\u00fcvenli, tek y\u00f6nl\u00fc hashing algoritmalar\u0131 kullan\u0131n. Bcrypt, parolan\u0131n hash'ini olu\u015ftururken rastgele bir tuz (salt) ekler ve yeterince yava\u015f \u00e7al\u0131\u015farak kaba kuvvet (brute-force) sald\u0131r\u0131lar\u0131n\u0131 zorla\u015ft\u0131r\u0131r.
\n * Tuzlama (Salting):<\/strong> Her parola i\u00e7in benzersiz bir tuz kullanmak, ayn\u0131 parolaya sahip iki kullan\u0131c\u0131n\u0131n farkl\u0131 hash de\u011ferlerine sahip olmas\u0131n\u0131 sa\u011flar ve g\u00f6kku\u015fa\u011f\u0131 tablosu (rainbow table) sald\u0131r\u0131lar\u0131n\u0131 engeller. Bcrypt bunu otomatik olarak yapar.
\n * G\u00fc\u00e7l\u00fc Parola Politikalar\u0131:<\/strong> Kullan\u0131c\u0131lardan uzun, karma\u015f\u0131k parolalar olu\u015fturmalar\u0131n\u0131 isteyin (b\u00fcy\u00fck\/k\u00fc\u00e7\u00fck harf, say\u0131, \u00f6zel karakter kar\u0131\u015f\u0131m\u0131).
\n* Oturum Y\u00f6netimi:<\/strong>
\n * G\u00fcvenli Oturum Kimlikleri:<\/strong> Oturum kimlikleri (session IDs) tahmin edilemez, rastgele ve yeterince uzun olmal\u0131d\u0131r. Go'da crypto\/rand<\/code> paketi ile g\u00fcvenli rastgele say\u0131lar olu\u015fturabilirsiniz.
\n * Oturum S\u00fcresi ve Yenileme:<\/strong> Oturumlar\u0131n belirli bir s\u00fcre sonra otomatik olarak sona ermesini sa\u011flay\u0131n ve kullan\u0131c\u0131 eylemsiz kald\u0131\u011f\u0131nda oturumlar\u0131 sonland\u0131r\u0131n. Hassas i\u015flemlerden sonra oturum kimliklerini yenilemek (session rotation) \u00f6nemlidir.
\n * \u00c7erez G\u00fcvenli\u011fi (Cookie Security):<\/strong> Oturum \u00e7erezlerini HTTP-only (JavaScript eri\u015fimini engeller), Secure (sadece HTTPS \u00fczerinden g\u00f6nderilir) ve SameSite (CSRF sald\u0131r\u0131lar\u0131n\u0131 \u00f6nler) nitelikleriyle yap\u0131land\u0131r\u0131n.
\n* \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (Multi-Factor Authentication - MFA):<\/strong> M\u00fcmk\u00fcnse, uygulaman\u0131zda MFA deste\u011fi sunun. Bu, kullan\u0131c\u0131lar\u0131n kimliklerini birden fazla y\u00f6ntemle (\u00f6rne\u011fin, parola ve cep telefonuna g\u00f6nderilen kod) do\u011frulamalar\u0131n\u0131 gerektirir ve ek bir g\u00fcvenlik katman\u0131 sa\u011flar.<\/p>\n\npackage main\n\nimport (\n\t\"fmt\"\n\t\"log\"\n\t\"net\/http\"\n\t\"time\"\n\n\t\"github.com\/gofrs\/uuid\" \/\/ UUID olu\u015fturmak i\u00e7in bir k\u00fct\u00fcphane\n\t\"golang.org\/x\/crypto\/bcrypt\"\n)\n\n\/\/ Kullan\u0131c\u0131 yap\u0131s\u0131\ntype User struct {\n\tID string\n\tUsername string\n\tPasswordHash []byte\n}\n\n\/\/ Basit bir kullan\u0131c\u0131 veritaban\u0131 (ger\u00e7ek uygulamada veritaban\u0131 kullan\u0131lmal\u0131)\nvar users = make(map[string]User) \/\/ username -> User\n\n\/\/ Oturum yap\u0131s\u0131\ntype Session struct {\n\tUserID string\n\tExpiresAt time.Time\n}\n\n\/\/ Basit bir oturum veritaban\u0131 (ger\u00e7ek uygulamada Redis\/Memcached gibi bir cache kullan\u0131lmal\u0131)\nvar sessions = make(map[string]Session) \/\/ sessionID -> Session\n\n\/\/ RegisterHandler, yeni kullan\u0131c\u0131 kayd\u0131n\u0131 y\u00f6netir\nfunc RegisterHandler(w http.ResponseWriter, r *http.Request) {\n\tif r.Method != http.MethodPost {\n\t\thttp.Error(w, \"Sadece POST metodu kabul edilir\", http.StatusMethodNotAllowed)\n\t\treturn\n\t}\n\n\tusername := r.FormValue(\"username\")\n\tpassword := r.FormValue(\"password\")\n\n\tif username == \"\" || password == \"\" {\n\t\thttp.Error(w, \"Kullan\u0131c\u0131 ad\u0131 ve parola bo\u015f olamaz\", http.StatusBadRequest)\n\t\treturn\n\t}\n\n\t\/\/ Parola hash'leme\n\thashedPassword, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)\n\tif err != nil {\n\t\thttp.Error(w, \"Parola hash'leme hatas\u0131\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\t\/\/ Benzersiz kullan\u0131c\u0131 ID'si olu\u015ftur\n\tuserID, err := uuid.NewV4()\n\tif err != nil {\n\t\thttp.Error(w, \"Kullan\u0131c\u0131 ID olu\u015fturma hatas\u0131\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tnewUser := User{\n\t\tID: userID.String(),\n\t\tUsername: username,\n\t\tPasswordHash: hashedPassword,\n\t}\n\n\tusers[username] = newUser\n\tfmt.Fprintf(w, \"Kullan\u0131c\u0131 %s ba\u015far\u0131yla kaydedildi.\", username)\n}\n\n\/\/ LoginHandler, kullan\u0131c\u0131 giri\u015fini y\u00f6netir\nfunc LoginHandler(w http.ResponseWriter, r *http.Request) {\n\tif r.Method != http.MethodPost {\n\t\thttp.Error(w, \"Sadece POST metodu kabul edilir\", http.StatusMethodNotAllowed)\n\t\treturn\n\t}\n\n\tusername := r.FormValue(\"username\")\n\tpassword := r.FormValue(\"password\")\n\n\tuser, found := users[username]\n\tif !found {\n\t\thttp.Error(w, \"Ge\u00e7ersiz kullan\u0131c\u0131 ad\u0131 veya parola\", http.StatusUnauthorized)\n\t\treturn\n\t}\n\n\t\/\/ Parolay\u0131 do\u011frula\n\terr := bcrypt.CompareHashAndPassword(user.PasswordHash, []byte(password))\n\tif err != nil {\n\t\thttp.Error(w, \"Ge\u00e7ersiz kullan\u0131c\u0131 ad\u0131 veya parola\", http.StatusUnauthorized)\n\t\treturn\n\t}\n\n\t\/\/ Oturum olu\u015ftur\n\tsessionID, err := uuid.NewV4()\n\tif err != nil {\n\t\thttp.Error(w, \"Oturum ID olu\u015fturma hatas\u0131\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\tsessions[sessionID.String()] = Session{\n\t\tUserID: user.ID,\n\t\tExpiresAt: time.Now().Add(30 * time.Minute), \/\/ Oturum 30 dakika ge\u00e7erli\n\t}\n\n\t\/\/ G\u00fcvenli \u00e7erez olu\u015ftur\n\thttp.SetCookie(w, &http.Cookie{\n\t\tName: \"session_token\",\n\t\tValue: sessionID.String(),\n\t\tExpires: time.Now().Add(30 * time.Minute),\n\t\tHttpOnly: true, \/\/ JavaScript eri\u015fimini engelle\n\t\tSecure: true, \/\/ Sadece HTTPS \u00fczerinden g\u00f6nder\n\t\tSameSite: http.SameSiteLaxMode, \/\/ CSRF korumas\u0131\n\t})\n\n\tfmt.Fprintf(w, \"Kullan\u0131c\u0131 %s ba\u015far\u0131yla giri\u015f yapt\u0131.\", username)\n}\n\n\/\/ AuthMiddleware, yetkilendirme i\u00e7in basit bir middleware\nfunc AuthMiddleware(next http.HandlerFunc) http.HandlerFunc {\n\treturn func(w http.ResponseWriter, r *http.Request) {\n\t\tcookie, err := r.Cookie(\"session_token\")\n\t\tif err != nil {\n\t\t\tif err == http.ErrNoCookie {\n\t\t\t\thttp.Error(w, \"Yetkilendirme gerekli\", http.StatusUnauthorized)\n\t\t\t\treturn\n\t\t\t}\n\t\t\thttp.Error(w, \"Ge\u00e7ersiz istek\", http.StatusBadRequest)\n\t\t\treturn\n\t\t}\n\n\t\tsessionID := cookie.Value\n\t\tsession, found := sessions[sessionID]\n\t\tif !found || session.ExpiresAt.Before(time.Now()) {\n\t\t\thttp.Error(w, \"Oturum ge\u00e7ersiz veya s\u00fcresi dolmu\u015f\", http.StatusUnauthorized)\n\t\t\treturn\n\t\t}\n\n\t\t\/\/ Oturumu yenile (iste\u011fe ba\u011fl\u0131, g\u00fcvenlik ve kullan\u0131c\u0131 deneyimi dengesi)\n\t\tsession.ExpiresAt = time.Now().Add(30 * time.Minute)\n\t\tsessions[sessionID] = session\n\n\t\t\/\/ Kullan\u0131c\u0131 ID'sini iste\u011fe ekleyebiliriz (context kullanarak daha iyi)\n\t\t\/\/ r = r.WithContext(context.WithValue(r.Context(), \"userID\", session.UserID))\n\n\t\tnext.ServeHTTP(w, r)\n\t}\n}\n\nfunc ProtectedHandler(w http.ResponseWriter, r *http.Request) {\n\tfmt.Fprintf(w, \"Bu korumal\u0131 bir kaynak. Ho\u015f geldiniz!\")\n}\n\nfunc main() {\n\thttp.HandleFunc(\"\/register\", RegisterHandler)\n\thttp.HandleFunc(\"\/login\", LoginHandler)\n\thttp.Handle(\"\/protected\", AuthMiddleware(ProtectedHandler))\n\n\tfmt.Println(\"Sunucu 8080 portunda dinliyor...\")\n\tlog.Fatal(http.ListenAndServe(\":8080\", nil))\n}\n <\/pre>\nAuthMiddleware<\/code> ile korumal\u0131 bir kayna\u011fa eri\u015fimi kontrol etmektedir.<\/p>\n
\n* Kaynak Tabanl\u0131 Yetkilendirme (Resource-Based Authorization):<\/strong> Baz\u0131 durumlarda, eri\u015fim kararlar\u0131 belirli bir kayna\u011f\u0131n (\u00f6rne\u011fin, bir kullan\u0131c\u0131n\u0131n kendi profilini d\u00fczenlemesi) sahibine veya \u00f6zelliklerine ba\u011fl\u0131 olabilir. Bu durumda, her istekte kullan\u0131c\u0131n\u0131n kayna\u011fa eri\u015fim yetkisi olup olmad\u0131\u011f\u0131n\u0131 kontrol edin.
\n* Yetkilendirme Kontrolleri:<\/strong> Her API u\u00e7 noktas\u0131 (endpoint) veya hassas i\u015flem i\u00e7in yetkilendirme kontrol\u00fc uygulay\u0131n. Bu kontroller, bir ara yaz\u0131l\u0131m (middleware) katman\u0131nda veya do\u011frudan i\u015f mant\u0131\u011f\u0131 i\u00e7inde yap\u0131labilir. Unutmay\u0131n, istemci taraf\u0131nda (frontend) yap\u0131lan yetkilendirme kontrolleri asla yeterli de\u011fildir; sunucu taraf\u0131nda (backend) her zaman do\u011frulama yap\u0131lmal\u0131d\u0131r.<\/p>\n
\n* CSRF (Cross-Site Request Forgery) Korumas\u0131:<\/strong> Web uygulamalar\u0131nda, kullan\u0131c\u0131lar\u0131n bilgisi d\u0131\u015f\u0131nda eylemler ger\u00e7ekle\u015ftirmesini \u00f6nlemek i\u00e7in CSRF token'lar\u0131 kullan\u0131n. Go'da, genellikle ara yaz\u0131l\u0131mlar bu token'lar\u0131 otomatik olarak olu\u015fturur ve do\u011frular. SameSite<\/code> \u00e7erez niteli\u011fi de bu t\u00fcr sald\u0131r\u0131lara kar\u015f\u0131 \u00f6nemli bir koruma sa\u011flar.
\n* G\u00fcvenlik Ba\u015fl\u0131klar\u0131:<\/strong> HTTP yan\u0131t ba\u015fl\u0131klar\u0131 (\u00f6rne\u011fin, X-Content-Type-Options<\/code>, X-Frame-Options<\/code>, Content-Security-Policy<\/code>) kullanarak taray\u0131c\u0131 tabanl\u0131 sald\u0131r\u0131lara (XSS, t\u0131klama ka\u00e7\u0131rma - clickjacking) kar\u015f\u0131 ek koruma sa\u011flay\u0131n.<\/p>\nBa\u011f\u0131ml\u0131l\u0131k Y\u00f6netimi ve G\u00fcvenlik G\u00fcncellemeleri Neden \u00d6nemli?<\/h3>\n
\n* Gizli Tehlikeler:<\/strong> Geli\u015ftiriciler genellikle kulland\u0131klar\u0131 t\u00fcm ba\u011f\u0131ml\u0131l\u0131klar\u0131n i\u00e7 i\u015fleyi\u015fini tam olarak bilemezler. Bu, g\u00f6zden ka\u00e7an g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131n uzun s\u00fcre fark edilmeden kalmas\u0131na neden olabilir.
\n* Bak\u0131m Y\u00fck\u00fc:<\/strong> Ba\u011f\u0131ml\u0131l\u0131klar\u0131 g\u00fcncel tutmak ve g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 takip etmek, \u00f6zellikle b\u00fcy\u00fck projelerde \u00f6nemli bir bak\u0131m y\u00fck\u00fc olu\u015fturabilir.<\/p>\n
\n * Periyodik Tarama:<\/strong> Go mod\u00fclleri (go.mod<\/code> ve go.sum<\/code>) arac\u0131l\u0131\u011f\u0131yla kullan\u0131lan t\u00fcm ba\u011f\u0131ml\u0131l\u0131klar\u0131 d\u00fczenli olarak taray\u0131n. Bu taramalar, bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 (CVE'ler - Common Vulnerabilities and Exposures) i\u00e7eren k\u00fct\u00fcphaneleri tespit etmenize yard\u0131mc\u0131 olur.
\n * Ara\u00e7 Kullan\u0131m\u0131:<\/strong> Go i\u00e7in govulncheck<\/code> gibi ara\u00e7lar, projenizdeki ba\u011f\u0131ml\u0131l\u0131klar\u0131 Go g\u00fcvenlik veri taban\u0131na (Go Vulnerability Database) kar\u015f\u0131 kontrol eder. Ayr\u0131ca, Snyk, Dependabot veya OWASP Dependency-Check gibi \u00fc\u00e7\u00fcnc\u00fc taraf g\u00fcvenlik taray\u0131c\u0131lar\u0131 da kullan\u0131labilir. Bu ara\u00e7lar, bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 otomatik olarak tespit eder ve d\u00fczeltme \u00f6nerileri sunar.
\n * \u00d6rnek Kullan\u0131m (govulncheck):<\/strong><\/p>\n\n# Go mod\u00fcl\u00fcn\u00fcz\u00fcn bulundu\u011fu dizinde\ngo install golang.org\/x\/vuln\/cmd\/govulncheck@latest\ngovulncheck .\/...\n <\/pre>\n