PortfolioAbout This Article
Point balance is personal information and must not be accessed without proper authentication. This article explains the mechanism for supporting multiple authentication methods while ensuring security.
Why Authentication is Important
Risks Without Authentication
Security Principles to Follow
- Authentication: Confirm who the request is from
- Authorization: Confirm the person has access permission
- Audit: Record all access
Authentication Mechanism
Authentication Check Flow
Receive point retrieval request from client
Get authentication token from request header
Verify token validity (signature, expiration)
Get authenticated customer ID from token
Confirm request target customer ID matches authenticated customer ID
If all pass, continue processing; if fail, return error
Flow Diagram
GET /api/points (Authorization: Bearer xxx)
Extract token -> Verify signature -> Check expiration -> Get customer ID -> Verify ownership
Supported Authentication Methods
Session Token Authentication
Customer authenticates with one-time password
Server issues session token
Save token in HttpOnly Cookie
Shopify Customer Account API Integration
Customer authenticates on Shopify's authentication screen
Shopify issues OAuth token
Can access customer info with token
Importance of Ownership Verification
Why Verify Ownership
Important: Even if authenticated, don't allow access to others' data
Verification Logic
Get customer ID (A) from auth token, target customer ID (X) from request params
Confirm A === X
Match -> Return point balance / Mismatch -> 403 error, log as unauthorized access
Security Measures
Implemented Measures
Error Response Design
For operators: Details can be verified in admin panel
Logging and Monitoring
Information to Record
Monitoring Alerts
Benefits of This Design
Security
- Safe design where others' points cannot be viewed
- Fraud detection and tracking possible
- Resilience against attacks
Operations
- Easy to identify causes when issues occur
- Security audit ready
- Data collection for continuous improvement