セキュリティの基本概念と用語

Core security terms are the alphabet of building secure systems. Let's lock in the words you'll meet over and over in auth work.

A principal is any entity that can be authenticated or authorized — a user, a service calling another service, or even a device. Basically, any identity needing verification.

When you sign into an app, you're the principal. Later, that app itself becomes a principal — using its own identity to reach the photo storage service.

A claim is a statement about a principal — a fact like a name or role, usually a key-value pair, that helps the system decide who you are and what you can do.

Think of a driver's license: it carries claims about you — name, email, role. Systems read these claims to make access decisions.

A token is a small digital proof of your identity and permissions — a badge that lets you access resources without re-entering credentials each time.

After you log in, the system issues a token. You send that with each request instead of your password, and the system inspects it to verify you.

A trust boundary is where the level of trust changes between systems. Anything crossing it should be treated as suspicious and validated.

Trust boundaries sit everywhere: browser to backend, app to database, even service to service. Each crossing demands validation, never blind trust.

Recap: principals are the who, claims are facts about them, tokens carry identity, and trust boundaries mark where you must validate.