[B! CSP] flatbirdã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

flatbird id:flatbird

CSPã«é–¢ã™ã‚‹flatbirdã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (14)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Content Security Policy é©ç”¨å¾Œã®çµŒéŽã‚’è¦³å¯Ÿã™ã‚‹ 2017å¹´11æœˆ
æŠ•ç¨¿è€…: kem / å³è¨˜å†… security / æŠ•ç¨¿æ—¥:2017-11-23 ( 6Â å¹´, 11Â ãƒ¶æœˆ ago) / æ›´æ–°æ—¥:2017-11-23 ( 6Â å¹´, 11Â ãƒ¶æœˆ ago) / ã‚³ãƒ¡ãƒ³ãƒˆ ã“ã®ãƒ–ãƒã‚°ã«éŽåŽ»ã€Content Security Policy ã‚’ reports-only ã§é©ç”¨ã—ã¾ã—ãŸã€‚ å‰å›ž ãƒãƒªã‚·ãƒ¼ã‚’å¤‰æ›´ã—ã¦ã‹ã‚‰3-4ãƒ¶æœˆãŒçµŒéŽã—ã¾ã—ãŸã®ã§ã€å†åº¦ãƒ¬ãƒãƒ¼ãƒˆã‚’é›†è¨ˆã—ã€å®šç¾©ã‚’è¦‹ç›´ã—ã¦ã„ãã¾ã™ã€‚ çµæžœã‚’ä»¥ä¸‹ã«è¨˜è¼‰ã—ã¾ã™ã€‚ [TOC] å‰å›žå¤‰æ›´æ™‚ã®è¨˜äº‹AMP HTML ã‚’ä½œæˆå¾Œã«ã€Content Security Policy (CSP) ã® report ã‚’ é›†è¨ˆã—ã¦ã€ãƒãƒªã‚·ãƒ¼ã‚’è¦‹ç›´ã™ | Monotalk ç¾åœ¨ã®ãƒãƒªã‚·ãƒ¼å®šç¾© Content-Security-Policy-Report-Only: script-src 'self' 'unsafe-inline'
flatbird 2018/01/11
csp

Security

Web
ãƒªãƒ³ã‚¯
Content-Security-Policyã‚„ã‚‰subresource integrityãªã©ã«é–¢ã™ã‚‹ãƒ¡ãƒ¢ - Sexually Knowing
æœ€è¿‘ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ç‰¹ã«æ°—ã‚’ã‹ã‘ãªã‘ã‚Œã°ã„ã‘ãªã„ã‚µãƒ¼ãƒ“ã‚¹ã®é–‹ç™ºã‚’ã—ã¦ã„ã¦èª¿ã¹ãŸçŸ¥è¦‹ã®ãƒ¡ãƒ¢ã€‚ subresource integrity Subresource Integrity - Web security | MDN ã„ã‚ã‚†ã‚‹ãƒã‚§ãƒƒã‚¯ã‚µãƒ ã®ä»•çµ„ã¿ã€‚ integrity å±žæ€§ã« ${hashalgorithm}-${hashdigest} å½¢å¼ã®å€¤ã‚’æ›¸ã„ã¦ãŠãã€ãƒ•ã‚§ãƒƒãƒã—ãŸãƒ•ã‚¡ã‚¤ãƒ«ã®ãƒãƒƒã‚·ãƒ¥å€¤ãŒä¸€è‡´ã—ã¦ã„ãªã‘ã‚Œã°ãƒ–ãƒ©ã‚¦ã‚¶ãŒèªã¿è¾¼ã¿ã‚’ãƒ–ãƒãƒƒã‚¯ã™ã‚‹ã€‚ ã“ã‚Œã¯ã€ãŸã¨ãˆã°CDNãŒæ”»æ’ƒã•ã‚Œã‚‹ãªã©ã—ã¦ã‚¹ã‚¯ãƒªãƒ—ãƒˆãªã©ãŒæ”¹ç«„ã•ã‚ŒãŸå ´åˆã«æœ‰åŠ¹ã€‚ JSã‚„CSSã¯ãƒ—ãƒªãƒ»ãƒã‚¹ãƒˆãƒ—ãƒã‚»ãƒƒã‚µã§å‡¦ç†ã—å‡ºåŠ›ã™ã‚‹ã“ã¨ãŒã»ã¨ã‚“ã©ã ã‚ã†ãŒã€subresource integrityã¨ã©ã†ã‚„ã£ã¦çµ±åˆã™ã‚‹ã‹ã¨ã„ã†ã¨gulp-hashsumã‚’ä½¿ã£ã¦ã‚³ãƒ³ãƒ‘ã‚¤ãƒ«ã—ãŸãƒ•ã‚¡ã‚¤ãƒ«ã®ãƒãƒƒã‚·ãƒ¥å€¤ã‚’digest.jsonã«ä¿å˜ã—ã€HTMLã®ãƒ¬ãƒ³ãƒ€
flatbird 2017/08/03
Web

Security

HTTP

CSP
ãƒªãƒ³ã‚¯
XSSã‚’é˜²ãæ–°ã—ã„XSS-Protectionãƒ˜ãƒƒãƒ€ - ASnoKaze blog
evalã¨reportOnlyã«ã¤ã„ã¦è¿½è¨˜ã—ã¾ã—ãŸ (2016/10/10) 2016/10/20 ä»•æ§˜åã¯ä»¥ä¸‹ã®é€šã‚Šã«ãªã‚Šã¾ã—ãŸã€‚Anti-XSS Response-Time Uniqueness Requirement ã¾ãŸã€ãƒ˜ãƒƒãƒ€åã¯ã€XSS-Protectionãƒ˜ãƒƒãƒ€ã§ã¯ãªãã€ARTURãƒ˜ãƒƒãƒ€ã¨ãªã£ã¦ãŠã‚Šã¾ã™ãŒã€ã¾ãŸå¤‰æ›´ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ Googleã®èª¿æŸ»ã«ã‚ˆã‚‹ã¨ã€CSPã«ã‚ˆã‚‹XSSã®é˜²æ¢ã¯ç¾å®Ÿçš„ã«ãƒ‡ãƒ—ãƒã‚¤ã®æ¬ é™¥ã«ã‚ˆã‚ŠXSSã®é˜²æ¢åŠ¹æžœãŒãªã„ã“ã¨ã‚’ç¤ºã—ã¦ã„ã¾ã™ã€‚èª¿æŸ»ã¯ã€ŒCSP Is Dead, Long Live CSP!ã€ã¨ã—ã¦ACMã®ã‚«ãƒ³ãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã§ç™ºè¡¨ã•ã‚Œã€ãƒšãƒ¼ãƒ‘ãƒ¼ã‚‚é–²è¦§ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ 9æœˆã«è¡Œã‚ã‚ŒãŸW3C TPAC 2016ã®WebAppSecã®ãƒŸãƒ¼ãƒ†ã‚£ãƒ³ã‚°ã§è°è«–ã•ã‚Œã€Googleã®Mike Westæ°ã‚ˆã‚Šæ–°ã—ãXSS Protectionã¨ã„ã†ä»•æ§˜ãŒææ¡ˆã•ã‚Œã¦
flatbird 2016/10/12
security

javascript

CSP

Web

HTTP

xss
ãƒªãƒ³ã‚¯
How HTML Injection Is Bad on Firefox OS
1101158.md How HTML Injection Is Bad on Firefox OS ã€ŒFirefox OS Advent Calendar 2014ã€ã¨ã€Œè„†å¼±æ€§"&'<<>\ Advent Calendar 2014ã€ã®12æœˆ20æ—¥ã®è¨˜äº‹ã§ã™ã€‚ å…ˆæœˆå ±å‘Šã—ãŸFirefox OSã®HTMLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãƒã‚°(Bug 1101158 )ã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ã“ã®ãƒã‚°ã¯Firefox OS Simulatorã‚’å«ã‚€ä¸€éƒ¨ã®ç’°å¢ƒã§ã¯ã¾ã ä¿®æ£ã•ã‚Œã¦ã„ã¾ã›ã‚“ãŒã€ãƒªã‚¹ã‚¯è©•ä¾¡ã®ä¸Šã€Mozillaã‚ˆã‚Šã¡ã‚‡ã†ã©æœ¬æ—¥(ï¼ï¼)ã€å…¬é–‹ã®è¨±å¯ã‚’é ‚ãæŽ²è¼‰ã—ã¦ãŠã‚Šã¾ã™ã€‚ HTML Injection on Firefox OS (Bug 1101158) Firefox OS v2.1/v2.2ã«ã¯ã€ç«¯æœ«ã®ãƒ›ãƒ¼ãƒ ãƒœã‚¿ãƒ³ã‚’é•·æŠ¼ã—ã—ãŸã¨ãã«è¡¨ç¤ºã•ã‚Œã‚‹ã‚«ãƒ¼ãƒ‰ãƒ“ãƒ¥ãƒ¼ã«ã€HTMLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®å¯èƒ½ãªç®‡æ‰€ãŒã‚ã‚Šã¾
flatbird 2015/01/03
FirefoxOS

security

vulnerability

csp
ãƒªãƒ³ã‚¯
CSP Lv.2ã®è©±
#ssmjp 2014/10 XSSã®é‹ç”¨ã®è©± é–“é•ã„ãªã©ã‚ã‚Šã¾ã—ãŸã‚‰ @yagihashoo ã¾ã§ã€‚ ## 10/28 9:26è¿½è¨˜ nonce-valueã€è¦æ ¼ä¸Šã¯Base64ã ã‚ˆï¼ã¨ã„ã†æŒ‡æ‘˜ã‚’ã„ãŸã ã„ãŸã®ã§ã‚¹ãƒ©ã‚¤ãƒ‰18-19ã‚’ä¿®æ£ã—ã¾ã—ãŸã€‚ è©³ç´°ã¯ä»¥ä¸‹ã‚’ã”è¦§ãã ã•ã„ã€‚ http://www.w3.org/TR/CSP2/#source-list-valid-nonces ## 10/29 15:00è¿½è¨˜ Path matchingã®ä¾‹ç¤ºã«ã¤ã„ã¦é–“é•ã„ãŒã‚ã£ãŸãŸã‚ã‚¹ãƒ©ã‚¤ãƒ‰14ã‚’ä¿®æ£ã—ã¾ã—ãŸã€‚Read less
flatbird 2014/12/19
CSP

security
ãƒªãƒ³ã‚¯
AVTOKYO 2014ã§ã€ŒCSPãŒåˆ‡ã‚Šé–‹ãWebã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®æœªæ¥ã€ã¨ã„ã†é¡Œã§è©±ã—ã¦ããŸ - è‘‰ã£ã±æ—¥è¨˜
AVTOKYO2014ã§ã€ã«ã—ã‚€ãã‚ã•ã‚“ã¨ã„ã£ã—ã‚‡ã«ã€Œã¯ã›ã‚€ãã‚ã€ã¨ã„ã†ãƒ¦ãƒ‹ãƒƒãƒˆåã§Content-Security-Policyã‚’ãƒ†ãƒ¼ãƒžã«è©±ã‚’ã—ã¦ãã¾ã—ãŸã€‚ Future of Web Security Opened up by CSP from Muneaki Nishimura å†…å®¹ã¯ã‚¹ãƒ©ã‚¤ãƒ‰ã®ã¨ãŠã‚Šã§ã€æ”»æ’ƒè€…ã¯Fiddlerãªã©ã‚’ä½¿ã£ã¦ä»»æ„ã®CSPé•åãƒ¬ãƒãƒ¼ãƒˆJSONã‚’é€ä¿¡å¯èƒ½ã§ã‚ã‚‹ã“ã¨ã€Firefoxã®å ´åˆã«ã¯CSPé•åãƒ¬ãƒãƒ¼ãƒˆã®JSONå†…ã«ã€Œ<ã€ã€Œ>ã€ãªã©ãŒå«ã¾ã‚Œã‚‹ã®ã§ã€é•åãƒ¬ãƒãƒ¼ãƒˆã‚’è¡¨ç¤ºã™ã‚‹ç®¡ç†ç”»é¢ã§ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ¼ã‚ŒãŒã‚ã‚‹ã¨é•åãƒ¬ãƒãƒ¼ãƒˆã‚’é€šã˜ã¦ç®¡ç†ç”»é¢å†…ã§XSSã™ã‚‹ã€ãªã©ã®è©±ã‚’è¡Œã„ã€å®Ÿéš›ã«ç®¡ç†ç”»é¢ã§ã®XSSã®ãƒ‡ãƒ¢ã‚’è¡Œã„ã¾ã—ãŸã€‚ ãƒ‡ãƒ¢ã¯ã‚ã‚“ã¾ã‚Šç´°ã‹ã„ã“ã¨ã¯è€ƒãˆã¦ãªã‹ã£ãŸã‚“ã§ã™ãŒã€ã‚¢ãƒ‰ãƒªãƒ–è‹¦æ‰‹ãªã«ã—ã‚€ãã‚ã•ã‚“ãŒã„ã„å‘³ã‚’å‡ºã—ã¦ã¦ã€æ¨ªã§è¦‹ã¦ã„ã¦ã‚‚æ¥½ã—ã‹ã£ãŸã§ã™ã€‚ã¡ãªã¿ã«ç›´å‰ã®æ‰“ã¡åˆã‚
flatbird 2014/11/18
security

web

csp

browser
ãƒªãƒ³ã‚¯
ãã‚ãã‚CSP Lv.2 nonceã‚„ã‚ã† - teppeis blog
tl;dr CSP Lv.2ã®nonceã‚’ä½¿ã†ã¨æ„å¤–ã¨ç°¡å˜ã«CSPã®æ©æµã‚’å—ã‘ã‚Œã‚‹ã‚ˆ Firefoxã¯unsafe-inlineã¨ã®æŒ™å‹•ãŒãŠã‹ã—ã„ã®ã§æ³¨æ„ ã‚µãƒ³ãƒ—ãƒ«å®Ÿè£…ã¨ã—ã¦Expressã§ç°¡å˜ã«nonceå¯¾å¿œã§ãã‚‹connectãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã‚’æ›¸ã„ãŸï¼ˆãƒ‡ãƒ¢ã‚ã‚Šï¼‰ Violation Reportã‚‚ãƒ–ãƒ©ã‚¦ã‚¶ã«ã‚ˆã£ã¦ç´°ã‹ã„æŒ™å‹•ã®å·®ç•°ãŒã‚ã‚‹ã‚ˆ CSP Lv.2 nonceã®ç™»å ´ã¨èƒŒæ™¯ CSPã®ç‰¹ã«unsafe-inlineã¯XSSã«å¯¾ã—ã¦æœ€çµ‚é˜²è¡›ç·šçš„ã«å¼·åŠ›ãªåŠ¹æžœãŒã‚ã‚‹ã€‚ ã—ã‹ã—ç‰¹ã«ã‚µãƒ¼ãƒãƒ¼ã‹ã‚‰ã®å€¤ã®å—ã‘æ¸¡ã—éƒ¨åˆ†ãªã©ã§ã©ã†ã—ã¦ã‚‚inline scriptã‚’ä½¿ã„ãŸããªã‚‹ã¨ã“ã‚ãŒã‚ã‚Šã€unsafe-inlineã‚’ç¦æ¢ã™ã‚‹ã¨DOM dataç‰ã‚’ä½¿ã‚ã–ã‚‹ã‚’å¾—ãšã€ã¤ã‚‰ã„æ„Ÿã˜ã ã£ãŸã€‚ @kazuho ã§ã™ãã€‚ã‹ã¨ã„ã£ã¦DOM dataã‹ãƒ¼ã€ã€ã¨ã„ã†æ„Ÿã˜ã§ã¯ã‚ã‚‹ã‚“ã§ã™ãŒã€CSPã§inline scriptç¦æ¢ã—ã¡
flatbird 2014/11/17
CSP

security

JavaScript
ãƒªãƒ³ã‚¯
Content-Security-Policy ã¨ nonce ã®è©± - tokuhirom's blog
Content-Security-Policy ã® nonce ã‚’åˆ©ç”¨ã™ã‚‹ã¨ã€XSS ã®è„…å¨ã‚’ã‹ãªã‚Šè»½æ¸›ã§ãã¾ã™ã€‚ ãã“ã§ã€Web Application Framework ã§ã¯ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§å¯¾å¿œã—ãŸã»ã†ãŒã‚ˆã„ã®ã§ã¯ãªã„ã‹ã€ã¨ã„ã†æ—¨ã‚’ @hasegawayosuke ã•ã‚“ã‹ã‚‰æ•™ãˆã¦é ‚ã„ãŸã®ã§ã€å®Ÿè£…ã«ã¤ã„ã¦è€ƒãˆã¦ã¿ã¾ã—ãŸã€‚ ã¨ã‚Šã‚ãˆãš CSP ã® nonce ã¯ã©ã†ã„ã†ã‚‚ã®ãªã®ã‹ã‚’è€ƒæ…®ã™ã‚‹ãŸã‚ã«ã€ã‚³ãƒ¼ãƒ‰ä¾‹ã‚’æŽ¢ã—ã¦ã„ãŸã®ã§ã™ãŒã€å®Ÿéš›ã«å‹•ãã‚µãƒ³ãƒ—ãƒ«ã¨ã„ã†ã‚‚ã®ãŒ nonce é–¢é€£ã®ã‚‚ã®ã§è¦‹å½“ãŸã‚Šã¾ã›ã‚“ã§ã—ãŸã€‚ ãã“ã§ã€å®Ÿéš›ã«å‹•ãã‚µãƒ³ãƒ—ãƒ«ã‚’ç”¨æ„ã—ã¾ã—ãŸã€‚ https://github.com/tokuhirom/csp-nonce-sample ä»¥ä¸‹ã¯ Sinatra ã§æ›¸ã‹ã‚ŒãŸã‚µãƒ³ãƒ—ãƒ«ã‚³ãƒ¼ãƒ‰ã§ã™ã€‚ require 'sinatra' require 'securerandom' get '/' d
flatbird 2014/09/30
security

Web

CSP

XSS

impressive
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
flatbird 2014/06/13
security

xss

CSP
ãƒªãƒ³ã‚¯
GitHub - brianmhunt/knockout-secure-binding: Use Knockout without unsafe-eval / content security policy
flatbird 2014/06/03
Javascript

knockout

csp
ãƒªãƒ³ã‚¯
GitHub - yandex/csp-reporter: Content Security Policy logs parser
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
flatbird 2014/01/31
html5

security

csp
ãƒªãƒ³ã‚¯
å¼Šç¤¾ã®ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã«Content Security Policy(CSP)ã‚’å°Žå…¥ã—ã¾ã—ãŸ
å¼Šç¤¾ã®ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã«CSP(Content Security Policy)ã‚’å°Žå…¥ã—ã¾ã—ãŸã€‚CSPã«ã¤ã„ã¦ã¯ã€ã¯ã›ãŒã‚ã‚ˆã†ã™ã‘æ°ã®ã‚¹ãƒ©ã‚¤ãƒ‰ã€Œ5åˆ†ã§ã‚ã‹ã‚‹CSPã€ãŒã‚ã‹ã‚Šã‚„ã™ã„ã¨æ€ã„ã¾ã™ã€‚ä»¥ä¸‹ã«ã‚¹ãƒ©ã‚¤ãƒ‰ã®ä¸€éƒ¨ã‚’å¼•ç”¨ã—ã¾ã™ã€‚ å…·ä½“çš„ã«ã¯ã€ä»¥ä¸‹ã®ã‚ˆã†ã«æŒ‡å®šã—ã¦ä½¿ã„ã¾ã™ã€‚ Content-Security-Policy: default-src 'self' ã“ã®çµæžœã€ä»¥ä¸‹ã®ã‚ˆã†ã«JavaScriptã®è¨˜è¿°ãŒåˆ¶é™ã•ã‚Œã¾ã™ã€‚ å¤–éƒ¨ã®JavaScriptã®èªã¿è¾¼ã¿ã¯ç¦æ¢ HTMLã‚½ãƒ¼ã‚¹ã«è¨˜è¿°ã—ãŸ<script>...</script>ã®JavaScriptã¯ç¦æ¢ ã‚¤ãƒ™ãƒ³ãƒˆå±žæ€§(onload="xxxx"ãªã©)ã¯ç¦æ¢ ä½•ã‚‚æ›¸ã‘ãªããªã‚‹ã˜ã‚ƒãªã„ã‹ã¨æ€ã‚ã‚Œã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ãŒã€JavaScriptã¯å…¨ã¦*.jsãƒ•ã‚¡ã‚¤ãƒ«ã«è¨˜è¿°ã™ã‚Œã°ã‚ˆã„ã€ã¨ã„ã†ã“ã¨ã§ã™ã€‚ CSPã¯ã€JavaScriptã®ã‚³ãƒ¼ãƒ‰ã¨ãƒ‡ãƒ¼ã‚¿ã‚’åˆ†é›¢ã—ã¦
flatbird 2013/12/07
web

security
ãƒªãƒ³ã‚¯
GitHub - github/secure_headers: Manages application of security headers with many safe defaults
SecureHeaders::Configuration.default do |config| config.cookies = { secure: true, # mark all cookies as "Secure" httponly: true, # mark all cookies as "HttpOnly" samesite: { lax: true # mark all cookies as SameSite=lax } } # Add "; preload" and submit the site to hstspreload.org for best protection. config.hsts = "max-age=#{1.week.to_i}" config.x_frame_options = "DENY" config.x_content_type_option
flatbird 2013/06/18
CSPãªã©ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç³»ã®ãƒ˜ãƒƒãƒ€ã‚’å‡ºåŠ›ã™ã‚‹gem

CSP

HTTP

Security

Web
ãƒªãƒ³ã‚¯
Firefoxã€XSSæ”»æ’ƒé˜²æ¢ã¸ã€€W3Cã®ä»•æ§˜ã«å¯¾å¿œ
FirefoxãŒã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰ã‚„ãƒ‡ãƒ¼ã‚¿ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãªã©ã®æ”»æ’ƒã‚’é˜²ããŸã‚ã®ã€ŒContent Security Policy 1.0ã€ã‚’ã‚µãƒãƒ¼ãƒˆã—ãŸã€‚ ç±³Mozilla Foundationã¯6æœˆ11æ—¥ã€Webã‚µã‚¤ãƒˆçµŒç”±ã®æ”»æ’ƒé˜»æ¢ã‚’ç›®çš„ã¨ã—ãŸä»•æ§˜ã€ŒContent Security Policyï¼ˆCSPï¼‰ 1.0ã€ã‚’Webãƒ–ãƒ©ã‚¦ã‚¶ã®Firefoxã«å®Ÿè£…ã—ãŸã¨ç™ºè¡¨ã—ãŸã€‚ CSPã¯ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXSSï¼‰ã‚„ãƒ‡ãƒ¼ã‚¿ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãªã©ã€æ”»æ’ƒã®å¸¸å¥—æ‰‹æ®µã¨ã—ã¦ä½¿ã‚ã‚Œã‚‹æ‰‹å£ã‚’æ¤œå‡ºã—ã¦è»½æ¸›ã™ã‚‹ãŸã‚ã«ä½¿ã‚ã‚Œã‚‹ã€‚ä»•æ§˜ãŒç¢ºå®šã™ã‚‹å‰æ®µéšŽã®CSPã¯2011å¹´3æœˆã‹ã‚‰Firefox 4.0ã«å®Ÿè£…ã•ã‚Œã¦ã„ãŸã€‚ 2011å¹´11æœˆã«ã¯W3CãŒCSP 1.0ã®è‰æ¡ˆã‚’ç–å®šã—ã€1å¹´å¾Œã«å‹§å‘Šå€™è£œã®æ®µéšŽã«åˆ°é”ã€‚Googleã®Chromeã¯2013å¹´ã«ãƒªãƒªãƒ¼ã‚¹ã—ãŸChrome 25ã§ã“ã‚Œã‚’ã‚µãƒãƒ¼
flatbird 2013/06/13
Firefox

Security

csp

browser
ãƒªãƒ³ã‚¯
1