[B! security][web] ir9ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ir9 id:ir9

securityã¨webã«é–¢ã™ã‚‹ir9ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (12)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ç†è§£ã—ã¦ã‚‹ã¤ã‚‚ã‚Šã® SSL/TLS ã§ã‚‚ã€ã‚‚ã£ã¨ç†è§£ã—ãŸã‚‰é¢ç™½ã‹ã£ãŸè©± Â· ã‘ã‚“ã”ã®ãŠå±‹æ•·
apache ã‚„ nginx ã®è¨å®šã‚’ã—ãŸã“ã¨ãŒã‚ã‚Œã°ä»¥ä¸‹ã®æ§˜ãªè¡Œã‚’è¦‹ãŸã“ã¨ãŒã‚ã‚‹äººã‚‚å¤šã„ã®ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚(â€» ä¸‹è¨˜ã¯ nginx ã®è¨å®šã€‚apache ã®å ´åˆã¯ SSLCipherSuite ã§ã™ã€‚) ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5; ã“ã‚ŒãŒæš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã‚’æŒ‡å®šã—ã¦ã„ã‚‹ç®‡æ‰€ã§ã™ã€‚ãã—ã¦ã“ã®éƒ¨åˆ†ã€ã‚ã‘ã®ã‚ã‹ã‚‰ãªã„æ–‡å—åˆ—ã®ç¾…åˆ—ãªã®ã§ã™ã”ãå–ã£ã¤ãã«ããã¦ä½•ã‚’æŒ‡å®šã—ãŸã‚‰ã„ã„ã‹ã‚ã‹ã‚‰ãªã„ã®ã§ã€ã‚³ãƒ”ãƒšã—ã¦ã—ã¾ã†äººã‚‚å¤šã„ã‚“ã˜ã‚ƒãªã„ã§ã—ã‚‡ã†ã‹ã€‚ã‹ãã„ã†ç§ã‚‚æ•°å¹´å‰ã«è¶£å‘³ã§ TLS å¯¾å¿œã® Web ã‚µãƒ¼ãƒ“ã‚¹ã‚’ä½œã£ãŸæ™‚ã¯ã‚³ãƒ”ãƒšã§æ¸ˆã¾ã›ã¦ã„ã¾ã—ãŸã€‚ã“ã®æš—å·ã‚¹ã‚¤ãƒ¼ãƒˆã¯ã€ä»¥ä¸‹ã®ã‚ˆã†ãª OpenSSL ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’ä½¿ã£ã¦å¯¾å¿œã—ã¦ã„ã‚‹ä¸€è¦§ã‚’è¦‹ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ $ openssl ciphers -v AES128-SH
ir9 2015/12/02
æš—å·åŒ–

security

web
ãƒªãƒ³ã‚¯
Let's Encrypt ã‚’ä½¿ã£ã¦è¨¼æ˜Žæ›¸ã‚’å–å¾—ã—ãŸã®ã§ Azure Web Apps ã«è¨å®šã—ã¦ç¢ºèªã—ã¦ã¿ãŸ - ã—ã°ã‚„ã‚“é›‘è¨˜
Let's Encrypt åŽ»å¹´ã‹ã‚‰æ°—ã«ãªã£ã¦ã„ãŸ Let's Encrypt ãŒã‚¯ãƒãƒ¼ã‚ºãƒ‰ãƒ™ãƒ¼ã‚¿ã«ãªã‚Šã€ç”³è«‹ã™ã‚Œã°å®Ÿéš›ã«è¨¼æ˜Žæ›¸ã®ç™ºè¡ŒãŒãƒ†ã‚¹ãƒˆã§ãã‚‹ã¨èžã„ãŸã®ã§ã€æ—©é€Ÿç”³è«‹ã—ã¦è¨¼æ˜Žæ›¸ã®ç™ºè¡Œã‚’è¡Œã£ã¦ã¿ã¾ã—ãŸã€‚ãŸã ã— IIS ã§ä½¿ã†å‰æã§ã™ã€‚ Letâ€™s Encryptã§ValidãªSSL/TLSè¨¼æ˜Žæ›¸ã‚’å–å¾—ã™ã‚‹ | DevelopersIO Dockerã§Letâ€™s Encryptã—ã‚ˆã£ã‹ - Qiita æ—¢ã«è¨¼æ˜Žæ›¸ã®ç™ºè¡Œã‚’è©¦ã—ãŸæ–¹ã‚‚å±…ãŸã®ã§å‚è€ƒã«ã—ã¦ã„ãŸã®ã§ã™ãŒã€æ—¢ã«å¾®å¦™ã«æŒ™å‹•ãŒå¤‰ã‚ã£ã¦ã„ã‚‹ã®ã§æ³¨æ„ã—ãŸã„ã§ã™ã€‚ä¸€å¿œãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã‚‚å…¬é–‹ã•ã‚Œã¦ã¾ã™ãŒã€ãƒ¡ãƒ¼ãƒ«ã«æ›¸ã„ã¦ã‚ã£ãŸåˆ†ã§ååˆ†ãªæ„Ÿã˜ã§ã™ã€‚ User Guide The Letâ€™s Encrypt project â€” letsencrypt latest documentation Let's Encrypt ã§ã¯ Web ã‚µãƒ¼ãƒãƒ¼ã¸ã®è¨¼æ˜Žæ›¸è¨å®š
ir9 2015/11/13
security

web

devel
ãƒªãƒ³ã‚¯
JavaScriptæ–‡å—åˆ—ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—
ã“ã‚Œã‚‰ã®ä¸ã§æ³¨ç›®ã™ã¹ãã¯ â€˜ ã¨ â€ ã¨ \ ã§ã™ã€‚ã‚·ãƒ³ã‚°ãƒ«ã‚¯ã‚©ãƒ¼ãƒˆã€ãƒ€ãƒ–ãƒ«ã‚¯ã‚ªãƒ¼ãƒˆã¯æ–‡å—ãƒªãƒ†ãƒ©ãƒ«ã‚’ä½œæˆã™ã‚‹ç‚ºã«åˆ©ç”¨ã•ã‚Œã€\ ã§ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã§ãã‚‹ã“ã¨ã§ã™ã€‚ã¤ã¾ã‚Šã€æ–‡å—ãƒªãƒ†ãƒ©ãƒ«ã®æœ€å¾Œã« \ ãŒç¾ã‚Œã‚‹ã¨æ–‡å—åˆ—ã®çµ‚ç«¯ãŒç„¡ããªã‚Šã¾ã™ã€‚å˜ç‹¬ã§ä¸æ£ãªJavaScriptã®æŒ¿å…¥ãŒå¯èƒ½ã«ãªã‚‹è¨³ã§ã¯ã‚ã‚Šã¾ã›ã‚“ãŒã€ãƒ—ãƒã‚°ãƒ©ãƒ ã®æ§‹é€ ãŒç ´å£Šã•ã‚Œã‚‹äº‹ã‚’æ„å‘³ã—ã¾ã™ã€‚ PHPã«ã¯JavaScriptæ–‡å—åˆ—ç”¨ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—é–¢æ•°ãŒç”¨æ„ã•ã‚Œã¦ã„ã¾ã›ã‚“ã€‚htmlspecialchars()ã‚„htmlentities()ã§ä»£ç”¨ã—ã¦ã„ã‚‹å ´åˆã‚‚å¤šã„ã¨æ€ã„ã¾ã™ã€‚ã—ã‹ã—ã€ã“ã‚Œã‚‰ã®é–¢æ•°ã§ã¯JavaScriptæ–‡å—åˆ—ã®ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã‚’ååˆ†ã«è¡Œã†äº‹ãŒã§ãã¾ã›ã‚“ã€‚ JavaScriptãƒ—ãƒã‚°ãƒ©ãƒ ã®æ§‹é€ ãŒç ´å£Šã•ã‚Œã‚‹ä¾‹ <?php $msg1 = 'test string\\'; $msg2 = ');alert(document.cookie); //
ir9 2013/11/02
JavaScript

security

web
ãƒªãƒ³ã‚¯
XSSã‚’æ”¾ç½®ã—ã¦ãŸã‚‰æ•°ååˆ†ã§ã‚µã‚¤ãƒˆã®ãƒ‡ã‚¶ã‚¤ãƒ³ãŒå‡ºæ¥ä¸ŠãŒã£ã¦ãŸä»¶
ä½œã£ã¦ãŸã‚ªãƒ³ãƒ©ã‚¤ãƒ³ã‚²ãƒ¼ãƒ ã®é€šä¿¡éƒ¨åˆ†ã‚‰ã—ãã‚‚ã®ãŒãªã‚“ã¨ãªãå‡ºæ¥ä¸ŠãŒã£ãŸã®ã§ã€é©å½“ã«ãƒãƒ£ãƒƒãƒˆã‚‚ã©ãã‚’ä½œã‚Šä¸Šã’ã¦å…¬é–‹ã—ã¦ã¾(ã™|ã—ãŸ)ã€‚ ã“ã“ã§ã™ http://osyoyu.com/client/ ã¨ã“ã‚ã§ã€WebSocket+MessagePackã‚’ä½¿ã£ãŸé€šä¿¡ãŒå®Ÿè£…ã§ããŸã“ã¨ã§å¬‰ã—ããªã£ã¦ã€XSSå¯¾ç–ã¨ã‹å¿˜ã‚Œã¦ã¾ã—ãŸã€‚ ãã“ã«ç›®ã‚’ã¤ã‘ãŸ @kyonfuee ã•ã‚“ãŒjQueryã‚’å®Ÿè¡Œã—ã¾ãã£ã¦ãƒ‡ã‚¶ã‚¤ãƒ³ã—ã¦ãã‚Œã¾ã—ãŸ(!?) ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ï¼ï¼ before (ãŠä¸–è¾žã«ã‚‚è‰¯ã„ãƒ‡ã‚¶ã‚¤ãƒ³ã¨ã¯è¨€ãˆãªã„): ã£ã¦ã„ã†æ„Ÿã˜ã«ãªã£ã¦ã¾ã—ãŸã€‚æ°—ã¥ã‹ãªã„ã†ã¡ã«ç°¡ç´ ãªãƒšãƒ¼ã‚¸ãŒè±ªè¯ã«ãªã£ã¦ã¾ã—ãŸã€‚æ„Ÿå‹•â€¦ï¼ï¼ ã‚ã¨èª°ã æ„›ç†ã‚’backgroundã«ã—ãŸã®ã€‚æ¬¡ã‹ã‚‰ã¯ã§ãã‚Œã°ãƒãƒªã£å¨˜ã§ãŠé¡˜ã„ã—ã¾ã™ã€‚ çµè«–: XSSã¯ç©æ¥µçš„ã«æ”¾ç½®ã—ã¦è¡Œã‘ ã‚ã€æœ€çµ‚çš„ã«ã¯ em-websocket ãŒãƒã‚°ã£ã¦æ»ã‚“ã ã£ã½ã„ã®ã§, æš‡ãŒã‚ã£
ir9 2012/10/10
ãƒã‚¿

web

xss

security

jQuery
ãƒªãƒ³ã‚¯
ã‚¢ãƒŽãƒ‹ãƒžã‚¹ãŒã€ŒéœžãŒé–¢ã¨éœžãƒ¶æµ¦ã‚’é–“é•ãˆãŸã€ã“ã¨ãŒå®šèª¬ã«ãªã£ã¦ã„ã‚‹ä»¶ã«é–¢ã—ã¦
å›½åœŸäº¤é€šçœé–¢æ±åœ°æ–¹æ•´å‚™å±€éœžãƒ¶æµ¦æ²³å·äº‹å‹™æ‰€Webã‚µã‚¤ãƒˆã®æ”¹ã–ã‚“ãŒ#opjapanã®IRCã§å ±å‘Šã•ã‚Œã‚‹ 20:57 (Juzzy) http://www.kasumi.ktr.mlit.go.jp/ 20:57 (Juzzy) Defaced. 20:57 (An3cd0t3) japan 20:57 (An3cd0t3) we have a news for you 20:57 (An3cd0t3) your awesome defacee has come up 20:57 (An3cd0t3) http://www.kasumi.ktr.mlit.go.jp/ 20:57 (An3cd0t3) defaced 20:57 (An3cd0t3) :D 20:57 (An3cd0t3) by juzzy :D æ³¨ï¼‰ã‚¢ãƒŽãƒ‹ãƒžã‚¹ã¯ä¸»ã«IRC(Internet Relay Chat)ã¨å‘¼ã°ã‚Œã‚‹ãƒãƒ£
ir9 2012/07/08
ã¾ã¨ã‚

security

web
ãƒªãƒ³ã‚¯
å€‹äººåˆ©ç”¨ãªã‚‰ SSL è¨¼æ˜Žæ›¸ãŒç„¡æ–™ã§åˆ©ç”¨ã§ãã‚‹ã‚‰ã—ã„: ã‚ã‚‹ SE ã®ã¤ã¶ã‚„ã
ã€Œä½“ç³»çš„ã«å¦ã¶ å®‰å…¨ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ä½œã‚Šæ–¹ã€ã‚’èªã‚“ã§ã„ãŸã‚‰ã€ã¨ã£ã¦ã‚‚æ°—ã«ãªã‚‹è¨˜è¿°ãŒã€‚ ã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã®ã†ã¡ãƒ‰ãƒ¡ã‚¤ãƒ³èªè¨¼è¨¼æ˜Žæ›¸ã¯æ¯”è¼ƒçš„ä¾¡æ ¼ãŒå®‰ãã€è³¼å…¥ã®ãƒãƒ¼ãƒ‰ãƒ«ãŒä½Žã„ã‚‚ã®ã§ã™ãŒã€ãƒ‰ãƒ¡ã‚¤ãƒ³èªè¨¼è¨¼æ˜Žæ›¸ã«ã¯ç„¡æ–™ã®ã‚‚ã®ãŒã‚ã‚Šã¾ã™ã€‚ã‚¤ã‚¹ãƒ©ã‚¨ãƒ«ã®StartComã¨ã„ã†ä¼æ¥ã¯ã€ç„¡æ–™ã®ã‚µãƒ¼ãƒãƒ¼è¨¼æ˜Žæ›¸ã‚’ç™ºè¡Œã—ã¦ã„ã¾ã™ã€‚IEã€Firefoxã€Google Chromeã€Safariã€Operaã®æœ€æ–°ç‰ˆã§è¨¼æ˜Žæ›¸ã‚¨ãƒ©ãƒ¼ãªãä½¿ç”¨ã§ãã¾ã™ã€‚IE6ã§ã‚‚ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆãŒå½“ãŸã£ã¦ã„ã‚Œã°ä½¿ç”¨ã§ãã¾ã™ã€‚ æ—¥æœ¬ã®æºå¸¯é›»è©±ã«ã¯å¯¾å¿œã—ã¦ã„ãªã„ã‚ˆã†ã§ã™ã€‚ã—ã‹ã—ã€ä»Šã¾ã§ãƒ©ãƒ”ãƒƒãƒ‰ SSL ãŒå¹´é–“2,100å††ã§æœ€å¼·ã ã¨æ€ã£ã¦ã„ãŸã‘ã©ç„¡æ–™ã®ã‚‚ã®ãŒã‚ã‚‹ã¨ã¯ã€‚æ°—ã«ãªã£ãŸã®ã§ã€ã¡ã‚‡ã£ã¨èª¿ã¹ã¦ã¿ã¾ã—ãŸã€‚ ä»¥ä¸‹ã®ç”»é¢ãŒ StartCom ã®ã‚µã‚¤ãƒˆã§ã™ã€‚ç”»é¢ã®èµ¤æž ã®ãƒªãƒ³ã‚¯ã‚’ã‚¯ãƒªãƒƒã‚¯ã™ã‚‹ã¨æ¬¡ã®ç”»é¢ãŒè¡¨ç¤ºã•ã‚Œã¾ã™ã€‚ ãã†ã™ã‚‹ã¨ã€SSL è¨¼æ˜Žæ›¸ã®è£½å“ç´¹ä»‹
ir9 2012/03/22
web

security
ãƒªãƒ³ã‚¯
[ãƒ‡ãƒ–ã‚µãƒŸ2012]è¶£å‘³ã¨å®Ÿç›Šã®è„†å¼±æ€§ç™ºè¦‹
1. Finding Vulnerabilities For Fun And Profit è¶£å‘³ã¨å®Ÿç›Šã®è„†å¼±æ€§ç™ºè¦‹ Feb 16 2012 Yosuke HASEGAWA 2. è‡ªå·±ç´¹ä»‹ ã¯ã›ãŒã‚ã‚ˆã†ã™ã‘ ï¶ãƒãƒƒãƒˆã‚¨ãƒ¼ã‚¸ã‚§ãƒ³ãƒˆæ ªå¼ä¼šç¤¾ ç ”ç©¶é–‹ç™ºéƒ¨ ï¶æ ªå¼ä¼šç¤¾ã‚»ã‚ãƒ¥ã‚¢ã‚¹ã‚«ã‚¤ãƒ»ãƒ†ã‚¯ãƒŽãƒã‚¸ãƒ¼ æŠ€è¡“é¡§å• ï¶Microsoft MVP for Consumer Security Oct 2005 - ï¶http://utf-8.jp/ ï¶é›£èªåŒ–JavaScriptæ›¸ã„ã¦ã¾ã™ Developers Summit 2012 NetAgent http://www.netagent.co.jp/ 4. è¨˜å·JavaScript JS without alnum $=~[];$={___:++$,$$$$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:+ +$,$_$$:
ir9 2012/02/22
web

JavaScript

security

xss
ãƒªãƒ³ã‚¯
XSSã®æ”»æ’ƒæ‰‹æ³•ã„ã‚ã„ã‚ - ã†ãªã®æ—¥è¨˜
html5securityã®ã‚µã‚¤ãƒˆã«ã€XSSã®å„ç¨®æ”»æ’ƒæ‰‹æ³•ãŒã¾ã¨ã‚ã‚‰ã‚Œã¦ã„ã‚‹ã®ã‚’ç™ºè¦‹ã›ã‚Š!ã¨ã„ã†ã“ã¨ã§ã€å€‹äººçš„ã«ã€ŒãŠ!ã€ã¨æ€ã£ãŸæ”»æ’ƒã‚’ã‚µãƒ³ãƒ—ãƒ«ã¤ãã§ã”ç´¹ä»‹ã—ã¾ã™ã€‚ 1. CSS Expression IE7ä»¥å‰ã«ã¯ã€ŒCSS Expressionsã€ã¨ã„ã†æ‹¡å¼µæ©Ÿèƒ½ãŒã‚ã‚Šã€CSSå†…ã§JavaScriptã‚’å®Ÿè¡Œã§ããŸã‚Šã—ã¾ã™ã€‚ <div style="color:expression(alert('XSS'));">a</div> ç¢ºèª @IT -ï¼»æŸ”è»Ÿã™ãŽã‚‹ï¼½IEã®CSSè§£é‡ˆã§èµ·ã“ã‚‹XSS ã§è©³ã—ãè§£èª¬ã•ã‚Œã¦ã„ã¾ã™ãŒã€CSSã®è§£é‡ˆãŒæŸ”è»Ÿãªã“ã¨ã¨ã‚‚ã‚ã„ã¾ã£ã¦è‡ªå‰ã§ç„¡å®³åŒ–ã™ã‚‹ã®ã¯ãªã‹ãªã‹å›°é›£ã€‚ä»¥ä¸‹ã®ã‚ˆã†ãªã‚³ãƒ¼ãƒ‰ã§ã‚‚ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œã•ã‚Œã¦ã—ã¾ã„ã¾ã™ã€‚ <div style="color:expr/* ã‚³ãƒ¡ãƒ³ãƒˆã®æŒ¿å…¥ */ession(alert('XSS'));">a</div> ç¢ºèª <div s
ir9 2010/06/22
web

security

ã¾ã¨ã‚

html
ãƒªãƒ³ã‚¯
OAuthãƒ—ãƒãƒˆã‚³ãƒ«ã®ä¸èº«ã‚’ã–ã£ãã‚Šè§£èª¬ã—ã¦ã¿ã‚‹ã‚ˆ - ( ê’ªâŒ“ê’ª) ã‚†ã‚‹ã‚ˆã‚æ—¥è¨˜
ã€ŒãŠãƒ¼ãŠãƒ¼ã£ã™ã£!ã€ ã¦ãªã“ã£ã¦ã€Twitterã®APIã®BASICèªè¨¼ã‚‚6æœˆæœ«ã«çµ‚äº†ã—ã¦OAuth/xAuthã«ç§»è¡Œã™ã‚‹ã¨ã„ã†ã“ã®æ™‚æœŸã«ã€ã‚ã‚‰ãŸã‚ã¦OAuthã«ã¤ã„ã¦å‹‰å¼·ã—ã¦ã¿ãŸã‚“ã§ã™ã®ã‚ˆ? OAuthèªè¨¼ã‚’åˆ©ç”¨ã™ã‚‹ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã¯å„è¨€èªžã§å‡ºãã‚ã£ã¦ãã¦ã‚‹ã®ã§ãã‚Œã‚’ä½¿ãˆã°ã„ã‚“ã˜ã‚ƒã¾ã„ã‹? ã¨ã„ã†ã¨è©±ãŒçµ‚ã‚ã‚‹ã®ã§ã€ã˜ã‚ƒã‚ãã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®ä¸èº«ã¯ãªã«ã‚„ã£ã¦ã‚“ã®ã‚ˆã£ã¦ã“ã¨ã‚’ã€OAuthã™ã‚‹Scalaã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªä½œã‚ŠãªãŒã‚‰èª¿ã¹ãŸã“ã¨ã‚’ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ é–“é•ã£ã¦ã„ã‚‹ã¨ã“ã‚ã‚‚ã‚ã‚‹ã¨æ€ã†ã®ã§ãƒ„ãƒƒã‚³ãƒŸæ“è¿Žã§ã™ï¼žï¼œ OAuthã£ã¦ãã‚‚ãã‚‚ãªã‚“ãªã®? ã‚‚ã®ã™ã”ãã–ã£ãã‚Šã¨ã„ã†ã¨ã€ŒAPIåˆ©ç”¨å´ãŒã€ãƒ¦ãƒ¼ã‚¶èªè¨¼ã‚’APIæä¾›ã‚µãƒ¼ãƒ“ã‚¹å´ã«ã‚„ã£ã¦ã‚‚ã‚‰ã†ãŸã‚ã®ä»•æ§˜ã€ã£ã¦æ„Ÿã˜ã§ã—ã‚‡ã†ã‹? BASICèªè¨¼ã®å ´åˆã€APIåˆ©ç”¨å´ãŒèªè¨¼ã«å¿…è¦ãªã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‚„ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’é ã‹ã‚‹å¿…è¦ãŒã‚ã‚‹ã‚ã‘ã§ã™ã€‚æ‚ªæ„ã®ã‚ã‚‹APIåˆ©ç”¨å´ãŒã€Œãªã‚“ã¨ã‹ãƒ¡ãƒ¼ã‚«ãƒ¼
ir9 2010/05/13
web

security

è³‡æ–™

ã¾ã¨ã‚
ãƒªãƒ³ã‚¯
WEBãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼å¿…è¦‹ï¼WEBè„†å¼±æ€§åŸºç¤ŽçŸ¥è˜æœ€é€Ÿãƒžã‚¹ã‚¿ãƒ¼ - ç‡ˆæ˜Žæ—¥è¨˜
ä»¥ä¸‹ã¯ã€WEBãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼ç”¨ã®WEBè„†å¼±æ€§ã®åŸºç¤ŽçŸ¥è˜ã®ä¸€è¦§ã§ã™ã€‚ WEBãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼ã®äººã¯ã“ã‚Œã‚’èªã‚ã°WEBè„†å¼±æ€§ã®åŸºç¤Žã‚’ãƒžã‚¹ã‚¿ãƒ¼ã—ã¦WEBãƒ—ãƒã‚°ãƒ©ãƒ ã‚’æ›¸ãã“ã¨ãŒã§ãã‚‹ã‚ˆã†ã«ãªã£ã¦ã„ã‚‹ã‹ã‚‚ã§ã™ã€‚ ã¾ãŸã€WEBè„†å¼±æ€§ã®ç°¡æ˜“ãƒªãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã¨ã—ã¦ã‚‚å°‘ã—åˆ©ç”¨ã§ãã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ WEBã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’é–‹ç™ºã™ã‚‹ã«ã¯ã€é–‹ç™ºè¦ä»¶æ›¸ã‚„ãƒ—ãƒã‚°ãƒ©ãƒ ä»•æ§˜æ›¸é€šã‚Šã«é–‹ç™ºã™ã‚Œã°è‰¯ã„ã¨ã„ã†ã‚ã‘ã«ã¯ã„ãã¾ã›ã‚“ã€‚ ãã†ã€WEBè„†å¼±æ€§ã‚’ç‹™ã†æ‚ªæ„ã®ãƒ¦ãƒ¼ã‚¶ã«ã‚‚å¯¾å‡¦ã—ãªã„ã¨ã„ã‘ãªã„ã®ã§ã™ã€‚ ä»Šå›žã€WEBã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’é–‹ç™ºã«ã‚ãŸã£ã¦ã®WEBè„†å¼±æ€§ã‚’ã€ä»¥ä¸‹ã®ä¸€è¦§ã«ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ ã“ã®ã¾ã¨ã‚ãŒWEBã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºã®å‚è€ƒã«ãªã‚Œã°å¹¸ã„ã§ã™ã€‚ ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒ»ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã‚„èªå¯åˆ¶å¾¡ã®æ¬ è½ ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒ»ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«(Directory Traversal) CSRFï¼ˆ
ir9 2010/05/12
security

ã¾ã¨ã‚

web
ãƒªãƒ³ã‚¯
OpenID & OAuth ä»•æ§˜æ›¸ã‚’æ—¥æœ¬èªžã«ç¿»è¨³ã—ã¾ã—ãŸ - äº¬ã®è·¯
æ˜¨å¹´æœ«ã«OpenIDãƒ•ã‚¡ã‚¦ãƒ³ãƒ‡ãƒ¼ã‚·ãƒ§ãƒ³ãƒ»ã‚¸ãƒ£ãƒ‘ãƒ³å‚åŠ ä¼æ¥ã®æœ‰å¿—æ•°åã§ç¿»è¨³ãƒ»æ•™è‚² Working Groupã¨ã„ã†ã®ã‚’ç«‹ã¡ä¸Šã’ã¦ã€ç¾åœ¨ã¯ä¸»ã«ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã®ç¿»è¨³ã‚’è¡Œã£ã¦ã„ã¾ã™ã€‚ ç¾åœ¨4æœ¬ã®ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã®æ—¥æœ¬èªžç‰ˆã‚’ç¿»è¨³ãƒ»æ•™è‚² Working Group ã®ã‚µã‚¤ãƒˆã§å…¬é–‹ã—ã¦ã„ã¾ã™ã€‚ï¼ˆã“ã®è¨˜äº‹ã®æœ«å°¾ã«ãƒªãƒ³ã‚¯ã‚ã‚Šï¼‰ ç¿»è¨³å¾Œã®ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆä»¥å¤–ã«ã€githubãƒ¬ãƒã‚¸ãƒˆãƒªã‚‚å…¬é–‹ã—ã¦ã„ã¾ã™ã€‚forkã‚‚pull requestã‚‚å¤§æ“è¿Žï¼åŽŸæ–‡ã¨ã®æ¯”è¼ƒãŒã—ã‚„ã™ã„ã‚ˆã†ã«ã€å„ç¿»è¨³ç‰ˆã®XMLãƒ•ã‚¡ã‚¤ãƒ«ã«ã¯ã‚³ãƒ¡ãƒ³ãƒˆã‚¢ã‚¦ãƒˆã®å½¢ã§åŽŸæ–‡ã‚‚æ®‹ã•ã‚Œã¦ã„ã¾ã™ã€‚ ç¿»è¨³ç‰ˆãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã¸ã®ã‚³ãƒ¡ãƒ³ãƒˆãƒ»è³ªå•ã¯ç¿»è¨³ãƒ»æ•™è‚² Working Group ã®ã‚µã‚¤ãƒˆã®ã‚³ãƒ¡ãƒ³ãƒˆæ¬„ã«ã©ã†ãžã€‚ OpenID Authentication 2.0 OpenID Attribute Exchange 1.0 OpenID Simple Registration Ex
ir9 2010/04/07
ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°

web

è³‡æ–™

security

network
ãƒªãƒ³ã‚¯
InfoQ: HTTPSã‚³ãƒã‚¯ã‚·ãƒ§ãƒ³ã®æœ€åˆã®æ•°ãƒŸãƒªç§’
ã»ã¨ã‚“ã©ã®äººãŒHTTPSã¨SSL (Secure Sockets Layer) ã‚’çµã³ã¤ã‘ã¦è€ƒãˆã¾ã™ã€‚SSLã¯1990å¹´ä»£åŠã°ã«Netscapeç¤¾ãŒé–‹ç™ºã—ãŸä»•çµ„ã¿ã§ã™ãŒã€ä»Šã§ã¯ã“ã®äº‹å®Ÿã¯ã‚ã¾ã‚Šæ£ç¢ºã§ãªã„ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚Netscapeç¤¾ãŒå¸‚å ´ã®ã‚·ã‚§ã‚¢ã‚’å¤±ã†ã«ã—ãŸãŒã£ã¦ã€SSLã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã¯ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆæŠ€è¡“ã‚¿ã‚¹ã‚¯ãƒ•ã‚©ãƒ¼ã‚¹(IETF)ã¸ç§»ç®¡ã•ã‚Œã¾ã—ãŸã€‚Netscapeç¤¾ã‹ã‚‰ç§»ç®¡ã•ã‚Œã¦ä»¥é™ã®åˆã‚ã¦ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã¯Transport Layer Security (TLS)1.0ã¨åä»˜ã‘ã‚‰ã‚Œã€1999å¹´1æœˆã«ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸã€‚TLSãŒä½¿ã‚ã‚Œã ã—ã¦10å¹´ã‚‚çµŒã£ã¦ã„ã‚‹ã®ã§ã€ç´”ç²‹ãª"SSL"ã®ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚’è¦‹ã‚‹ã“ã¨ã¯ã»ã¨ã‚“ã©ã‚ã‚Šã¾ã›ã‚“ã€‚ Client Hello TLSã¯ã™ã¹ã¦ã®ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚’ç•°ãªã‚‹ã‚¿ã‚¤ãƒ—ã®"ãƒ¬ã‚³ãƒ¼ãƒ‰"ã§åŒ…ã¿ã¾ã™ã€‚ãƒ–ãƒ©ã‚¦ã‚¶ãŒå‡ºã™å…ˆé ã®ãƒã‚¤ãƒˆå€¤ã¯16é€²æ•°è¡¨è¨˜ã§0x16 = 22ã€‚ ã“ã‚Œã¯
ir9 2010/03/01
network

web

security

èªã¿ç‰©
ãƒªãƒ³ã‚¯
1