CSRF is (really) dead
Scott Helme Security researcher, entrepreneur and international speaker who specialises in web technologies. More posts by Scott Helme. A little while back I wrote a blog post about how "CSRF is dead". It focused on SameSite cookies, a powerful yet simple feature to protect your website against CSRF attacks. As powerful as it was, and as much as it will kill CSRF, you had to enable it on your site
Python2ã¨Python3ã§HTTP POST+Cookie処ç†ã®æ¯”較 - yattã®ãƒ–ãƒã‚°
Webを支ãˆã‚‹æŠ€è¡“ -HTTPã€URIã€HTMLã€ãã—ã¦REST (WEB+DB PRESS plus) 作者: 山本陽平出版社/メーカー: 技術評論社発売日: 2010/04/08メディア: å˜è¡Œæœ¬ï¼ˆã‚½ãƒ•ãƒˆã‚«ãƒãƒ¼ï¼‰è³¼å…¥: 143人 クリック: 4,320回ã“ã®å•†å“ã‚’å«ã‚€ãƒ–ãƒã‚° (183件) を見る Python2ç³»ã§urllibã¨urllib2ã«åˆ†ã‹ã‚Œã¦ã„ãŸHTTP関係ã®ã‚³ãƒ¼ãƒ‰ã¯ã€Python3ã§urllibモジュールã«çµ±åˆã•ã‚Œã¾ã—ãŸã€‚ Pthon3ã§HTTP POSTã‚’ã™ã‚‹å ´åˆã«urllibã‚’ã©ã†ä½¿ãˆã°ã„ã„ã®ã‹ã«ã¤ã„ã¦ã€ã¯ã¦ãªã«ãƒã‚°ã‚¤ãƒ³ã™ã‚‹ã‚¹ã‚¯ãƒªãƒ—トを例ã«ã—ã¦æ¯”較ã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚GETã¯ç°¡å˜ãªã‚“ã§ãƒ‘ス。 全体的ãªæµã‚Œã¨ã—㦠データをURLエンコードã—ã¦é€ä¿¡ cookieã¯CookieProcesssorã§CookieJarã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã‚’å‡¦ç† æŽ¥ç¶šã™ã‚‹ã¨ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚ªãƒ–ジェクトãŒè¿”ã‚‹ã®ã§
サードパーティCookieã®æ´å²ã¨ç¾çŠ¶ Part1 å‰æ知è˜ã®å…±æœ‰ - 最速転è·ç ”究会
Web開発者ã®ãŸã‚ã®ã‚µãƒ¼ãƒ‰ãƒ‘ーティCookieやらトラッã‚ングやらã®å•é¡Œç‚¹ã«ã¤ã„ã¦ä¸‰å›žãらã„ã«åˆ†ã‘ã¦æ›¸ãã¾ã™ã€‚ ã“ã®æ–‡ç« ã¯å€‹äººçš„ã«æ›¸ã„ã¦ã„ã¾ã™ã®ã§ã€ãŠã„ã€ãŠå‰ã®ã¨ã“ã‚ã®ã‚µãƒ¼ãƒ“スãŒã‚µãƒ¼ãƒ‰ãƒ‘ーティCookieã«ä¾å˜ã—ã¦ã‚‹ã˜ã‚ƒãーã‹ã¨ã„ã†ãƒ„ッコミãŒã‚ã‚‹ã‹ã‚‚ã—ã‚Œãªã„ãŒã€ãã†ã„ã†ã“ã¨ã‚’æ°—ã«ã—ã¦ã„ã‚‹ã¨ã„ã¤ã¾ã§çµŒã£ã¦ã‚‚公開ã§ããªã„ã¨ã„ã†å•é¡ŒãŒå‡ºã¦ã—ã¾ã†ã®ã§ã€ãã‚“ãªã“ã¨ã¯ãŠæ§‹ã„ãªã—ã«æ›¸ã。ã¡ãªã¿ã«ä¾‹å¤–ãªã自社サービスã«å¯¾ã—ã¦ã‚‚サードパーティCookieã«ä¾å˜ã™ã‚‹ãªæ»ãã¨è¨€ã£ã¦ã„る。ã“ã‚Œã¯Webプãƒã‚°ãƒ©ãƒžãƒ¼è¦³ç‚¹ã§ã€è‡ªåˆ†ãŒã‚µãƒ¼ãƒ“ス開発ã«é–¢ã‚る上ã§çŸ¥ã£ã¦ãŠã‹ãã°ãªã‚‰ãªã„ã ã‚ã†çŸ¥è˜ã¨ã—ã¦åæ•°å¹´é–“ã らã らã¨Webを見ã¦ã„ã¦è‡ªç„¶ã«çŸ¥ã£ã¦ã„ãŸã‚‚ã®ã¨ã€ã‚ã‚‹ã„ã¯èˆˆå‘³ã‚’æŒã£ã¦çŽ‡å…ˆã—ã¦èª¿ã¹ãŸã‚‚ã®ãŒå«ã¾ã‚Œã¦ã„る。ググッã¦ç›´ãã«åˆ†ã‹ã‚‹ç¨‹åº¦ã®ç”¨èªžã®å®šç¾©çš„ãªã“ã¨ã¯æ›¸ã‹ãªã„。ã‚ãã¾ã§Webサイト制作者å´ã‹ã‚‰ã®è¦³ç‚¹ãªã®ã§ã€ãƒ–ラウザ開発関係
What Are Refresh Tokens and How to Use Them Securely
This post will explore the concept of refresh tokens as defined by OAuth 2.0. We will learn how they compare to other token types and how they let us balance security, usability, and privacy. You can follow the text in this post, or if you prefer learning from presentations, you can watch this article’s companion video: What Is A Token?Tokens are pieces of data that carry just enough information t
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
Play Frameworkã§Secure Cookie対応ã™ã‚‹ã¾ã§ã®é“ã®ã‚Š
{{#tags}}- {{label}}
{{/tags}}