[B! ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£] t32kã®ãƒ

t32k id:t32k

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã™ã‚‹t32kã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (11)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã‚‚ã†ã™ãæ¥ã‚‹? Web Authentication APIã«ã¤ã„ã¦èª¿ã¹ã¦ã¿ãŸ - Qiita
ãƒ”ã‚¯ã‚·ãƒ–æ ªå¼ä¼šç¤¾ Advent Calendar 2017 ã® 23 æ—¥ç›®æ‹…å½“ã® syoichi ã§ã™ã€‚ åŽ»å¹´ã® 2 æœˆã«ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã¨ã—ã¦å…¥ç¤¾ã—ã¾ã—ãŸã€‚åŽ»å¹´ã® Advent Calendar ã®æ™‚ã‹ã‚‰å¤‰ã‚ã‚‰ãšãƒ—ãƒ¬ãƒŸã‚¢ãƒ ãƒãƒ¼ãƒ ã«æ‰€å±žã—ã¦ãŠã‚Šã€ä¸»ã« PHP / JavaScript / CSS ã§é–‹ç™ºã—ã¦ã„ã¾ã™ã€‚ç›´è¿‘ã§ã¯ pixiv ã®æ±ºæ¸ˆåŸºç›¤ã®ã‚·ã‚¹ãƒ†ãƒ ã§ Scala ã«è§¦ã‚Œã‚‹æ©Ÿä¼šã‚‚ã‚ã‚Šã¾ã—ãŸã€‚ ã•ã¦ã€ä»Šå›žã¯ç¾åœ¨å„ãƒ–ãƒ©ã‚¦ã‚¶ãƒ¼ã§é–‹ç™ºä¸ã§ã€Edge ã§å…ˆè¡Œå®Ÿè£…ã•ã‚Œã€Firefox ã§ãƒªãƒªãƒ¼ã‚¹ã®ç›®å‡¦ãŒç«‹ã¡ã¤ã¤ã‚ã‚‹ã€Web Authentication API ã«ã¤ã„ã¦ç°¡å˜ã«èª¿ã¹ã¦ã¿ã¾ã—ãŸã€‚ ä½•ãŒã§ãã‚‹ã®ã‹ ç«¯çš„ã«è¨€ã†ã¨ã€FIDO 2.0 ã«åŸºã„ã¦ã€FIDO å¯¾å¿œãƒ‡ãƒã‚¤ã‚¹ã«ã‚ˆã£ã¦æŒ‡ç´‹ã‚„é¡”ãªã©ã‚’ç…§åˆã™ã‚‹ç”Ÿä½“èªè¨¼ãŒ Web ã‹ã‚‰åˆ©ç”¨ã§ãã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã™ã€‚ æ´»ç”¨ä¾‹ã¨ã—ã¦ã¯ã€ç”Ÿä½“èªè¨¼ã«ã‚ˆã£ã¦ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ç„¡ã—ã§ç´
t32k 2018/04/23
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã«ä¾å˜ã—ãªã„èªè¨¼ã€ŒWebAuthnã€ã‚’Chrome/Firefox/EdgeãŒå®Ÿè£…é–‹å§‹ã€W3CãŒæ¨™æº–åŒ–ã€‚Webã¯ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã«ä¾å˜ã—ãªã„ã‚ˆã‚Šå®‰å…¨ã§ä¾¿åˆ©ãªã‚‚ã®ã¸
Googleã€Mozillaã€ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆãŒã€ŒWebAuthnã€ã®å®Ÿè£…ã‚’é–‹å§‹ã€‚ã“ã‚Œã«ã‚ˆã£ã¦ã€ŒFIDO2ã€ã®æ™®åŠãŒæœŸå¾…ã•ã‚Œã€Webãƒ–ãƒ©ã‚¦ã‚¶ã‹ã‚‰æŒ‡ç´‹èªè¨¼ã‚„é¡”èªè¨¼ãªã©ã§ç°¡å˜ã«Webã‚µã‚¤ãƒˆã¸ã®ãƒã‚°ã‚¤ãƒ³ã‚„æ”¯æ‰•ã„ã®æ‰¿èªã¨ã„ã£ãŸæ“ä½œãŒå®Ÿç¾ã•ã‚Œãã†ã ã€‚ å¤šãã®Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã¯ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®èªè¨¼ã«ãƒ¦ãƒ¼ã‚¶ãƒ¼åã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®çµ„ã¿åˆã‚ã›ã‚’ç”¨ã„ã¦ã„ã¾ã™ã€‚ ã—ã‹ã—ãƒ¦ãƒ¼ã‚¶ãƒ¼åã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®çµ„åˆã‚ã›ã‚’ç”¨ã„ã‚‹æ–¹æ³•ã«ã¯ã•ã¾ã–ã¾ãªå•é¡ŒãŒæŒ‡æ‘˜ã•ã‚Œã¦ã„ã¾ã™ã€‚èº«è¿‘ãªã¨ã“ã‚ã§ã¯ã€å®‰å…¨ãªãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ç”Ÿæˆã™ã‚‹ã“ã¨ã®æ‰‹é–“ã‚„ã€å®‰å…¨æ€§ã‚’é«˜ã‚ã‚‹ãŸã‚ã«ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®ä½¿ã„å›žã—ã‚’é¿ã‘ã‚ˆã†ã¨ã—ãŸçµæžœç™ºç”Ÿã™ã‚‹å¤šæ•°ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ç®¡ç†ã™ã‚‹ã“ã¨ã®æ‰‹é–“ãªã©ãŒã‚ã’ã‚‰ã‚Œã¾ã™ã€‚ ãã—ã¦ã“ã†ã—ãŸãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®ä¸ä¾¿ã•ãŒçµæžœã¨ã—ã¦ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®ä½¿ã„å›žã—ã‚’å¼•ãèµ·ã“ã—ã€ã„ãšã‚Œã‹ã®ã‚µã‚¤ãƒˆã§ä¸‡ãŒä¸€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒæµå‡ºã—ãŸå ´åˆã«ã¯ãã‚Œã‚’åŸºã«ã—ãŸãƒªã‚¹ãƒˆåž‹æ”»æ’ƒãŒæœ‰åŠ¹ã«ãªã£ã¦ã—ã¾ã†ã€ãªã©ã®çŠ¶æ³
t32k 2018/04/18
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
HTML5 Security - OWASP Cheat Sheet Series
HTML5 Security Cheat SheetÂ¶ IntroductionÂ¶ The following cheat sheet serves as a guide for implementing HTML 5 in a secure fashion. Communication APIsÂ¶ Web MessagingÂ¶ Web Messaging (also known as Cross Domain Messaging) provides a means of messaging between documents from different origins in a way that is generally safer than the multiple hacks used in the past to accomplish this task. However, th
t32k 2018/02/20
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ãã‚ãã‚CSP Lv.2 nonceã‚„ã‚ã† - teppeis blog
tl;dr CSP Lv.2ã®nonceã‚’ä½¿ã†ã¨æ„å¤–ã¨ç°¡å˜ã«CSPã®æ©æµã‚’å—ã‘ã‚Œã‚‹ã‚ˆ Firefoxã¯unsafe-inlineã¨ã®æŒ™å‹•ãŒãŠã‹ã—ã„ã®ã§æ³¨æ„ ã‚µãƒ³ãƒ—ãƒ«å®Ÿè£…ã¨ã—ã¦Expressã§ç°¡å˜ã«nonceå¯¾å¿œã§ãã‚‹connectãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã‚’æ›¸ã„ãŸï¼ˆãƒ‡ãƒ¢ã‚ã‚Šï¼‰ Violation Reportã‚‚ãƒ–ãƒ©ã‚¦ã‚¶ã«ã‚ˆã£ã¦ç´°ã‹ã„æŒ™å‹•ã®å·®ç•°ãŒã‚ã‚‹ã‚ˆ CSP Lv.2 nonceã®ç™»å ´ã¨èƒŒæ™¯ CSPã®ç‰¹ã«unsafe-inlineã¯XSSã«å¯¾ã—ã¦æœ€çµ‚é˜²è¡›ç·šçš„ã«å¼·åŠ›ãªåŠ¹æžœãŒã‚ã‚‹ã€‚ ã—ã‹ã—ç‰¹ã«ã‚µãƒ¼ãƒãƒ¼ã‹ã‚‰ã®å€¤ã®å—ã‘æ¸¡ã—éƒ¨åˆ†ãªã©ã§ã©ã†ã—ã¦ã‚‚inline scriptã‚’ä½¿ã„ãŸããªã‚‹ã¨ã“ã‚ãŒã‚ã‚Šã€unsafe-inlineã‚’ç¦æ¢ã™ã‚‹ã¨DOM dataç‰ã‚’ä½¿ã‚ã–ã‚‹ã‚’å¾—ãšã€ã¤ã‚‰ã„æ„Ÿã˜ã ã£ãŸã€‚ @kazuho ã§ã™ãã€‚ã‹ã¨ã„ã£ã¦DOM dataã‹ãƒ¼ã€ã€ã¨ã„ã†æ„Ÿã˜ã§ã¯ã‚ã‚‹ã‚“ã§ã™ãŒã€CSPã§inline scriptç¦æ¢ã—ã¡
t32k 2018/01/15
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
CSP (Content Security Policy) nonce-sourceã«ã¤ã„ã¦èª¿ã¹ã¦ã¿ãŸ â€” A Day in Serenity (Reloaded) â€” PHP, CodeIgniter, FuelPHP, Linux or something
CSP nonce-sourceã¨ã¯ï¼Ÿ Content Security Policy (CSP) ã¯ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° (XSS) ã‚„ãƒ‡ãƒ¼ã‚¿ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³æ”»æ’ƒã‚’å«ã‚€ã€ã‚ˆãçŸ¥ã‚‰ã‚ŒãŸç¨®é¡žã®æ”»æ’ƒã‚’æ¤œå‡ºã—ã¦è»½æ¸›ã™ã‚‹ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®è¿½åŠ ãƒ¬ã‚¤ãƒ¤ãƒ¼ã§ã™ã€‚ã“ã‚Œã‚‰ã®æ”»æ’ƒæ‰‹æ³•ã¯ã€ãƒ‡ãƒ¼ã‚¿çªƒç›—ã‹ã‚‰ã‚µã‚¤ãƒˆæ”¹å¤‰ã€ãƒžãƒ«ã‚¦ã‚§ã‚¢æ„ŸæŸ“ã¾ã§ã€ã™ã¹ã¦ã«ä½¿ç”¨ã•ã‚Œã¾ã™ã€‚ https://developer.mozilla.org/ja/docs/Security/CSP ã‚ˆã‚Šã€‚ XSSã«é–¢ã—ã¦ç°¡å˜ã«è¨€ã†ã¨ã€å®Ÿè¡Œã§ãã‚‹JavaScriptã‚’åˆ¶é™ã—ã¦ã€å¤–éƒ¨ã‹ã‚‰ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒæ³¨å…¥ã•ã‚Œã¦ã‚‚ãƒ–ãƒ©ã‚¦ã‚¶ãŒå®Ÿè¡Œã—ãªã„ã“ã¨ã§XSSã‚’é˜²å¾¡ã™ã‚‹æ©Ÿèƒ½ã¨ã„ã†ã“ã¨ã«ãªã‚Šã¾ã™ã€‚ ä¾‹ãˆã°ã€è‡ªåˆ†ã®ã‚µãƒ¼ãƒä¸Šã®jsãƒ•ã‚¡ã‚¤ãƒ«ã‹ã‚‰ã®ã¿ã®scriptã‚’å®Ÿè¡Œã™ã‚‹ã‚ˆã†ã«æŒ‡å®šã™ã‚Œã°ã€å¤–éƒ¨ã‹ã‚‰ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’æŒ¿å…¥ã•ã‚Œã¦ã‚‚å®Ÿè¡Œã¯ã•ã‚Œãšå®‰å…¨ã«ãªã‚Šã¾ã™ã€‚ ã—ã‹ã—ã€ã‚¤ãƒ³ãƒ©ã‚¤ãƒ³ã®Ja
t32k 2018/01/15
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Content-Security-Policy ã¨ nonce ã®è©± - tokuhirom's blog
Content-Security-Policy ã¨ nonce ã®è©± Content-Security-Policy ã® nonce ã‚’åˆ©ç”¨ã™ã‚‹ã¨ã€XSS ã®è„…å¨ã‚’ã‹ãªã‚Šè»½æ¸›ã§ãã¾ã™ã€‚ ãã“ã§ã€Web Application Framework ã§ã¯ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§å¯¾å¿œã—ãŸã»ã†ãŒã‚ˆã„ã®ã§ã¯ãªã„ã‹ã€ã¨ã„ã†æ—¨ã‚’ @hasegawayosuke ã•ã‚“ã‹ã‚‰æ•™ãˆã¦é ‚ã„ãŸã®ã§ã€å®Ÿè£…ã«ã¤ã„ã¦è€ƒãˆã¦ã¿ã¾ã—ãŸã€‚ ã¨ã‚Šã‚ãˆãš CSP ã® nonce ã¯ã©ã†ã„ã†ã‚‚ã®ãªã®ã‹ã‚’è€ƒæ…®ã™ã‚‹ãŸã‚ã«ã€ã‚³ãƒ¼ãƒ‰ä¾‹ã‚’æŽ¢ã—ã¦ã„ãŸã®ã§ã™ãŒã€å®Ÿéš›ã«å‹•ãã‚µãƒ³ãƒ—ãƒ«ã¨ã„ã†ã‚‚ã®ãŒ nonce é–¢é€£ã®ã‚‚ã®ã§è¦‹å½“ãŸã‚Šã¾ã›ã‚“ã§ã—ãŸã€‚ ãã“ã§ã€å®Ÿéš›ã«å‹•ãã‚µãƒ³ãƒ—ãƒ«ã‚’ç”¨æ„ã—ã¾ã—ãŸã€‚ https://github.com/tokuhirom/csp-nonce-sample ä»¥ä¸‹ã¯ Sinatra ã§æ›¸ã‹ã‚ŒãŸã‚µãƒ³ãƒ—ãƒ«ã‚³ãƒ¼ãƒ‰ã§ã™ã€‚ require 'sinatr
t32k 2018/01/15
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
node ã® security checkã‚’ã™ã‚‹ãªã‚‰ nsp ãŒä¾¿åˆ© - from scratch
nspã¨ã¯ å…ˆæ—¥ãŸã¾ãŸã¾ä¼šç¤¾ã§ Vulnerability ã®è©±ã«ãªã£ã¦è‰²ã€…ã¨ Node.js ã ã¨ã“ã†ã„ã†ã®ã‚ã‚‹ã‚“ã§ã™ã‚ˆã£ã¦è¨€ã£ãŸã‚‰çŸ¥ã‚‰ãªã‹ã£ãŸæ–¹ã‚‚å¤šã‹ã£ãŸã®ã§ç´¹ä»‹ã€‚ nsp ã¯ node security platform ã®é æ–‡å—ã‚’å–ã£ãŸãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã§ã‚ã‚‹ã€‚ Node Security Platform ã¯ã‚µã‚¤ãƒˆä¸Šã§è„†å¼±æ€§ã‚’å…¬é–‹ã—ã¦ã„ã‚‹ã€‚ Node.js ã®ã‚³ã‚¢ã®è„†å¼±æ€§ã¨ã„ã†ã‚ˆã‚Šã‚‚ npm ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ãªã©ã®ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã®è„†å¼±æ€§ã ã€‚ nsp ã«æŒ™ã’ã‚‰ã‚Œã¦ã‚‹è„†å¼±æ€§ã®ä¸€ä¾‹ ä¾‹ãˆã°ã“ã®è„†å¼±æ€§ãªã‚“ã‹ã¯2017å¹´2æœˆ11æ—¥ã«å…¬é–‹ã•ã‚ŒãŸè„†å¼±æ€§ã§ã‚ã‚‹ã€‚ https://nodesecurity.io/advisories/313 github.com ã©ã†ã„ã†è„†å¼±æ€§ã‹ã¨ã„ã†ã¨ã€ã“ã®ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã¯JavaScript Objectã‚’ã‚·ãƒªã‚¢ãƒ©ã‚¤ã‚ºã™ã‚‹ãŸã‚ã®ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã ãŒã€ãã®serializeã™ã‚‹æ™‚ã«é–¢æ•°ã¾
t32k 2017/12/27
npm

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Helmet
t32k 2017/12/14
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Content security policy Â |Â Articles Â |Â web.dev
The web's security model is based on a same-origin policy. For example, code from https://mybank.com must have access to only https://mybank.com's data, and https://evil.example.com must never be allowed access. Each origin is, in theory, kept isolated from the rest of the web, giving developers a safe sandbox to build in. In practice, however, attackers have found several ways to subvert the syst
t32k 2017/12/14
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Introducing Content Security Policy - MDC Doc Center
HTTP ã‚¬ã‚¤ãƒ‰ HTTP ã®æ¦‚è¦ å…¸åž‹çš„ãª HTTP ã‚»ãƒƒã‚·ãƒ§ãƒ³ HTTP ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ MIME ã‚¿ã‚¤ãƒ—ï¼ˆIANA ãƒ¡ãƒ‡ã‚£ã‚¢ç¨®åˆ¥ï¼‰ HTTP ã®åœ§ç¸® HTTP ã‚ãƒ£ãƒƒã‚·ãƒ¥ HTTP èªè¨¼ HTTP Cookie ã®ä½¿ç”¨ HTTP ã®ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆ HTTP æ¡ä»¶ä»˜ããƒªã‚¯ã‚¨ã‚¹ãƒˆ HTTP ç¯„å›²ãƒªã‚¯ã‚¨ã‚¹ãƒˆ ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ãƒã‚´ã‚·ã‚¨ãƒ¼ã‚·ãƒ§ãƒ³ HTTP/1.x ã®ã‚³ãƒã‚¯ã‚·ãƒ§ãƒ³ç®¡ç† HTTP ã®é€²åŒ– ãƒ—ãƒãƒˆã‚³ãƒ«ã®ã‚¢ãƒƒãƒ—ã‚°ãƒ¬ãƒ¼ãƒ‰ã®ä»•çµ„ã¿ ãƒ—ãƒã‚ã‚·ã‚µãƒ¼ãƒãƒ¼ã¨ãƒˆãƒ³ãƒãƒªãƒ³ã‚° HTTP ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãƒ’ãƒ³ãƒˆ HTTP ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ã‚µã‚¤ãƒˆã®å®‰å…¨åŒ– HTTP Observatory Permissions Policy ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒãƒªã‚·ãƒ¼ (CSP) ã‚ªãƒªã‚¸ãƒ³é–“ãƒªã‚½ãƒ¼ã‚¹å…±æœ‰ (CORS) Cross-Origin Resource Policy (CORP) Strict-Transport-Securit
t32k 2017/12/14
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Content-Security-Policy (CSP) Header Quick Reference
Content Security Policy Reference The new Content-Security-Policy HTTP response header helps you reduce XSS risks on modern browsers by declaring which dynamic resources are allowed to load. What is Content-Security-Policy? Content-Security-Policy is the name of a HTTP response header that modern browsers use to enhance the security of the document (or web page). The Content-Security-Policy header
t32k 2017/12/14
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
1