[B! CSRF] HeavyFeatherã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

HeavyFeather id:HeavyFeather

CSRFã«é–¢ã™ã‚‹HeavyFeatherã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (8)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
HeavyFeather 2011/05/03
security

cookie

iphone

https

csrf
ãƒªãƒ³ã‚¯
CakePHP ã® PHP ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã®è„†å¼±æ€§ã‚’ä½¿ã£ã¦ CakePHP ã‚’ç„¦ãŒã™ - co3k.org
2010/11/13 ã«å‡ºãŸã‚‰ã—ã„ http://bakery.cakephp.org/articles/markstory/2010/11/13/cakephp_1_3_6_and_1_2_9_released ã‚’èªã‚“ã§ã³ã£ãã‚Šã—ãŸã‚“ã§ã™ãŒã€ Twitter ã‚’è»½ãæ¤œç´¢ã—ãŸé™ã‚Šã ã¨ CakePHP ãƒ¦ãƒ¼ã‚¶ã§ãªã„åƒ•ãŒæ°—ã¥ã„ã¦ã„ã‚‹ã®ã« (æ—¥æœ¬ã®) CakePHP ãƒ¦ãƒ¼ã‚¶ã•ã‚“ãŸã¡ãŒã©ã†ã‚‚æ°—ã¥ã„ã¦ã„ãªã„ã£ã½ã„ã®ã§ã‚ã‹ã‚Šã‚„ã™ãã¾ã¨ã‚ã¦ã¿ã‚‹ã“ã¨ã«ã—ã¾ã—ãŸï¼ã€€CakePHP ã«ã¯ä»»æ„ã® PHP ã‚³ãƒ¼ãƒ‰ãŒå®Ÿè¡Œã§ãã‚‹è‡´å‘½çš„ãªè„†å¼±æ€§ãŒã‚ã‚Šã¾ã™ï¼ã€€å½±éŸ¿ã®ã‚ã‚‹ã‚µã‚¤ãƒˆçµæ§‹ã‚ã‚Šãã†ã§ã™ãŒæ‚ªç”¨åŽ³ç¦ã§ã™ï¼ â€»é€šå¸¸ãƒªãƒªãƒ¼ã‚¹ã®å‘ŠçŸ¥ã®ãªã‹ã«ã“ã‚“ãªè‡´å‘½çš„ãªè„†å¼±æ€§ã«é–¢ã™ã‚‹æƒ…å ±ã‚’æ€ã„ã£ãã‚Šã‚ã‹ã‚Šã«ããæ›¸ã„ã¡ã‚ƒã†ã®ã¯ã²ã©ã„ãªã‚ã¨æ€ã†ã®ã§ã€ãƒ¦ãƒ¼ã‚¶ã®æ–¹ã¯ CakePHP ã«æ–‡å¥ã‚’è¨€ã†ã¨ã„ã„ã¨æ€ã„ã¾ã™ã€‚åƒ•ã¯ CakePHP ãƒ¦ãƒ¼ã‚¶ã˜ã‚ƒãªã„
HeavyFeather 2010/11/25
php

cakephp

security

CSRF
ãƒªãƒ³ã‚¯
Site Under Maintenance
We'll be back soon! Our site is currently undergoing maintenance. Please check back later.
HeavyFeather 2010/09/05
csrf

web

coupon

trouble
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
HeavyFeather 2009/12/25
Security

web

csrf
ãƒªãƒ³ã‚¯
CSRFå¯¾ç–ã¯åŸºæœ¬? | æ°´ç„¡æœˆã°ã‘ã‚‰ã®ãˆã³æ—¥è¨˜
ã‚³ãƒŸãƒ¥ãƒ‹ãƒ†ã‚£ãƒ¼ã‚µã‚¤ãƒˆæ§‹ç¯‰ã«è©³ã—ã„å°‚é–€å®¶ã¯ã€ã€ŒCSRFå¯¾ç–ã¯åŸºæœ¬çš„ãªã¨ã“ã‚ã€‚Amebaãªã†ãŒå¯¾ç–ã—ã¦ã„ãªã‹ã£ãŸã®ã¯æ„å¤–ã ã€ã¨è©±ã—ã¦ã„ã‚‹ã€‚ ã€ŒCSRFå¯¾ç–ã¯åŸºæœ¬çš„ãªã¨ã“ã‚ã€ã¨è¨€ã‚ã‚Œã‚‹ã¨ã€ç™ºè¦‹ã‚‚å¯¾å‡¦ã‚‚å®¹æ˜“ã§ã‚ã‚‹ã‚ˆã†ãªå°è±¡ã‚’å—ã‘ã¾ã™ãŒã€ã“ã‚Œã¯å°‘ã—é•å’Œæ„ŸãŒã‚ã‚Šã¾ã™ãã€‚ åŠå¹´ã»ã©å‰ã®è©±ã§ã™ãŒã€å¼Šç¤¾ (www.b-architects.com)ã®ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãŒæ–°è¦ã®ECã‚µã‚¤ãƒˆã‚’ç«‹ã¡ä¸Šã’ã‚‹ã«ã‚ãŸã£ã¦è„†å¼±æ€§è¨ºæ–ã‚’ã—ã‚ˆã†ã¨ã„ã†è©±ã«ãªã‚Šã€å¤–éƒ¨ã®ä¼šç¤¾ã«è¦‹ç©ã‚‚ã‚Šä¾é ¼ã‚’ã—ãŸã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚ãã®éš›ã€æ¥ç•Œã§ã¯çŸ¥ã‚‰ãªã„äººãŒã„ãªã„ã‚ˆã†ãªå¤§æ‰‹ä¼šç¤¾ã®è¨ºæ–ãƒ¡ãƒ‹ãƒ¥ãƒ¼ã‚‚è¦‹ã›ã¦ã„ãŸã ãã¾ã—ãŸã€‚ ãã“ã§å°è±¡çš„ã ã£ãŸã®ã¯ã€æ¨™æº–ã¨ã•ã‚Œã‚‹ãƒ—ãƒ©ãƒ³ã«CSRFã®è¨ºæ–ãŒå«ã¾ã‚Œã¦ã„ãªã‹ã£ãŸã“ã¨ã§ã™ã€‚æ¨™æº–ã®ã‚³ãƒ¼ã‚¹ã«ã¯XSSã‚„SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã®è¨ºæ–ãŒå«ã¾ã‚Œã¾ã™ãŒã€CSRFã¯ã€Œã‚¢ãƒ‰ãƒãƒ³ã‚¹ãƒ‰ã€ãƒ—ãƒ©ãƒ³ã®æ–¹ã«ã—ã‹å«ã¾ã‚Œã¦ã„ã¾ã›ã‚“ã§ã—ãŸã€‚æ™®é€šã®ã‚µã‚¤ãƒˆã§ã¯XSSã‚„
HeavyFeather 2009/12/25
Security

csrf

web

xss

SQL
ãƒªãƒ³ã‚¯
URLè¸ã‚€ã¨ã€Œã“ã‚“ã«ã¡ã¯ã€€ã“ã‚“ã«ã¡ã¯!!ã€ã€€Amebaãªã†ã®CSRFè„†å¼±æ€§ã§â€œæ„å›³ã—ãªã„æŠ•ç¨¿â€åºƒãŒã‚‹
12æœˆ10æ—¥ã«PCç‰ˆãŒã‚¹ã‚¿ãƒ¼ãƒˆã—ãŸã‚µã‚¤ãƒãƒ¼ã‚¨ãƒ¼ã‚¸ã‚§ãƒ³ãƒˆã®ãƒŸãƒ‹ãƒ–ãƒã‚°ã‚µãƒ¼ãƒ“ã‚¹ã€ŒAmebaãªã†ã€ã§ã€ã‚ã‚‹URLã‚’ã‚¯ãƒªãƒƒã‚¯ã™ã‚‹ã¨ã€ã€Œã“ã‚“ã«ã¡ã¯ã€€ã“ã‚“ã«ã¡ã¯!!ã€ã¨ã„ã†ãƒ•ãƒ¬ãƒ¼ã‚ºã¨ã‚¯ãƒªãƒƒã‚¯ã—ãŸURLæ–‡å—åˆ—ãŒè‡ªå‹•ã§æŠ•ç¨¿ã•ã‚Œã€ã€Œã¯ã¾ã¡ã‚„2ã€ã•ã‚“ã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‚’è‡ªå‹•ã§ãƒ•ã‚©ãƒãƒ¼ã—ã¦ã—ã¾ã†ã¨ã„ã†ç¾è±¡ãŒåºƒãŒã£ãŸã€‚ URLã‚’ã‚¯ãƒªãƒƒã‚¯ã—ãŸãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒæ„å›³ã—ãªã„æ©Ÿèƒ½ã‚’å®Ÿè¡Œã•ã›ã‚‰ã‚Œã‚‹Webã‚¢ãƒ—ãƒªã®è„†å¼±æ€§ã®ä¸€ç¨®ãƒ»ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒªï¼ˆCSRFï¼‰ã‚’çªã„ãŸã‚‚ã®ã€‚åŒç¤¾ã¯10æ—¥å¤œã€URLã‚’ã‚¯ãƒªãƒƒã‚¯ã—ãªã„ã‚ˆã†ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«å‘ŠçŸ¥ã€‚èª¤ã£ã¦ã‚¯ãƒªãƒƒã‚¯ã—ãŸå ´åˆã¯æŠ•ç¨¿ã‚’å‰Šé™¤ã—ã€ã¯ã¾ã¡ã‚„2ã•ã‚“ã®ãƒ•ã‚©ãƒãƒ¼ã‚’å¤–ã™ã‚ˆã†å‘¼ã³æŽ›ã‘ãŸã€‚11æ—¥æœã¾ã§ã«è„†å¼±æ€§ã‚‚ä¿®æ£ã—ãŸã¨ã„ã†ã€‚ mixiã§ã‚‚2005å¹´ã€ã‚ã‚‹URLã‚’ã‚¯ãƒªãƒƒã‚¯ã™ã‚‹ã¨ã€Œã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼ã€ã¨ã„ã†æ—¥è¨˜ãŒå‹æ‰‹ã«æŠ•ç¨¿ã•ã‚Œã‚‹ã¨ã„ã†ã€CSRFã‚’åˆ©ç”¨ã—ãŸã‚¹ãƒ‘ãƒ ãŒæµé€šã—ãŸã“ã¨ãŒã‚ã£ãŸã€‚ã‚³ãƒŸãƒ¥ãƒ‹ãƒ†ã‚£ãƒ¼ã‚µã‚¤ãƒˆæ§‹
HeavyFeather 2009/12/16
ameba

security

csrf

web
ãƒªãƒ³ã‚¯
å€‹äººã ã‹ã‚‰ç”˜ã„ã®ã‹ãª - ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼
ã‚ã‚‰ã‚ã‚‰äºˆå‘ŠinãŒXSSã‚„ã‚‰ã‚Œã¡ã‚ƒã£ãŸã‚‰ã—ã„ã§ã™ãï¼ ä½¿ã„å¤ã•ã‚ŒãŸæ‰‹æ³•ï¼Ÿ ã„ã¾ã©ãã‚¨ã‚¹ã‚±ãƒ¼ãƒ—å‡¦ç†ã™ã‚‰ã—ã¦ãªãã¦ãƒ€ã‚µã„ï¼Ÿ é–¢é€£ã®è¨˜äº‹ã«å¯¾ã—ã¦ã€ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ã§ã‚‚è‰²ã€…è¨€ã‚ã‚Œã¦ã„ãŸã‚Šã€ http://b.hatena.ne.jp/t/%E4%BA%88%E5%91%8A.in?threshold=1 ãƒ‹ãƒ¥ãƒ¼ã‚¹ã‚µã‚¤ãƒˆã§ã‚‚ã€ã“ã‚“ãªç…½ã‚Šè¨˜äº‹ã‚’æ›¸ã‹ã‚Œã¦ã„ãŸã‚Šã™ã‚‹ã‘ã‚Œã©â€¦ ä»Šå›žã®ä»¶ã«ã¤ã„ã¦ITä¼æ¥ã«å‹¤ã‚ã‚‹ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã«èžã„ã¦ã¿ã‚‹ã¨ã€ ã€Œã“ã‚Œã¯åˆæ©ä¸ã®åˆæ©ã€‚XSSã‚³ãƒ¼ãƒ‰æ›¸ã„ãŸæ–¹ã‚‚10åˆ†ã‚‚æŽ›ã‹ã£ã¦ãªã„ã‚ˆã€‚ãã‚Œã‚’äº‹å‰ã«å¯¾ç–ã—ã¦ãªã‹ã£ãŸäºˆå‘Šinã«ã¯ã‚‚ã£ã¨ãƒ“ãƒƒã‚¯ãƒªã ã‘ã©ã€ã€ã€ç´ äººãªã®ï¼Ÿã€ ã¨èªžã‚‹ã€‚ äºˆå‘Šinã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è„†å¼±æ€§ã‚’ç‹™ã£ãŸã‚³ãƒ¼ãƒ‰!?ã€€ã€Œäºˆå‘Šiné–‹ç™ºè€…ã¯ç´ äººã€ http://news.livedoor.com/article/detail/3759632/ ãã‚Œã£ã¦ã©ã†ã ã‚ã†ãã€‚ Googleã‚„Amazo
HeavyFeather 2008/08/06
csrf

internet

programming

security

web

xss
ãƒªãƒ³ã‚¯
ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°(XSS)ã¨CSRFã®é•ã„æ—©åˆ†ã‹ã‚Š - ockeghem(å¾³ä¸¸æµ©)ã®æ—¥è¨˜
æ˜¨æ—¥ã®æ—¥è¨˜ã§ã€DKç¥ã‚Šã§ä½¿ã‚ã‚Œã¦ã„ã‚‹è„†å¼±æ€§ãŒXSSã‹CSRFã‹ã¨ã„ã†å•é¡Œã«ãªã£ãŸã€‚ã©ã†ã‚‚ã€XSSã¨CSRFãŒã”ã£ã¡ã‚ƒã«ãªã£ã¦ã„ã‚‹äººã‚‚ã„ã‚‹ã‚ˆã†ã«è¦‹å—ã‘ã‚‹ã®ã§ã€ç°¡å˜ãªæ•´ç†ã‚’è©¦ã¿ãŸã„ã€‚ XSSã¨CSRFã«ã¯ä¼¼ãŸç‚¹ãŒã‚ã‚‹ã€‚ ã©ã¡ã‚‰ã‚‚ã€Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã€ã¨ã„ã†è¨€è‘‰ãŒå…ˆé ã«ã¤ã ãªã‚Šã™ã¾ã—ã®ã‚ˆã†ãªã“ã¨ãŒçµæžœã¨ã—ã¦ã§ãã‚‹ ã©ã¡ã‚‰ã‚‚å—å‹•åž‹æ”»æ’ƒã§ã‚ã‚‹ ãã‚Œã«å¯¾ã—ã¦ã€ã‚‚ã¡ã‚ã‚“é•ã†ç‚¹ã‚‚ã‚ã‚‹ã€‚å°‚é–€å®¶ã‹ã‚‰è¦‹ã‚Œã°ã€Œä¼¼ã¦ã‚‹ã‚‚ä½•ã‚‚ã€ãã‚‚ãã‚‚å…¨ç„¶é•ã†ã‚‚ã®ã§ã™ã‚ˆã€ã¨ãªã‚‹ã®ã ã‚ã†ãŒã€ç¾ã«æ··åŒã—ã¦ã„ã‚‹äººãŒã„ã‚‹ã®ã ã‹ã‚‰ç´›ã‚‰ã‚ã—ã„ç‚¹ã‚‚ã‚ã‚‹ã®ã ã‚ã†ã€‚ ç§æ€ã†ã«ã€XSSã¨CSRFã®æ±ºå®šçš„ãªé•ã„ã¯ã€ä»¥ä¸‹ã®ç‚¹ã§ã¯ãªã„ã ã‚ã†ã‹ã€‚ XSSã¯æ”»æ’ƒã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§å‹•ããŒã€CSRFã¯ã‚µãƒ¼ãƒãƒ¼ä¸Šã§å‹•ã ã“ã®ãŸã‚ã€XSSã§ã§ãã‚‹æ‚ªã„ã“ã¨ã¯ã€ã™ãªã‚ã¡JavaScriptã§ã§ãã‚‹ã“ã¨ã§ã‚ã£ã¦ã€æ”»æ’ƒå¯¾è±¡ã®Cookieã‚’ç›—ã¿å‡ºã™ã“ã¨ãŒå…¸åž‹ä¾‹ã¨ãªã‚‹ã€‚ä¸€æ–¹ã€CS
HeavyFeather 2007/12/04
security

csrf

xss

web
ãƒªãƒ³ã‚¯
1