[B! csrf] Jxckã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

Jxck id:Jxck

csrfã«é–¢ã™ã‚‹Jxckã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

CSRFãƒˆãƒ¼ã‚¯ãƒ³ ã‚¤ãƒ³ã‚¿ãƒ“ãƒ¥ãƒ¼ã‚º - Qiita
VAddyã¨CSRFãƒˆãƒ¼ã‚¯ãƒ³ VAddyã¯è„†å¼±æ€§è¨ºæ–ã‚’å®Ÿè¡Œã™ã‚‹éš›ã«ã€CSRFãƒˆãƒ¼ã‚¯ãƒ³ã‚’æœ€æ–°ã®ã‚‚ã®ã«æ›´æ–°ã—ãªãŒã‚‰å‹•ä½œã—ã¾ã™ã€‚ãã®ãŸã‚ã€Œã©ã®ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ãŒCSRFãƒˆãƒ¼ã‚¯ãƒ³ã‹ï¼Ÿã€ã‚’åˆ¤æ–ã™ã‚‹ãƒã‚¸ãƒƒã‚¯ãŒå˜åœ¨ã—ã¦ã„ã¾ã™ã€‚æœ€è¿‘ã‚ã‚‹ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ï¼ˆå¾Œè¿°ï¼‰ã«ã¤ã„ã¦ã€ŒCSRFãƒˆãƒ¼ã‚¯ãƒ³ã‚’æ£ã—ãèªè˜ã§ããªã„ã€ã¨ã„ã†ãƒã‚°ã‚’ä¿®æ£ã—ãŸã®ã§ã™ãŒã€è‰¯ã„æ©Ÿä¼šãªã®ã§ãƒ¡ã‚¸ãƒ£ãƒ¼ãªãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã‚„CMSã‚’ä¸å¿ƒã«CSRFãƒˆãƒ¼ã‚¯ãƒ³ã®å®Ÿè£…ã‚’ã–ã£ã¨è¿½ã£ã¦ã¿ã¾ã—ãŸã€‚ä¸€è¦§ã«ã—ã¦ã‚‚é¢ç™½ããªã„ã®ã§ã€ä»®æƒ³ã‚¤ãƒ³ã‚¿ãƒ“ãƒ¥ãƒ¼å½¢å¼ã«ã¾ã¨ã‚ã¦ã‚ã‚Šã¾ã™ã€‚GitHubä¸Šã§è»½ãè¿½ã£ãŸã‚‚ã®ãŒå¤šã„ã®ã§ã€æœ€æ–°ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ãªã‹ã£ãŸã‚Šã€è§£é‡ˆãŒé–“é•ã£ã¦ã„ã‚‹ç®‡æ‰€ãŒã‚ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ ãã‚Œã§ã¯ã€ã©ã†ãžã€‚ Ruby on Rails é‡‘åºŠ(ä»¥ä¸‹ã€é‡‘)ã€Œã“ã‚“ã«ã¡ã¯ã€‚ã‚ˆã†ã“ãã€‚ã€ RoRã€Œã“ã‚“ã«ã¡ã¯ã€ é‡‘ã€Œç›¸å¤‰ã‚ã‚‰ãšã‚·ã‚§ã‚¢é«˜ã„ã‚ˆã†ã§ã™ãã€‚ã€ RoRã€Œã¯ã„ã€ãŠã‹ã’ã•ã¾ã§ã€‚ã“ã®é–“ã¯ãƒ«ãƒžãƒ³24
Jxck 2016/12/22
ã‚ã¨ã§èªã‚€

rails

csrf
ãƒªãƒ³ã‚¯
æ›¸ç±ã€ŽWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–å…¥é–€ã€ã®CSRFè„†å¼±æ€§ | å¾³ä¸¸æµ©ã®æ—¥è¨˜
å›³ã®ã‚ˆã†ã«ã€å¤§åž£æœ¬ã®CSRFå¯¾ç–æ–¹å¼ï¼ˆä»¥ä¸‹ã€ã€Œå¤§åž£æ–¹å¼ã€ã¨è¡¨è¨˜ï¼‰ã§ã¯ã€ãƒˆãƒ¼ã‚¯ãƒ³ï¼ˆåŒæ›¸ã§ã¯ãƒ•ã‚©ãƒ¼ãƒ IDã¨è¡¨è¨˜ï¼‰ã‚’ãƒ©ãƒ³ãƒ€ãƒ ãªéµã¨ã—ã¦ç”Ÿæˆï¼ˆâ‘¡ï¼‰ã—ã€ãã‚Œã‚’ãƒ•ã‚©ãƒ¼ãƒ ã®éš ã—ãƒ•ã‚£ãƒ¼ãƒ«ãƒ‰ã¨DBã«ä¿å˜ã—ã¾ã™ï¼ˆâ‘¢ã€â‘£ï¼‰ã€‚ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒãƒ•ã‚©ãƒ¼ãƒ ã‚’ã‚µãƒ–ãƒŸãƒƒãƒˆï¼ˆâ‘¤ï¼‰ã™ã‚‹ã¨ã€é€ä¿¡ã•ã‚Œã¦ããŸãƒˆãƒ¼ã‚¯ãƒ³ãŒDBä¸Šã«å˜åœ¨ã™ã‚‹ã‹ç¢ºèªï¼ˆâ‘¥ï¼‰ã—ã€ã‚ã‚Œã°ãƒˆãƒ¼ã‚¯ãƒ³ã‚’å‰Šé™¤ï¼ˆâ‘¦ï¼‰ã—ã¦ã€ã‚µãƒ¼ãƒãƒ¼ä¸Šã®å‡¦ç†ã«é€²ã¿ã¾ã™ã€‚â‘¥ã§ãƒˆãƒ¼ã‚¯ãƒ³ãŒDBã«ãªã„å ´åˆã¯ã€ã‚¨ãƒ©ãƒ¼ã¨ã—ã¦å‡¦ç†ã«ã¯é€²ã¿ã¾ã›ã‚“ã€‚ ä¸€èˆ¬çš„ãªCSRFå¯¾ç–æ‰‹æ³•ã¨ã®é•ã„ å¤§åž£æ–¹å¼ãŒä¸€èˆ¬çš„ãªCSRFå¯¾ç–ã¨ç•°ãªã‚‹ç‚¹ã¯ä»¥ä¸‹ã®2ç‚¹ã§ã™ã€‚ ãƒ•ã‚©ãƒ¼ãƒ ã®2é‡æŠ•ç¨¿é˜²æ¢æ©Ÿèƒ½ã‚’å…¼ãã¦ã„ã‚‹ ãƒˆãƒ¼ã‚¯ãƒ³ãŒã‚»ãƒƒã‚·ãƒ§ãƒ³å¤‰æ•°ã§ã¯ãªãDBã«ä¿å˜ã•ã‚Œã‚‹ ãƒˆãƒ¼ã‚¯ãƒ³ã®æœ‰åŠ¹ç¯„å›²ã¯? ãƒˆãƒ¼ã‚¯ãƒ³ãŒDBã«ä¿å˜ã•ã‚Œã‚‹å ´åˆã€ãƒˆãƒ¼ã‚¯ãƒ³ã®æœ‰åŠ¹ç¯„å›²ãŒæ°—ã«ãªã‚‹ã¨ã“ã‚ã§ã™ã€‚å¤§åž£æœ¬ãŠã‚ˆã³ç¬¬äºŒç‰ˆã®ã‚½ãƒ¼ã‚¹ã‚’è¦‹ã‚‹ã¨ã€ãƒˆãƒ¼ã‚¯ãƒ³ã‚’ä¿å˜ã™ã‚‹ãƒ†ãƒ¼ãƒ–ãƒ«ã®å®šç¾©ã¯ä»¥ä¸‹ã®é€šã‚Šã§ã™ã€‚ CR
Jxck 2015/06/30
csrf
ãƒªãƒ³ã‚¯
ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒª(CSRF)ã¨ãã®å¯¾ç–
æœ¬è³‡æ–™ã¯ã€web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ãŠã‘ã‚‹è„†å¼±æ€§ã®ã²ã¨ã¤ã€CSRF (ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒª) ã®ä»•çµ„ã¿ã¨ãã®å¯¾ç–ã«é–¢ã™ã‚‹èª¬æ˜Žè³‡æ–™ã§ã™ã€‚ ã¾ãŸã€CSRF å¯¾ç–ã®ãŸã‚ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®ã„ãã¤ã‹ã«ã¤ã„ã¦ã€ãã®æ¦‚è¦ã¨é©ç”¨ä¾‹ã‚‚ç´¹ä»‹ã—ã¦ã„ã¾ã™ã€‚ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä½œæˆã™ã‚‹é–‹ç™ºè€…ã®æ–¹ã€…ãŒã€CSRF è„†å¼±æ€§ã«å¯¾ã™ã‚‹ç†è§£ã‚’æ·±ã‚ã€ã‚ˆã‚Šã‚»ã‚ãƒ¥ã‚¢ãªWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®é–‹ç™ºã®ä¸€åŠ©ã¨ãªã‚Œã°å¹¸ã„ã§ã™ã€‚ è‡ªç¿’ç”¨ã®è³‡æ–™ã‚„å‹‰å¼·ä¼šã§ã®è³‡æ–™ã¨ã—ã¦ã”æ´»ç”¨ãã ã•ã„ã€‚ - æ”¹è¨‚ç‰ˆ+1: å›³ç‰ˆã‚„èª¤è¨˜ã®ä¿®æ£ (2015å¹´10æœˆ20æ—¥) â€» ã‚³ãƒ¡ãƒ³ãƒˆãã ã•ã£ãŸçš†æ§˜ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™! - æ”¹è¨‚ç‰ˆ: JPCERT/CC Web ã‚µã‚¤ãƒˆã«ã¦å…¬é–‹ (2015å¹´10æœˆ6æ—¥) - åˆç‰ˆ: OSC2015Hokkaido è¬›æ¼”è³‡æ–™ (2015å¹´6æœˆ13æ—¥) Read less
Jxck 2015/06/15
csrf
ãƒªãƒ³ã‚¯
AngularJSã¨Railsã®ä¸åº¦è‰¯ã„é–¢ä¿‚ã‚’æŽ¢ã‚‹ï¼šã‚³ãƒ¼ãƒ‰è§£èª¬ç·¨ | mah365
ä»¥å‰æŠ•ç¨¿ã—ãŸAngularJSã¨Railsã®ä¸åº¦è‰¯ã„é–¢ä¿‚ã‚’æŽ¢ã‚‹ã¨ã„ã†è¨˜äº‹ã®ã‚³ãƒ¼ãƒ‰è§£èª¬ç·¨ã§ã™ã€‚å‰å›žã¯ã–ã£ãã‚Šã¨ã—ãŸã‚¢ãƒ¼ã‚ãƒ†ã‚¯ãƒãƒ£ã®ç´¹ä»‹ã®ã¿ã«ã¨ã©ã‚ã¦ã„ãŸã®ã§ã€ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã‚µãƒ³ãƒ—ãƒ«ã‚³ãƒ¼ãƒ‰ã®è©³ç´°ã«ã¤ã„ã¦è§£èª¬ã—ã¾ã™ã€‚ ãƒãƒ¼ã‚¸ãƒ§ãƒ³æƒ…å ± ruby 2.1.3 rails 4.1.7 devise 3.2.4 angularjs 1.3.2 ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªæ§‹é€ appä»¥ä¸‹ã®ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªæ§‹é€ ã¯ä»¥ä¸‹ã®ã‚ˆã†ãªå½¢ã§ã™ã€‚ app â”œâ”€â”€ assets â”‚Â Â â”œâ”€â”€ images â”‚Â Â â”œâ”€â”€ javascripts â”‚Â Â â”‚Â Â â”œâ”€â”€ app â”‚Â Â â”‚Â Â â”‚Â Â â””â”€â”€ tasks â”‚Â Â â”‚Â Â â”‚Â Â â”œâ”€â”€ tasks.controller.js.erb â”‚Â Â â”‚Â Â â”‚Â Â â”œâ”€â”€ tasks.html.erb â”‚Â Â â”‚Â Â â”‚Â Â â”œâ”€â”€ tasks.js.erb â”‚Â Â â”‚Â Â â”‚Â Â
Jxck 2014/11/25
AngularJSã‹ã‚‰ã®POSTæ™‚ã«è‡ªå‹•çš„ã«ãã®å€¤ãŒX-XSRF-TOKENã«è¨å®šã•ã‚Œã‚‹æ€§è³ªã‚’åˆ©ç”¨ã™ã‚‹ã€‚

csrf

angular.js

rails
ãƒªãƒ³ã‚¯
Cross-Site Request Forgery Prevention - OWASP Cheat Sheet Series
Introduction Index Alphabetical Index ASVS Index MASVS Index Proactive Controls Index Top 10 Cheatsheets Cross-Site Request Forgery Prevention Cheat SheetÂ¶ IntroductionÂ¶ A Cross-Site Request Forgery (CSRF) attack occurs when a malicious web site, em ail, blog, instant message, or program tricks an authenticated user's web browser into performing an unwanted action on a trusted site. If a target use
Jxck 2012/11/05
csrf
ãƒªãƒ³ã‚¯
æœ‰åãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã®CSRFå¯¾ç–æ–¹æ³•ã‚’èª¿ã¹ãŸã¾ã¨ã‚ - webãƒã‚¿
ZendFramework æµã‚Œ è¡¨ç¤ºæ™‚ : tokenç”Ÿæˆâ†’hiddenã‚»ãƒƒãƒˆ + ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«ã‚»ãƒƒãƒˆ é€ä¿¡æ™‚ : é€ã‚‰ã‚Œã¦ããŸtokenã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«ã‚ã‚‹ã‚‚ã®ã¨åŒã˜ã‹ã§ãƒã‚§ãƒƒã‚¯ tokenç”Ÿæˆæ–¹æ³• ãƒ©ãƒ³ãƒ€ãƒ å€¤ + salt + å›ºå®šå€¤ + ãƒ©ãƒ³ãƒ€ãƒ å€¤ md5( mt_rand(1,1000000) . $this->getSalt() . $this->getName() . mt_rand(1,1000000) ); ã¾ã¨ã‚ ãƒ©ãƒ³ãƒ€ãƒ å€¤ã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«ã„ã‚Œã¦ã€é€ã‚‰ã‚Œã¦ããŸã‚‚ã®ã¨ãƒã‚§ãƒƒã‚¯ã€‚ Symfony æµã‚Œ è¡¨ç¤ºæ™‚ : tokenç”Ÿæˆâ†’hiddenã‚»ãƒƒãƒˆ é€ä¿¡æ™‚ : é€ã‚‰ã‚Œã¦ããŸtokenã‚’ã€å†åº¦ç”Ÿæˆã—ãŸtokenã¨æ¯”è¼ƒã—ã¦åŒã˜ã‹ãƒã‚§ãƒƒã‚¯ tokenç”Ÿæˆæ–¹æ³• salt + å›ºå®šå€¤ + ã‚»ãƒƒã‚·ãƒ§ãƒ³ID sha1($this->secret.$intention.$this->getSe
Jxck 2012/06/07
csrf

security
ãƒªãƒ³ã‚¯
1