[B! Security][CSP] clavierã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

clavier id:clavier

Securityã¨CSPã«é–¢ã™ã‚‹clavierã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

CSP (Content Security Policy) nonce-sourceã«ã¤ã„ã¦èª¿ã¹ã¦ã¿ãŸ â€” A Day in Serenity (Reloaded) â€” PHP, CodeIgniter, FuelPHP, Linux or something
CSP nonce-sourceã¨ã¯ï¼Ÿ Content Security Policy (CSP) ã¯ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° (XSS) ã‚„ãƒ‡ãƒ¼ã‚¿ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³æ”»æ’ƒã‚’å«ã‚€ã€ã‚ˆãçŸ¥ã‚‰ã‚ŒãŸç¨®é¡žã®æ”»æ’ƒã‚’æ¤œå‡ºã—ã¦è»½æ¸›ã™ã‚‹ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®è¿½åŠ ãƒ¬ã‚¤ãƒ¤ãƒ¼ã§ã™ã€‚ã“ã‚Œã‚‰ã®æ”»æ’ƒæ‰‹æ³•ã¯ã€ãƒ‡ãƒ¼ã‚¿çªƒç›—ã‹ã‚‰ã‚µã‚¤ãƒˆæ”¹å¤‰ã€ãƒžãƒ«ã‚¦ã‚§ã‚¢æ„ŸæŸ“ã¾ã§ã€ã™ã¹ã¦ã«ä½¿ç”¨ã•ã‚Œã¾ã™ã€‚ https://developer.mozilla.org/ja/docs/Security/CSP ã‚ˆã‚Šã€‚ XSSã«é–¢ã—ã¦ç°¡å˜ã«è¨€ã†ã¨ã€å®Ÿè¡Œã§ãã‚‹JavaScriptã‚’åˆ¶é™ã—ã¦ã€å¤–éƒ¨ã‹ã‚‰ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒæ³¨å…¥ã•ã‚Œã¦ã‚‚ãƒ–ãƒ©ã‚¦ã‚¶ãŒå®Ÿè¡Œã—ãªã„ã“ã¨ã§XSSã‚’é˜²å¾¡ã™ã‚‹æ©Ÿèƒ½ã¨ã„ã†ã“ã¨ã«ãªã‚Šã¾ã™ã€‚ ä¾‹ãˆã°ã€è‡ªåˆ†ã®ã‚µãƒ¼ãƒä¸Šã®jsãƒ•ã‚¡ã‚¤ãƒ«ã‹ã‚‰ã®ã¿ã®scriptã‚’å®Ÿè¡Œã™ã‚‹ã‚ˆã†ã«æŒ‡å®šã™ã‚Œã°ã€å¤–éƒ¨ã‹ã‚‰ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’æŒ¿å…¥ã•ã‚Œã¦ã‚‚å®Ÿè¡Œã¯ã•ã‚Œãšå®‰å…¨ã«ãªã‚Šã¾ã™ã€‚ ã—ã‹ã—ã€ã‚¤ãƒ³ãƒ©ã‚¤ãƒ³ã®Ja
clavier 2018/03/13
CSP

security
ãƒªãƒ³ã‚¯
mixed contents å¯¾å¿œã‚’ä¿ƒé€²ã™ã‚‹ CSP ãƒ‡ã‚£ãƒ¬ã‚¯ãƒ†ã‚£ãƒ– | blog.jxck.io
Intro HTTPS ç§»è¡Œã®å•é¡Œç‚¹ã®ä¸€ã¤ã«ã€ mixed contents ã¸ã®å¯¾å¿œãŒã‚ã‚‹ã€‚ é€†ã« mixed contents ã®ç™ºç”Ÿã‚’æã‚Œã€ HTTPS ã«ç§»è¡Œã§ããªã„ã‚µãƒ¼ãƒ“ã‚¹ã‚‚ã‚ã‚‹ã ã‚ã†ã€‚ æœ¬ã‚¨ãƒ³ãƒˆãƒªã§ã¯ mixed contents ã®æ£ã—ã„ç†è§£ã¨ã€ãã®æ¤œå‡ºã‚„è§£æ¶ˆã«åˆ©ç”¨ã§ãã‚‹å¯èƒ½æ€§ã®ã‚ã‚‹ã€ CSP ã® Upgrade-Insecure-Request ãŠã‚ˆã³ã€ Block-All-Mixed-Contents ã‚’è§£èª¬ã™ã‚‹ã€‚ mixed contents HTTPS ã§é…ä¿¡ã•ã‚ŒãŸã‚³ãƒ³ãƒ†ãƒ³ãƒ„ãŒã€ã‚µãƒ–ãƒªã‚½ãƒ¼ã‚¹ã¨ã—ã¦ HTTP ã®ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚’å«ã‚€å ´åˆã€ã“ã‚Œã‚’ mixed contents ã¨ã„ã†ã€‚ HTTPS ã¯ MITM ã«å¯¾ã™ã‚‹è€æ€§ãŒã‚ã‚‹ãŒã€ HTTP ã¯ MITM ã¸ã®è€æ€§ãŒãªã„ãŸã‚ã€ mixed contents ã®çŠ¶æ…‹ã§ã¯ã‚µãƒ–ãƒªã‚½ãƒ¼ã‚¹ã‚’èµ·ç‚¹ã«ãƒ¡ã‚¤ãƒ³ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã¸ã®æ”¹ã–ã‚“ãŒæˆç«‹ã—ã¦
clavier 2017/01/11
HTTPS

security

CSP
ãƒªãƒ³ã‚¯
Webãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
4. äº‹å‰å¦ç¿’ã‚’æŒ¯ã‚Šè¿”ã‚‹ â€¢ HSTSã‚’å…ƒã«æ¬¡ã®ã‚ˆã†ãªå•é¡Œç‚¹ã‚’è€ƒå¯Ÿã—ãŸ ãã®æŠ€è¡“ã§ã¯è§£æ±ºã§ããªã„å•é¡Œ ç«¯æœ«æ™‚åˆ»ã®æ”¹ã–ã‚“ã«ã‚ˆã‚‹HSTSã®å¼·åˆ¶å¤±åŠ¹ ãã®æŠ€è¡“ã®å°Žå…¥ã«ã‚ˆã‚Šæ–°ãŸã«ç”Ÿã˜ã‚‹å•é¡Œ HSTSã‚’ç”¨ã„ãŸãƒ¦ãƒ¼ã‚¶ãƒ¼è¿½è·¡ (HSTS Supercookies) å®Ÿè£…ã®èª¤ã‚Šã«èµ·å› ã™ã‚‹å•é¡Œ æŒ‡å®šã‚’èª¤ã‚‹ã¨HTTPSéžå¯¾å¿œã®ã‚µãƒ–ãƒ‰ãƒ¡ã‚¤ãƒ³ãŒã‚¢ã‚¯ã‚»ã‚¹ä¸èƒ½ã« ä»•æ§˜ä¸Šæ—¢å®šã•ã‚Œã¦ã„ãªã„æŒ¯ã‚‹èˆžã„ HSTSã¯WebSocket(ws:)ã«ã‚‚é©ç”¨ã•ã‚Œã‚‹ã®ã‹ï¼Ÿ CVE-2015-1244: Chrome ã§WebSocketã«HSTSãŒé©ç”¨ã•ã‚Œãªã„ HSTSã¯ãƒ—ãƒ©ã‚¤ãƒã‚·ãƒ¼ãƒ¢ãƒ¼ãƒ‰ã«ã‚‚å¼•ãç¶™ãã®ã‹ï¼Ÿ ã¾ãŸãã®é€†ã¯ï¼Ÿ 7. ç§ã®æˆ¦æ´(å‚è€ƒ) â€¢ æ¬¡ã®ã‚ˆã†ãªä»•æ§˜ä¸å‚™ã‚’è„†å¼±æ€§ã¨ã—ã¦æŒ‡æ‘˜ã—ã¦ããŸ Chromeã®CSPé•åãƒ¬ãƒãƒ¼ãƒˆã®é€ä¿¡å…ˆãŒ<base>ã§åˆ¶å¾¡ã§ãã‚‹ https://crbug.com/431218 Chromeã®HTML
clavier 2015/08/15
security

CSP
ãƒªãƒ³ã‚¯
CSPã®è©±ã€œFxOSãƒãƒ¥ãƒ¼ãƒ³â˜†ã€œ
CSPã®è©±ã€œFxOSãƒãƒ¥ãƒ¼ãƒ³â˜†ã€œ - Download as a PDF or view online for free
clavier 2015/05/30
CSP

firefox

security
ãƒªãƒ³ã‚¯
PHPã§CSPï¼ˆContent Security Policyï¼‰ã‚’å°Žå…¥ã—ã¦XSSå¯¾ç–ã‚’å¼·åŒ–ã—ã¦ã¿ã‚ˆã† â€” A Day in Serenity (Reloaded) â€” PHP, CodeIgniter, FuelPHP, Linux or something
PHPã§ç°¡å˜ã«CSPã‚’å°Žå…¥ã™ã‚‹ãŸã‚ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã‚’ä½œæˆã—ã¦ã¿ã¾ã—ãŸã€‚ kenjis/csp https://github.com/kenjis/php-csp-nonce-source æ—¢å˜ã‚µã‚¤ãƒˆã¸ã®å½±éŸ¿ã‚’æœ€å°é™ã«ã—ã¦CSPãŒå°Žå…¥ã§ãã‚‹ã“ã¨ã‚’ç›®çš„ã¨ã—ã¦ã„ã¾ã™ã€‚ åŸºæœ¬çš„ã«CSP nonce-sourceã‚’ä½¿ã„ã€nonceã®ãªã„scriptã‚¿ã‚°ã¯å®Ÿè¡Œã—ãªã„ã‚ˆã†ã«ã™ã‚‹ã“ã¨ã§XSSå¯¾ç–ã‚’å¼·åŒ–ã—ã¾ã™ã€‚ ã“ã®ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã®ä»•æ§˜ã¨ã—ã¦ã¯ã€CSP nonce-sourceã«å¯¾å¿œã—ã¦ã„ã‚‹ã¨æ€ã‚ã‚Œã‚‹æŒ‡å®šãƒ–ãƒ©ã‚¦ã‚¶ã«å¯¾ã—ã¦ã®ã¿CSPãƒ˜ãƒƒãƒ€ã‚’å‡ºåŠ›ã—ã¾ã™ã€‚ç¾çŠ¶ã€Chromeã¨Firefoxã®ã¿ãŒæŒ‡å®šã•ã‚Œã¦ã„ã¾ã™ã€‚ ãªãŠã€CSP nonce-sourceã«å¯¾å¿œã—ãŸChromeã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ãŒã‚ã‹ã‚‰ãªã„ã®ã§ã€ç¢ºèªã§ããŸãƒãƒ¼ã‚¸ãƒ§ãƒ³37ä»¥ä¸Šã¨ã—ã¦ã¾ã™ã€‚ CSPã«ã¤ã„ã¦ CSPã«ã¤ã„ã¦ã‚ˆãçŸ¥ã‚‰ãªã„æ–¹ã¯ä»¥ä¸‹ã®ã‚¹ãƒ©ã‚¤ãƒ‰ãªã©ã‚’ã”è¦§ä¸‹ã•ã„ã€‚
clavier 2014/10/31
PHP

XSS

security

CSP
ãƒªãƒ³ã‚¯
A primer on Content Security Policy
Content Security Policy (CSP) is as a security concept aiming to prevent XSS and other forms of browserâ€“based attacks right where they happen â€” in the browser. CSP has been around for a little while but itâ€™s only now that browser vendors are closing in on implementing most of the W3C specification. This talk will take a look at what CSP is, why it matters and how to use it with Rubyâ€“based web appl
clavier 2014/10/05
CSP

browser

security
ãƒªãƒ³ã‚¯
1