Ruby On Rails ピãƒã‚«ãƒ¼ãƒˆè¡—é“ - [2.0]セッション＆クッã‚ー -XSS　クãƒã‚¹ãƒ»ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ティングã§å•é¡Œã¨ã—ã¦çœŸã£å…ˆã«ä¸Šã’られãã†ãªã€cookie ã®å€¤ã‚’ javascript ã§å–ã£ã¦ãã‚‹ã€ã¨ã„ã†ã“ã¨ãŒå‡ºæ¥ãªã„クッã‚ーã®ã“ã¨ã§ã™ã€‚ ãれを http only cookie ã¨è¨€ã£ãŸã‚Šã—ã¾ã™ãŒã€ãã®è¨å®šãŒå‡ºæ¥ã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚ options = { "name" => "quality", "value" => "owesome", "http_only" => true } cookie = CGI::Cookie.new(options) http only クッã‚ーã¨ã¯ãªã‚“ãžã‚„ã€ã®æ–¹ã¯ã€ T.Teradaã®æ—¥è¨˜ã‚„ Mitigating Cross-site Scripting With HTTP-only CookiesãŒãŠå‹§ã‚ã§ã™ã€‚ ã€åºƒå‘Šã€‘ CSRF (Cross-Site Request Forgery) ã‚’å‹æ‰‹ã«é˜²æ¢ã—ã¦ãã ã•ã„
Rails 3 ã§ã® CSRF å¯¾ç– - エラー時㫠ActionController::InvalidAuthenticityToken error ã¯è¡¨ç¤ºã•ã‚Œãªã„ - 僕ã¯ç™ºå±•é€”上技術者
CSRFã®å¯¾å¿œã«ã¤ã„ã¦ã€rails使ã„ãŒçŸ¥ã£ã¦ãŠãã¹ãã“㨠- ãŠã‚‚ã—ã‚webサービス開発日記
Rails 4.0ã ã¨CSRFトークンã§ã‚¨ãƒ©ãƒ¼ã«ãªã‚‹ - Qiita
Rails ã« XML をボディã¨ã™ã‚‹ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’ JavaScript ã§é€ã‚‹ - æƒ…å ±ã¨éŸ³æ¥½
{{#tags}}- {{label}}
{{/tags}}