[B! cookie] mahboã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

mahbo id:mahbo

cookieã«é–¢ã™ã‚‹mahboã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã‚¯ãƒƒã‚ãƒ¼ãƒ¢ãƒ³ã‚¹ã‚¿ãƒ¼ãƒã‚°ãŒã‚ã‚‹ã¨ã€IPã‚¢ãƒ‰ãƒ¬ã‚¹å½è£…é˜²æ¢ã®CSRFå¯¾ç–ãŒå›žé¿ã•ã‚Œã‚‹
æ—¥çµŒLinux 2013å¹´1æœˆå·ã«ã€Œâ€œèª¤èªé€®æ•â€ã‚’é˜²ãWebã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¼·åŒ–è¡“ã€ã‚’æ›¸ãã€ãã‚ŒãŒä»Šé€±4å›žé€£è¼‰ã§ã€ITproã«è»¢è¼‰ã•ã‚Œã¾ã—ãŸã€‚ã“ã®ä¸ã§ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒª(CSRF)å¯¾ç–ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã—ãŸãŒã€ã‚¯ãƒƒã‚ãƒ¼ãƒ¢ãƒ³ã‚¹ã‚¿ãƒ¼ãƒã‚°(Cookie Monster Bug)ãŒã‚ã‚‹å ´åˆã«å¯¾ç–ãŒå›žé¿ã•ã‚Œã‚‹ã“ã¨ã«æ°—ãŒã¤ãã¾ã—ãŸã€‚ ãã‚Œã§ã¯ã€ã©ã®ã‚ˆã†ãªå¯¾ç–ãŒæœ›ã¾ã—ã„ã‹ã‚’è€ƒãˆã¦ã¿ã‚‹ã¨ã€ä¸ã€…é›£ã—ã„å•é¡Œã§ã™ã€‚ä»¥ä¸‹ã€ãã®å†…å®¹ã«ã¤ã„ã¦æ¤œè¨Žã—ã¾ã™ã€‚ è§£æ±ºã™ã¹ãèª²é¡Œã®æ•´ç† è¨˜äº‹ã®è¶£æ—¨ã¯ã€æ˜¨å¹´ç„¡å®Ÿã®å¸‚æ°‘ã®ãƒ‘ã‚½ã‚³ãƒ³ã‹ã‚‰CSRFã«ã‚ˆã‚‹çŠ¯è¡Œäºˆå‘ŠãŒæ¨ªæµœå¸‚ã®ã‚µã‚¤ãƒˆã«æ›¸ãè¾¼ã¾ã‚ŒãŸã“ã¨ã‚’å—ã‘ã¦ã€ã‚µã‚¤ãƒˆå´ã§CSRFå¯¾ç–ã‚’ã—ã¦ã€ãªã‚Šã™ã¾ã—æ›¸ãè¾¼ã¿ãŒã§ããªã„ã‚ˆã†ã«ã—ã‚ˆã†ã¨ã„ã†ã‚‚ã®ã§ã™ã€‚ãªã‚Šã™ã¾ã—ã®çŠ¯è¡Œäºˆå‘Šã«ã¯ã€CSRFã®ã»ã‹ã€ãƒžãƒ«ã‚¦ã‚§ã‚¢ã‚’ç”¨ã„ã‚‹æ–¹æ³•ã€CSRFä»¥å¤–ã®Webã‚µã‚¤ãƒˆã¸ã®æ”»æ’ƒæ‰‹æ³•ã‚‚ã‚ã‚‹ã®ã§ã€CSRFå¯¾ç–ã ã‘ã§ååˆ†ã¨
mahbo 2013/09/17
security

cookie
ãƒªãƒ³ã‚¯
ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¢ãƒ€ãƒ—ã‚·ãƒ§ãƒ³ãŒãªãã¦ã‚‚ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒ•ã‚£ã‚¯ã‚»ã‚¤ã‚·ãƒ§ãƒ³æ”»æ’ƒã¯å¯èƒ½
å¤§åž£ï¼ˆ@yohgakiï¼‰ã•ã‚“ã¨ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¢ãƒ€ãƒ—ã‚·ãƒ§ãƒ³è„†å¼±æ€§ãŒã€Œé‡å¤§ãªè„…å¨ã€ã‹å¦ã‹ã§è«–äº‰ã‚’ç¶šã‘ã¦ã„ã¾ã™ã€‚ å¤§åž£ã•ã‚“:ç¬¬25å›žã€€PHPã®ã‚¢ã‚ãƒ¬ã‚¹è…± â”€â”€ ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†å¾³ä¸¸:PHPã®Session Adoptionã¯é‡å¤§ãªè„…å¨ã§ã¯ãªã„å¤§åž£ã•ã‚“:PHPã®ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¢ãƒ€ãƒ—ã‚·ãƒ§ãƒ³è„†å¼±æ€§ã¯ä¿®æ£ã—ã¦å½“ç„¶ã®è„†å¼±æ€§è°è«–ãŒã‹ã¿åˆã‚ãªã„ã®ã§ã€twitterã§ã€Œãƒ–ãƒã‚°èªã¿ã¾ã—ãŸã€‚ã‚µãƒ³ãƒ—ãƒ«ã‚‚å‹•ã‹ã—ã¾ã—ãŸã€‚å•é¡Œã¯åˆ†ã‹ã‚‹ã®ã§ã™ãŒã€ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¢ãƒ€ãƒ—ã‚·ãƒ§ãƒ³ãŒãªã„PHPã ã¨ã€ä½•ãŒæ”¹å–„ã•ã‚Œã‚‹ã®ã‹ãŒåˆ†ã‹ã‚Šã¾ã›ã‚“ã€‚æ•™ãˆã¦ä¸‹ã•ã„ã€ã¨ãƒ„ã‚¤ãƒ¼ãƒˆã—ãŸã¨ã“ã‚ã€å¤§åž£ã•ã‚“ãŒãƒ–ãƒã‚°ã§è¿”ä¿¡ä¸‹ã•ã„ã¾ã—ãŸã€‚ å¤§åž£ã•ã‚“:Â ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¢ãƒ€ãƒ—ã‚·ãƒ§ãƒ³è„†å¼±æ€§ãŒãªã„ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ãŒå¿…è¦ãªç†ç”±ã“ã‚Œã‚’èªã‚“ã§ã‹ã¿åˆã‚ãªã„ç†ç”±ãŒåˆ†ã‹ã‚Šã¾ã—ãŸã€‚å¤§åž£ã•ã‚“ã€ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ä»¥ä¸‹å¤§åž£ã•ã‚“ã®ãƒ–ãƒã‚°ã®æœ«å°¾ã‚’å¼•ç”¨ã—ã¾ã™ã€‚ è„±ç·šã—ã¾ã—ãŸãŒã€ä½•ãŒæ”¹å–„ã•ã‚Œã‚‹ã®ã‹ï¼Ÿçµè«–ã¯ ãƒã‚°ã‚¤ãƒ³æ™‚ã«
mahbo 2013/09/17
security

cookie
ãƒªãƒ³ã‚¯
PHP5.5.2ä»¥é™ã®strict sessionsãƒ¢ãƒ¼ãƒ‰ã§ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒ•ã‚£ã‚¯ã‚»ã‚¤ã‚·ãƒ§ãƒ³å¯¾ç–ã¯ã©ã†ã™ã‚Œã°ã‚ˆã„ã‹
å…ˆæ—¥ã®ã‚¨ãƒ³ãƒˆãƒªã€Žã€é€Ÿå ±ã€‘PHP-5.5.2ã«ã¦å¤§åž£ã•ã‚“ã®strict sessionsãŒå®Ÿè£…ã•ã‚Œã¾ã—ãŸã€ã«ã¦ã€PHP5.5.2ã§ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¢ãƒ€ãƒ—ã‚·ãƒ§ãƒ³ãŒè§£æ¶ˆã•ã‚ŒãŸã“ã¨ã‚’å ±å‘Šã—ã¾ã—ãŸï¼ˆsession.use_strict_mode=1ã®å ´åˆï¼‰ã€‚ ã‚»ãƒƒã‚·ãƒ§ãƒ³ã‚¢ãƒ€ãƒ—ã‚·ãƒ§ãƒ³ã¨ã¯ã€æœªåˆæœŸåŒ–ã®ã‚»ãƒƒã‚·ãƒ§ãƒ³IDï¼ˆãŸã¨ãˆã°PHP SESSID=ABCï¼‰ã‚’PHPãŒå—ã‘å…¥ã‚Œã‚‹å•é¡Œã®ã“ã¨ã§ã™ã€‚strict sessionsã‚’ä½¿ç”¨ã™ã‚‹ã¨ã€PHPãŒç”Ÿæˆã—ã€ç¾åœ¨æœ‰åŠ¹ã§ã‚ã‚‹ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã®ã¿ã‚’å—ã‘å…¥ã‚Œã€ãã†ã§ãªã„å ´åˆã€PHPã¯ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã‚’æŒ¯ã‚Šç›´ã—ã¾ã™ã€‚ ã‚ã„ã«ãPHP5.5.2ï¼ˆPHP5.5.3ã‚‚ï¼‰ã«ã¯ãƒã‚°ãŒã‚ã‚Šã€session.use_strict_mode=1ã«ã‚ˆã‚‹strict sessionsã¯ä½¿ç”¨ã§ãã¾ã›ã‚“ãŒã€æ—¢ã«å¤§åž£ã•ã‚“è‡ªèº«ã«ã‚ˆã‚Šãƒã‚°ä¿®æ£ã•ã‚Œã¦ã„ã‚‹ã®ã§ã€PHP5.5.4ã‹ã‚‰ã¯ä½¿ãˆã‚‹ã‚ˆã†ã«ãªã‚‹ã§ã—ã‚‡ã†ã€‚ str
mahbo 2013/09/17
security

cookie
ãƒªãƒ³ã‚¯
Cookieã®Domainå±žæ€§ã¯ *æŒ‡å®šã—ãªã„* ãŒä¸€ç•ªå®‰å…¨
ãŸã¾ã«èª¤è§£ãŒã‚ã‚‹ã‚ˆã†ã§ã™ãŒã€Cookieã‚’è¨å®šã™ã‚‹å ´åˆã®Domainå±žæ€§ã¯ *è¨å®šã—ãªã„* ã®ãŒã‚‚ã£ã¨ã‚‚å®‰å…¨ã§ã™ã€‚ä»¥ä¸‹ã€ä¾‹ç¤ºã«ã‚ˆã‚Šèª¬æ˜Žã—ã¾ã™ã€‚ # ã“ã®ã‚¨ãƒ³ãƒˆãƒªã¯ã€ã¯ã¦ãªãƒ€ã‚¤ã‚¢ãƒªãƒ¼ã®éŽåŽ»ã®ã‚¨ãƒ³ãƒˆãƒªã‹ã‚‰ã®è»¢è¼‰ã§ã™
mahbo 2013/09/17
security

cookie
ãƒªãƒ³ã‚¯
éžSSLã‹ã‚‰SSLï¼ˆSSLã‹ã‚‰éžSSLï¼‰ã¸ã®sessionãƒ‡ãƒ¼ã‚¿ã®å—ã‘æ¸¡ã—ï½œâ˜…ãƒŽãƒžãƒ‰ãƒ¯ãƒ¼ã‚ãƒ³ã‚°ã«æ†§ã‚Œã¦â˜… PROJECTÃ—9POINTS
mahbo 2011/01/17
ssl

cookie
ãƒªãƒ³ã‚¯
SSLã¨éžSSLã®é–“ã®è¡Œãæ¥ã®ãƒ¡ã‚«ãƒ‹ã‚ºãƒ ï½œâ˜…ãƒŽãƒžãƒ‰ãƒ¯ãƒ¼ã‚ãƒ³ã‚°ã«æ†§ã‚Œã¦â˜… PROJECTÃ—9POINTS
mahbo 2011/01/17
ssl

cookie
ãƒªãƒ³ã‚¯
1