Djangoã®ãƒ‘スワードリセットã§tokenã®ä¸€è‡´ç¢ºèªã«ä½¿ã‚れるconstant_time_compare - メモ置ãå ´ã“ã‚“ãªé–¢æ•°ãªã‚“ã§ã™ãŒã€ãªã‚“ã§æ–‡å—列ã®==ã§ãªãã€ã‚ã–ã‚ã–ã“ã‚“ãªã“ã¨ã—ã¦ã‚‹ã‚“ã§ã—ょã†ã‹ï¼Ÿ djangoã®1.3ã®é ƒã¯æ™®é€šã«æ¯”較ã—ã¦ãŸã¨æ€ã†ã‚“ã§ã™ãŒã€‚ django.utils.crypto.py def constant_time_compare(val1, val2): """ Returns True if the two strings are equal, False otherwise. The time taken is independent of the number of characters that match. """ if len(val1) != len(val2): return False result = 0 if six.PY3 and isinstance(val1, bytes) and isinstance(val2, bytes): for x,
CSRF is (really) dead
Why is referer checking needed for Django to prevent CSRF
クãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒª(CSRF)ã¨ãã®å¯¾ç–
CSRF対ç–用トークンã®å€¤ã«ã‚»ãƒƒã‚·ãƒ§ãƒ³IDãã®ã‚‚ã®ã‚’使ã£ã¦ã‚‚ã„ã„時代ãªã‚“ã¦ã€ãã‚‚ãã‚‚ç„¡ã‹ã£ãŸ
2013 å¹´ã®æ–°å’ç ”ä¿®ãƒ¡ãƒ‹ãƒ¥ãƒ¼ - gist:5316074
twitterã«å¦ã¶ãªã‚Šã™ã¾ã—投稿対ç–
ãªãœGoogleã¯JSONã®å…ˆé ã« while(1); ã‚’ã¤ã‘ã‚‹ã®ã‹ - Qiita
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - CSRF対ç–ã«ã€Œãƒ¯ãƒ³ã‚¿ã‚¤ãƒ トークンã€æ–¹å¼ã‚’推奨ã—ãªã„ç†ç”±
FuelPHP » Forums
Simple, yet effective CSRF class for FuelPHP. · GitHub
CSRFã§å¼·åˆ¶ãƒã‚°ã‚¤ãƒ³ã•ã›ã‚‹ã¨ã„ã†ã‚¢ã‚¤ãƒ‡ã‚¢ - ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼
monoweb.info - ã“ã®ã‚¦ã‚§ãƒ–サイトã¯è²©å£²ç”¨ã§ã™ï¼Â - monoweb リソースãŠã‚ˆã³æƒ…å ±
http://blog.monoweb.info/article/2012021823.html
webアプリケーションã®è„†å¼±æ€§ã¨ã¯ï¼Ÿ - OKWAVE
クãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ティング(XSS)ã¨CSRFã®é•ã„早分ã‹ã‚Š - ockeghem(徳丸浩)ã®æ—¥è¨˜
æ©Ÿå¯†æƒ…å ±ã«JSONPã§ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ãª
{{#tags}}- {{label}}
{{/tags}}