[B! csrf] potappoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

potappo id:potappo

csrfã«é–¢ã™ã‚‹potappoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

crossdomain.xml ã¨ CSRF è„†å¼±æ€§ã«ã¤ã„ã¦ - 2nd life (ç§»è»¢ã—ã¾ã—ãŸ)
crossdomain.xml ã‚’å®‰æ˜“ã«è¨ç½®ã™ã‚‹ã¨ CSRF è„†å¼±æ€§ã‚’å¼•ãèµ·ã“ã™å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ã¨ã„ã†ã®ã‚‚ã€ã“ã“æ•°ãŒæœˆã€ãã‚Œãªã‚Šã®æ•°ã® crossdomain.xml ã«ã‚ˆã‚‹ CSRF è„†å¼±æ€§ã‚’ç™ºè¦‹ã—(ç¾åœ¨ã€ãã‚Œã‚‰ã®ã‚µã‚¤ãƒˆã§ã¯å¯¾ç–ãŒãªã•ã‚Œã¦ã„ã¾ã™)ã€ã¾ã ã¾ã Web ãƒ—ãƒã‚°ãƒ©ãƒžã«è„†å¼±æ€§ã‚’å¼•ãèµ·ã“ã™å¯èƒ½æ€§ãŒã‚ã‚‹ã€ã¨ã„ã†è€ƒãˆæ–¹ãŒæµ¸é€ã—ã¦ãªã„ã‚“ã˜ã‚ƒãªã„ã‹ã€ã¨æ€ã£ãŸã®ã§ã€‚ å…ˆæœˆã€Life is beautiful: ã‚¦ã‚§ãƒ–ã‚µãƒ¼ãƒ“ã‚¹APIã«ãŠã‘ã‚‹ã€Žæˆã‚Šã™ã¾ã—å•é¡Œã€ã«é–¢ã™ã‚‹ä¸€è€ƒå¯Ÿã«ã‚‚ crossdomain.xml ã«ã¤ã„ã¦æ›¸ã‹ã‚Œã¦ãŸã®ã§ã™ãŒã€ãã®å¾Œã‚‚ã„ãã¤ã‹ã®ã‚µãƒ¼ãƒ“ã‚¹ã§ crossdomain.xml ã‚’è¨±å¯ãƒ‰ãƒ¡ã‚¤ãƒ³ã™ã¹ã¦ã«ã—ã¦ã„ã‚‹ã‚µãƒ¼ãƒ“ã‚¹ãŒã‚ã£ãŸã®ã§ã€æ³¨æ„å–šèµ·ã¨ã—ã¦ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã«æ›¸ãèµ·ã“ã—ã¾ã™ã€‚ è‡ªåˆ†ã‚‚ä¸€å¹´åŠãã‚‰ã„å‰ã¯ã€crossdomain.xml ã‚’è¨±å¯ãƒ‰ãƒ¡ã‚¤ãƒ³ã™ã¹ã¦ ('*') ã«ã—ã¦è¨ç½®ã—
potappo 2007/07/20
crossdomain.xml

csrf

flash

security
ãƒªãƒ³ã‚¯
ã‚¢ãƒ•ã‚£ãƒªã‚¨ã‚¤ãƒˆIDãŒæ›¸ãæ›ã‚ã‚‹è„†å¼±æ€§ã«ã¤ã„ã¦ - ã¯ã¦ãªãƒ€ã‚¤ã‚¢ãƒªãƒ¼æ—¥è¨˜
æœ¬æ—¥20æ™‚é ƒã€ç‰¹å®šã®ã‚¿ã‚°ã‚’è²¼ã‚Šä»˜ã‘ãŸãƒšãƒ¼ã‚¸ã‚’é–²è¦§ã™ã‚‹ã ã‘ã§ã€ã¯ã¦ãªã«ã”ç™»éŒ²ã„ãŸã ã„ã¦ã„ã‚‹ã‚¢ãƒ•ã‚£ãƒªã‚¨ã‚¤ãƒˆIDãŒæ›¸ãæ›ã‚ã£ã¦ã—ã¾ã†è„†å¼±æ€§ãŒå˜åœ¨ã™ã‚‹äº‹ãŒåˆ¤æ˜Žã—ã¾ã—ãŸã€‚ ã“ã®è„†å¼±æ€§ã«ã¤ã„ã¦ã€å…ˆã»ã©ä¿®æ£ã‚’è¡Œã„ã¾ã—ãŸã€‚ç¾åœ¨ã€ã“ã®è„†å¼±æ€§ã¯ä¿®æ£ã•ã‚Œã¦ãŠã‚Šã¾ã™ã€‚ è„†å¼±æ€§ã®å†…å®¹ ç‰¹å®šã®å¼•æ•°ã‚’æŒ‡å®šã—ãŸç”»åƒã‚¿ã‚°ã‚’ä½¿ç”¨ã™ã‚‹äº‹ã§ã€ãƒšãƒ¼ã‚¸ã®é–²è¦§è€…ãŒã‚¢ãƒ•ã‚£ãƒªã‚¨ã‚¤ãƒˆãƒšãƒ¼ã‚¸ã§è¨å®šã‚’å¤‰æ›´ã—ãŸæ“ä½œã¨åŒç‰ã®æ“ä½œãŒå¯èƒ½ã¨ãªã£ã¦ãŠã‚Šã¾ã—ãŸã€‚ ä»Šå¾Œã®å¯¾å¿œã«ã¤ã„ã¦ ç¾åœ¨è¢«å®³çŠ¶æ³ã‚’èª¿æŸ»ä¸ã§ã™ãŒã€ã‚¢ãƒ•ã‚£ãƒªã‚¨ã‚¤ãƒˆIDã®æ›¸ãæ›ãˆãŒè¡Œã‚ã‚ŒãŸæ–¹ãŒç¾åœ¨200åç¨‹åº¦ç¢ºèªã•ã‚Œã¦ã„ã¾ã™ã€‚ ä»Šå¾Œã•ã‚‰ã«è©³ç´°ãªèª¿æŸ»ã‚’è¡Œã„ã€è¢«å®³è€…ã®æ–¹ã«ã¯éšæ™‚å€‹åˆ¥ã«ä»Šå›žã®çŠ¶æ³èª¬æ˜Žã¨ã€ã‚¢ãƒ•ã‚£ãƒªã‚¨ã‚¤ãƒˆIDå†è¨å®šã®ã”é€£çµ¡ã‚’è¡Œã‚ã›ã¦ã„ãŸã ãã¾ã™ã€‚ ã¾ãŸã€åŒæ§˜ã®è„†å¼±æ€§ãŒå˜åœ¨ã—ãªã„ã‹ã€æ”¹ã‚ã¦ä»–ã®ãƒšãƒ¼ã‚¸ã«ã¤ã„ã¦ã‚‚ç¢ºèªã‚’è¡Œã„ã¾ã™ã€‚ ã“ã®ãŸã³ã¯ã¯ã¦ãªã‚·ã‚¹ãƒ†ãƒ ã®ä¸å‚™ã«ã‚ˆã‚Šã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®çš†æ§˜ã«ã”è¿·æƒ‘ã‚’ãŠã‹ã‘
potappo 2006/12/28
d:id:Hamachiya2:20061226:1167131091ã®ä»¶ã€‚

affiliate

csrf

security

hatena

d

hamachiya
ãƒªãƒ³ã‚¯
http://search.cpan.org/~holly/CGI-Application-Plugin-ProtectCSRF/ProtectCSRF.pm
potappo 2006/11/15
cpan

perl

cgi

csrf

security
ãƒªãƒ³ã‚¯
æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ï¼šæƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ï¼šè„†å¼±æ€§å¯¾ç–ï¼šå®‰å…¨ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ä½œã‚Šæ–¹
ã€Œå®‰å…¨ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ä½œã‚Šæ–¹ã€ã¯ã€IPAãŒå±Šå‡º(*1)ã‚’å—ã‘ãŸè„†å¼±æ€§é–¢é€£æƒ…å ±ã‚’åŸºã«ã€å±Šå‡ºä»¶æ•°ã®å¤šã‹ã£ãŸè„†å¼±æ€§ã‚„æ”»æ’ƒã«ã‚ˆã‚‹å½±éŸ¿åº¦ãŒå¤§ãã„è„†å¼±æ€§ã‚’å–ã‚Šä¸Šã’ã€ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆé–‹ç™ºè€…ã‚„é‹å–¶è€…ãŒé©åˆ‡ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’è€ƒæ…®ã—ãŸã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã‚’ä½œæˆã™ã‚‹ãŸã‚ã®è³‡æ–™ã§ã™ã€‚ ã€Œå®‰å…¨ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ä½œã‚Šæ–¹ã€æ”¹è¨‚ç¬¬7ç‰ˆã®å†…å®¹ ç¬¬1ç« ã§ã¯ã€ã€Œã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å®Ÿè£…ã€ã¨ã—ã¦ã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ã€OSã‚³ãƒžãƒ³ãƒ‰ãƒ»ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ã‚„ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° ç‰11ç¨®é¡žã®è„†å¼±æ€§ã‚’å–ã‚Šä¸Šã’ã€ãã‚Œãžã‚Œã®è„†å¼±æ€§ã§ç™ºç”Ÿã—ã†ã‚‹è„…å¨ã‚„ç‰¹ã«æ³¨æ„ãŒå¿…è¦ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ç‰¹å¾´ç‰ã‚’è§£èª¬ã—ã€è„†å¼±æ€§ã®åŽŸå› ãã®ã‚‚ã®ã‚’ãªãã™æ ¹æœ¬çš„ãªè§£æ±ºç–ã€æ”»æ’ƒã«ã‚ˆã‚‹å½±éŸ¿ã®ä½Žæ¸›ã‚’æœŸå¾…ã§ãã‚‹å¯¾ç–ã‚’ç¤ºã—ã¦ã„ã¾ã™ã€‚ ç¬¬2ç« ã§ã¯ã€ã€Œã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®å®‰å…¨æ€§å‘ä¸Šã®ãŸã‚ã®å–ã‚Šçµ„ã¿ã€ã¨ã—ã¦ã€ã‚¦ã‚§ãƒ–ã‚µãƒ¼ãƒã®é‹ç”¨ã«é–¢ã™ã‚‹å¯¾ç–ã‚„ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã«ãŠã‘ã‚‹ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®å–æ‰±ã„ã«é–¢ã™
potappo 2006/11/04
0ã‚ã¨ã§èªã‚€

web

security

csrf

webdev

reference
ãƒªãƒ³ã‚¯
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - CSRFå¯¾ç–ã«ã€Œãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒˆãƒ¼ã‚¯ãƒ³ã€æ–¹å¼ã‚’æŽ¨å¥¨ã—ãªã„ç†ç”±
æ°´è‰²ã®å››è§’ã¯ç”»é¢ã‚’è¡¨ã—ã€ç™½æŠœãå®Ÿç·šæž ã®å››è§’ã¯ãƒœã‚¿ãƒ³ã‚’è¡¨ã™ã€‚ ã“ã‚Œã‚’ã€Webã‚¢ãƒ—ãƒªã¨ã„ã†å®Ÿè£…æ‰‹æ³•ã‚’é¸æŠžã™ã‚‹å ´åˆã«ç‰¹åŒ–ã™ã‚‹ã¨ã€å›³2ã®ã‚ˆã†ãªé·ç§»å›³ãŒæã‘ã‚‹ã€‚ å®Ÿç·šçŸ¢å°ã¯ãƒ–ãƒ©ã‚¦ã‚¶ãŒé€ä¿¡ã™ã‚‹HTTPã®requestï¼ˆãƒ˜ãƒƒãƒ€ãŠã‚ˆã³ã€POSTã®å ´åˆã¯ãƒœãƒ‡ã‚£ã‚’å«ã‚€ï¼‰ã‚’è¡¨ã—ã€é»„è‰²ã®ä¸¸ãŒã‚µãƒ¼ãƒå´ã§ã®1ã‚¢ã‚¯ã‚»ã‚¹ã®å‡¦ç†ã‚’è¡¨ã—ã€ç‚¹ç·šãŒãã®å‡¦ç†çµæžœã‚’è¿”ã™HTTPã®responseï¼ˆãƒ˜ãƒƒãƒ€ãŠã‚ˆã³ã€HTMLï¼‰ã‚’è¡¨ã™ã€‚responseã®ä¸Šã®æ–‡ã¯HTMLã®å†…å®¹ã‚’èª¬æ˜Žã™ã‚‹ã‚‚ã®ã§ã‚ã‚‹ã€‚é»„è‰²ã®ä¸¸ã®ä¸ã®æ–‡ã¯å‡¦ç†å†…å®¹ã®èª¬æ˜Žã§ã‚ã‚Šã€ã“ã“ã‹ã‚‰è¤‡æ•°ã®responseçŸ¢å°ãŒå‡ºã¦ã„ã‚‹å ´åˆã€å‡¦ç†ã®çµæžœã«ã‚ˆã£ã¦é·ç§»å…ˆã®ç”»é¢ãŒç•°ãªã‚‹å ´åˆã§ã‚ã‚‹ã“ã¨ã‚’è¡¨ã—ã€ç ´ç·šã®ç™½æŠœãå››è§’ãŒãã®åˆ†å²ã®æ¡ä»¶ã‚’æ¦‚èª¬ã—ã¦ã„ã‚‹ã€‚ ã“ã®å›³ã§ä¾‹ã«ç”¨ã„ã¦ã„ã‚‹ã®ã¯ã€ECã‚µã‚¤ãƒˆã‚„blogã‚µãƒ¼ãƒ“ã‚¹ãªã©ã«è¦‹ã‚‰ã‚Œã‚‹å…¸åž‹çš„ãªã€Œç™»éŒ²å€‹äººæƒ…å ±å¤‰æ›´ã€ã®æ©Ÿèƒ½ã§ã‚ã‚‹ã€‚ã€Œãƒ¡ã‚¤ãƒ³ãƒ¡ãƒ‹ãƒ¥ãƒ¼ã€ç”»é¢ã®ã€Œç™»éŒ²æƒ…å ±å¤‰æ›´
potappo 2006/04/11
csrf

security

0ã‚ã¨ã§èªã‚€

webdev
ãƒªãƒ³ã‚¯
é–‹ç™ºè€…ã®ãŸã‚ã®æ£ã—ã„CSRFå¯¾ç–
è‘—è€…: é‡‘åºŠ <anvil@jumperz.net> http://www.jumperz.net/ â– ã¯ã˜ã‚ã« ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºè€…ã®ç«‹å ´ã‹ã‚‰è¦‹ãŸCSRFå¯¾ç–ã«ã¤ã„ã¦ã€ã•ã¾ã–ã¾ãªæƒ…å ±ãŒå…¥ã‚Šä¹±ã‚Œã¦ã„ã‚‹ã€‚ç†è€…ãŒ2006å¹´3æœˆã®æ™‚ç‚¹ã«ãŠã„ã¦å›½å†…ã®ã‚¦ã‚§ãƒ–ã‚µ ã‚¤ãƒˆã‚„ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿æ›¸ç±ãƒ»é›‘èªŒãªã©ã§CSRFå¯¾ç–ã«ã¤ã„ã¦æ›¸ã‹ã‚Œã¦ã„ã‚‹è¨˜äº‹ã‚’èª¿ã¹ãŸçµæžœã€ãŠã©ã‚ãã¹ãã“ã¨ã«ã€ãã®ã»ã¨ã‚“ã©ãŒèª¤ã‚Šã‚’å«ã‚“ã§ã„ãŸã‚Šã€ç¾å®Ÿçš„ ã«ã¯ä½¿ç”¨ã§ããªã„æ–¹æ³•ã‚’ç´¹ä»‹ã—ãŸã‚Šã—ã¦ã„ãŸã€‚ãã“ã§æœ¬ç¨¿ã§ã¯ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºè€…ã«ã¨ã£ã¦ã®æœ¬å½“ã«æ£ã—ã„CSRFå¯¾ç–ã«ã¤ã„ã¦ã¾ã¨ã‚ã‚‹ã“ã¨ã¨ã™ ã‚‹ã€‚ã¾ãŸã€æŽ¡ç”¨ã™ã¹ãã§ãªã„CSRFå¯¾ç–ã¨ãã®ç†ç”±ã‚‚åˆã‚ã›ã¦ç´¹ä»‹ã™ã‚‹ã€‚ â– ã‚ã‚‰ã‚†ã‚‹æ©Ÿèƒ½ãŒã‚¿ãƒ¼ã‚²ãƒƒãƒˆã¨ãªã‚Šã†ã‚‹ ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®æŒã¤å…¨ã¦ã®æ©Ÿèƒ½ãŒCSRFæ”»æ’ƒã®å¯¾è±¡ã¨ãªã‚Šã†ã‚‹ã€‚ã¾ãšã“ã®ã“ã¨ã‚’èªè˜ã—ã¦ãŠãå¿…è¦ãŒã‚ã‚‹ã€‚ Amaz
potappo 2006/03/31
web2.0æ™‚ä»£ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€‚

csrf

security

web2.0

webdev

0ã‚ã¨ã§èªã‚€

XSS

webservice

WebUI

ie

reference
ãƒªãƒ³ã‚¯
1