[B! xss][jwt] takaesuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

takaesu id:takaesu

xssã¨jwtã«é–¢ã™ã‚‹takaesuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

JWT èªè¨¼ã®ãƒ¡ãƒªãƒƒãƒˆã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒˆãƒ¬ãƒ¼ãƒ‰ã‚ªãƒ•ã®ç§æ„Ÿ - ..ãŸã‚Œã‚ã..
2020/5/9è¿½è¨˜: è€ƒãˆãŸçµæžœã€Authorization Bearer ãƒ˜ãƒƒãƒ€ã‚’ä½¿ã£ãŸæ£è¦ã®JWTã®å ´åˆã€åŒä¸€ãƒ‰ãƒ¡ã‚¤ãƒ³ä¸‹ã§èªã¿è¾¼ã‚€å…¨ JavaScript ãŒä¿¡ç”¨ã§ãã‚‹å ´åˆã§ãªã„ã¨ãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§å®‰å…¨ã«ãƒˆãƒ¼ã‚¯ãƒ³ã‚’ä¿æŒã§ããªã„ã®ã§ãƒ–ãƒ©ã‚¦ã‚¶ã‹ã‚‰ã®APIã‚¢ã‚¯ã‚»ã‚¹æ™‚ã®èªè¨¼ç”¨ã«ã¯ä½¿ã†ã¹ãã§ã¯ãªã„ã¨ã„ã†ã¨ã“ã‚ã«ç€é™¸ã—ã¾ã—ãŸã€‚ãƒ–ãƒ©ã‚¦ã‚¶ã‹ã‚‰ã®ã‚¢ã‚¯ã‚»ã‚¹ã§ã¯ http only cookie ã«ãƒˆãƒ¼ã‚¯ãƒ³ã‚’å…¥ã‚Œã€ CSRF å¯¾ç–ã‚‚å¿˜ã‚Œãšã«ã¨ã„ã†ã“ã‚Œã¾ã§é€šã‚Šã®å®šçŸ³ãŒæ‰‹å …ã„ã‚ˆã†ã«æ€ã„ã¾ã™ã€‚ JWTã‚’ä½¿ã†ã®ã¯ãƒˆãƒ¼ã‚¯ãƒ³ã®å®‰å…¨ãªä¿ç®¡ãŒã§ãã‚‹éžãƒ–ãƒ©ã‚¦ã‚¶ãªãƒã‚¤ãƒ†ã‚£ãƒ–ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‹ã‚‰ã®APIã‚¢ã‚¯ã‚»ã‚¹æ™‚ã«é™ã£ãŸæ–¹ãŒã‚ˆã•ãã†ã§ã™ã€‚ APIã‚µãƒ¼ãƒå´ã§ã¯ã‚¢ã‚¯ã‚»ã‚¹å…ƒã«åˆã‚ã›ã¦èªè¨¼æ–¹æ³•ã‚’ä½¿ã„åˆ†ã‘ã‚‹ä¸¡å¯¾å¿œãŒè¦æ±‚ã•ã‚Œã‚‹ã®ã§æ‰‹é–“ã¯å¢—ãˆã¾ã™ãŒæ‰‹æŠœãã§ãã‚‹å ´æ‰€ã§ã‚‚ãªã„ã®ã§ä»•æ–¹ãªã—ã¨ã€‚ React(SPA)ã§ã®èªè¨¼ã«ã¤ã„ã¦ã¾ã¨ã‚ - ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®æœ¬
takaesu 2019/01/18
jwt

ã‚»ãƒƒã‚·ãƒ§ãƒ³

javascript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

xss

security

èªè¨¼

èªå¯
ãƒªãƒ³ã‚¯
Refresh Tokenï¼š ã©ã®ã‚ˆã†ãªå ´åˆã«ä½¿ç”¨ã—ã€ã©ã®ã‚ˆã†ã« JWT ã¨ç›¸äº’ä½œç”¨ã™ã‚‹ã‹
Auth0 Marketplace Discover and enable the integrations you need to solve identity Explore Auth0 Marketplace æœ¬æ›¸ã§ã¯ OAuth2 ã§å®šç¾©ã•ã‚ŒãŸRefresh Tokenã®æ¦‚å¿µã«ã¤ã„ã¦å¦ã³ã¾ã™ã€‚ã¾ãŸã€Refresh Tokenã¨ä»–ã®ãƒˆãƒ¼ã‚¯ãƒ³ã‚¿ã‚¤ãƒ—ã‚’æ¯”è¼ƒã—ã¦ã€ãã®ç†ç”±ã¨æ–¹æ³•ã‚’å¦ã³ã¾ã™ã€‚ã•ã‚‰ã«ã€ç°¡å˜ãªä¾‹ã‚’ä½¿ã£ã¦Refresh Tokenã®ä½¿ã„æ–¹ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ãã‚Œã§ã¯ã€å§‹ã‚ã¾ã—ã‚‡ã†ï¼ æ›´æ–°ï¼š æœ¬æ›¸ã‚’æ›¸ã„ãŸæ™‚ç‚¹ã§ã¯ã€Auth0 ã¯ OpenID Connect èªè¨¼ã‚’å–å¾—ã—ã¦ã„ã¾ã›ã‚“ã§ã—ãŸã€‚æœ¬æ›¸ã§ã¯ access token ã®ã‚ˆã†ãªç”¨èªžã®ä¸€éƒ¨ã¯æœ¬ä»•æ§˜ã«æº–æ‹ ã—ã¾ã›ã‚“ãŒã€ OAuth2 ä»•æ§˜ã«ã¯æº–æ‹ ã—ã¦ã„ã¾ã™ã€‚OpenID Connect ã¯ access token ï¼ˆAuthoriz
takaesu 2019/01/18
jwt

ã‚»ãƒƒã‚·ãƒ§ãƒ³

javascript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

xss

security

èªè¨¼

èªå¯
ãƒªãƒ³ã‚¯
JWTèªè¨¼ã€ä¾¿åˆ©ã‚„ã‚“ï¼Ÿ - ãƒ–ãƒã‚°
ã©ã†ã—ã¦ JWT ã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«ä½¿ã£ã¡ã‚ƒã†ã‚ã‘ï¼Ÿ - co3k.orgã€€ã«å¯¾ã—ã¦æ€ã†ã“ã¨ã‚’æ›¸ãã€‚ (ã‚¹ãƒ†ãƒ¼ãƒˆãƒ¬ã‚¹ãª) JWT ã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«ä½¿ã†ã“ã¨ã¯ã€ã‚»ãƒƒã‚·ãƒ§ãƒ³ ID ã‚’ç”¨ã„ã‚‹ä¼çµ±çš„ãªã‚»ãƒƒã‚·ãƒ§ãƒ³æ©Ÿæ§‹ã«æ¯”ã¹ã¦ã€ã‚ã‚‰ã‚†ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®ãƒªã‚¹ã‚¯ã‚’è² ã†ã“ã¨ã«ãªã‚Šã¾ã™ã€‚ ã¨å¤§å£å©ã„ã¦ãŠã„ã¦ã€ãã‚Œã«ç¶šãç†ç”±ãŒã»ã¨ã‚“ã©ãŠç²—æœ«ãªé‹ç”¨ã«ã‚ˆã‚‹ã‚‚ã®ãªã®ã¯ã©ã†ãªã®ã‹ã€‚æœ€å¾Œã«ã€ ã§ã‚‚ãã“ã¾ã§ã—ã¦ã‚¹ãƒ†ãƒ¼ãƒˆãƒ¬ã‚¹ã« JWT ã‚’ä½¿ã‚ãªãã¦ã¯ã„ã‘ãªã„ã‹ï¼Ÿ ã¨ã¾ã§è¡Œã£ã¦ã„ã¾ã™ãŒã€JWTèªè¨¼ã®ãƒ¡ãƒªãƒƒãƒˆã¯ãã®å®Ÿè£…ã®ã‚·ãƒ³ãƒ—ãƒ«ã•ã¨ã‚¹ãƒ†ãƒ¼ãƒˆãƒ¬ã‚¹ãªã“ã¨ã«ã‚ã‚Šã¾ã™ã€‚ç¾å®Ÿçš„ã«ã¯å®Ÿéš›ã¯DBå‚ç…§ã¨ã‹å¿…è¦ã«ãªã£ãŸã‚Šã™ã‚‹ã‚“ã§ã™ãŒã€ã»ã¨ã‚“ã©æ”¹ã–ã‚“æ¤œè¨¼ã ã‘ã§æ¸ˆã‚€ã®ã¯é…åŠ›çš„ã§ã™ã€‚ãƒˆãƒ¬ãƒ¼ãƒ‰ã‚ªãƒ•ã§ãƒªã‚¢ãƒ«ã‚¿ã‚¤ãƒ ã§ãƒ¦ãƒ¼ã‚¶ãƒ¼ç„¡åŠ¹åŒ–ãŒã§ããªã„ã“ã¨ãã‚‰ã„ã§ã™ã‹ãã€‚ãƒ©ã‚¤ãƒ–ãƒ©ãƒªãªã‚“ã¦ä½¿ã†å¿…è¦ãªã„ã»ã©ã‚·ãƒ³ãƒ—ãƒ«ã ã—ã€ãƒˆãƒ¬ãƒ¼ãƒ‰ã‚ªãƒ•ã•ãˆè¨±å®¹ã§ãã‚Œã°ã‚€ã—ã‚ã€ãªãœã“ã‚Œä»¥ä¸Šã«è¤‡é›‘ãªèªè¨¼
takaesu 2019/01/18
JWTã®æœ‰åŠ¹ãªéƒ¨åˆ†

jwt

ã‚»ãƒƒã‚·ãƒ§ãƒ³

javascript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

xss

security

èªè¨¼

èªå¯
ãƒªãƒ³ã‚¯
ã©ã†ã—ã¦ JWT ã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«ä½¿ã£ã¡ã‚ƒã†ã‚ã‘ï¼Ÿ - co3k.org
å‚™è€ƒ 2018/09/21 22:15 è¿½è¨˜ 2018/09/20 12:10 ã«å…¬é–‹ã—ãŸã€Œã©ã†ã—ã¦ JWT ã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«ä½¿ã£ã¡ã‚ƒã†ã‚ã‘ï¼Ÿã€ã¨ã„ã†ã‚¿ã‚¤ãƒˆãƒ«ãŒä¸é©åˆ‡ã ã¨ã”æŒ‡æ‘˜ã‚’ã„ãŸã ã„ã¦ã„ã¾ã™ã€‚ ãã®æ„è¦‹ã¯ã‚‚ã£ã¨ã‚‚ã ã¨æ€ã„ã¾ã™ã®ã§ã€ç¾åœ¨ã€é©åˆ‡ã¨ãªã‚‹ã‚ˆã†ã«ã‚¿ã‚¤ãƒˆãƒ«ã‚’èª¿æ•´ã—ã¦ã„ã¾ã™ã€‚ ã”è¿·æƒ‘ãŠã‚ˆã³ãŠé¨’ãŒã›ã‚’ã—ã¦å¤§å¤‰ç”³ã—è¨³ã”ã–ã„ã¾ã›ã‚“ã€‚ æœ¬æ–‡ã®è¡¨ç¾ã«ã¤ã„ã¦ã‚‚æ”¹å–„ã®ä½™åœ°ã¯å¤§ã„ã«ã‚ã‚Šãã†ã§ã™ãŒã€ã“ã¡ã‚‰ã¯ (ã™ã§ã«ã”æ„è¦‹ã‚’é ‚æˆ´ã—ã¦ã„ã‚‹é–¢ä¿‚ã§ã€) ä¸»å¼µãŒå¤‰ã‚ã£ã¦ã—ã¾ã‚ãªã„ã‚ˆã†ã«é…æ…®ã—ã¤ã¤æ…Žé‡ã«èª¿æ•´ã•ã›ã¦ã„ãŸã ãã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ ã¯ã‚ã‚ã‚ã€œã€œã€œã€œé ¼ã‚€ã‹ã‚‰ã“ã¡ã‚‰ã‚‚å¿™ã—ã„ã®ã§ã“ã‚“ãªã‚¨ãƒ³ãƒˆãƒªã‚’æ›¸ã‹ã›ãªã„ã§ã»ã—ã„ (æŒ¨æ‹¶)ã€‚ã‚‚ã—ãã¯åƒ•ã‚’æš‡ã«ã—ã¦ã“ã†ã„ã†ã‚¨ãƒ³ãƒˆãƒªã‚’æ›¸ã‹ã›ã‚‹ãŸã‚ã®ãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼ã‚’å‹Ÿé›†ã—ã¦ã„ã¾ã™ (æŒ¨æ‹¶)ã€‚ JWT (JSON Web Token; RFC 7519) ã‚’å……åˆ†ãªãƒªã‚¹ã‚¯ã®è¦‹ç©ã‚‚ã‚Šã‚’ã›ãšã‚»ãƒƒã‚·
takaesu 2019/01/18
jwt

ã‚»ãƒƒã‚·ãƒ§ãƒ³

javascript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

xss

security

èªè¨¼

èªå¯
ãƒªãƒ³ã‚¯
JWTã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã«è»¢ç”¨ã™ã‚‹ã®ã¯ã‚ã¾ã‚Šè‰¯ã„ã‚¢ã‚¤ãƒ‡ã‚¢ã§ã¯ãªã„(èªè¨¼ã ã‘ãªã‚‰ã„ã„ã‚ˆ) - id:anatooã®ãƒ–ãƒã‚°
ã©ã†ã—ã¦ãƒªã‚¹ã‚¯ã‚¢ã‚»ã‚¹ãƒ¡ãƒ³ãƒˆã›ãšã« JWT ã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«ä½¿ã£ã¡ã‚ƒã†ã‚ã‘ï¼Ÿ - co3k.org JWTèªè¨¼ã€ä¾¿åˆ©ã‚„ã‚“ï¼Ÿ - ãƒ–ãƒã‚° JWT èªè¨¼ã®ãƒ¡ãƒªãƒƒãƒˆã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒˆãƒ¬ãƒ¼ãƒ‰ã‚ªãƒ•ã®ç§æ„Ÿ - ..ãŸã‚Œã‚ã.. JWTã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ã«ä½¿ã†ã“ã¨ã«é–¢ã—ã¦æœ€è¿‘å°‘ã—è°è«–ãŒã‚ã£ãŸã®ã§ã€è‡ªåˆ†ã®ãŠæ°—æŒã¡ã‚’è¡¨æ˜Žã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ ç§ã¯ä»¥å‰SPAã‚’æ›¸ãæ™‚ã«JWTã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã«ä½¿ãŠã†ã¨ã—ãŸã“ã¨ãŒã‚ã‚Šã¾ã—ãŸãŒã€ä»”ç´°ã«æ¤œè¨Žã—ã¦ã„ãã¨JWTã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã«ä½¿ã†ã®ã¯ç„¡æ„å‘³ã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®ãƒªã‚¹ã‚¯ã‚’å¢—ã‚„ã™ã ã‘ã§ã€ä¼çµ±çš„ãªã‚¯ãƒƒã‚ãƒ¼ã‚’ä½¿ã£ãŸã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã‚’ä½¿ã£ãŸæ–¹ãŒè‰¯ã„ã¨ã„ã†çµè«–ã«è‡³ã‚Šã¾ã—ãŸã€‚ å‰æã‚’æ•´ç†ã™ã‚‹ãŸã‚ã«ã‚ã‚‰ã‹ã˜ã‚å‰ç½®ãã™ã‚‹ã¨ã€ã€ŒJWTã‚’ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã«ä½¿ã†ã€ã¨ã„ã†ã®ã¯èªè¨¼APIãªã©ã§è¿”ã£ã¦ããŸJWTã‚’localstorageãªã©JavaScriptã‹ã‚‰ã‚¢ã‚¯ã‚»ã‚¹ã§ãã‚‹ã‚¹ãƒˆãƒ¬ãƒ¼ã‚¸ã«ä¿ç®¡ã—ã¦ãŠã„ã¦ã€ajaxã§ã‚µãƒ¼ãƒ
takaesu 2019/01/18
jwt

ã‚»ãƒƒã‚·ãƒ§ãƒ³

javascript

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

xss

security

èªè¨¼

èªå¯
ãƒªãƒ³ã‚¯
1