[B! csrf] teppeisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

teppeis id:teppeis

csrfã«é–¢ã™ã‚‹teppeisã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (37)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ä»¤å’Œæ™‚ä»£ã® API å®Ÿè£…ã®ãƒ™ãƒ¼ã‚¹ãƒ—ãƒ©ã‚¯ãƒ†ã‚£ã‚¹ã¨ CSRF å¯¾ç– | blog.jxck.io
Intro CSRF ã¨ã„ã†å¤ã®æ”»æ’ƒãŒã‚ã‚‹ã€‚ã“ã®æ”»æ’ƒã‚’ã€Œå¤(ã„ã«ã—ãˆ)ã€ã®ã‚‚ã®ã«ã™ã‚‹ã“ã¨ãŒã§ããŸãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã®é€²åŒ–ã®èƒŒæ™¯ã‚’ã€ã€ŒCookie ãŒ SameSite Lax by Default ã«ãªã£ãŸã‹ã‚‰ã ã€ã¨ã„ã†è§£èª¬ã‚’è¦‹ã‚‹ã“ã¨ãŒã‚ã‚‹ã€‚ ç¢ºã‹ã«ã€ç¾å®Ÿçš„ã«ãã‚Œã«ã‚ˆã£ã¦æ”»æ’ƒã®æˆç«‹ã¯é›£ã—ããªã‚Šã€æ•‘ã‚ã‚Œã¦ã„ã‚‹ã‚µãƒ¼ãƒ“ã‚¹ã‚‚ã‚ã‚‹ã€‚ã—ã‹ã—ã€ãã‚Œã¯ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ãŒç”¨æ„ã—ãŸå¯¾ç–ã®æœ¬è³ªã‹ã‚‰è¨€ã†ã¨ã€è§£é‡ˆãŒå°‘ã—ãšã‚Œã¦ã„ã‚‹ã¨è¨€ãˆã‚‹ã ã‚ã†ã€‚ ä»Šå›žã¯ã€ã€ŒCSRF ãŒã©ã†ã—ã¦æˆç«‹ã—ã¦ã„ãŸã®ã‹ã€ã‚’æŒ¯ã‚Šè¿”ã‚‹ã“ã¨ã§ã€æœ¬å½“ã«ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ã«è¶³ã‚Šã¦ã„ãªã‹ã£ãŸã‚‚ã®ã¨ã€ãã‚Œã‚’è£œã£ã¦ã„ã£ãŸçµŒç·¯ã€æœ¬å½“ã«ã™ã¹ãå¯¾ç–ã¯ä½•ã§ã‚ã‚‹ã‹ã‚’è§£èª¬ã—ã¦ã„ãã€‚ çµæžœã¨ã—ã¦è¦‹ãˆã¦ãã‚‹ã®ã¯ã€ä»Šã‚µãƒ¼ãƒ“ã‚¹ã‚’å®Ÿè£…ã™ã‚‹ä¸Šã§ã®ã€Œãƒ™ãƒ¼ã‚¹ã€(not ãƒ™ã‚¹ãƒˆ)ã¨ãªã‚‹ãƒ—ãƒ©ã‚¯ãƒ†ã‚£ã‚¹ã ã¨ç†è€…ã¯è€ƒãˆã¦ã„ã‚‹ã€‚ CSRF æˆç«‹ã®æ¡ä»¶ ä¾‹ãˆã°ã€æ”»æ’ƒè€…ãŒç”¨æ„ã—ãŸ attack.examp
teppeis 2024/04/26
ãƒŸãƒ‰ãƒ«ã‚¦ã‚§ã‚¢ã€if(POST) ã˜ã‚ƒãªãã¦ã€if (!(GET or HEAD)) ã®æ–¹ãŒè‰¯ã„ã®ã§ã¯

csrf

cookie

security
ãƒªãƒ³ã‚¯
CSRF å¯¾ç–ã¯ã„ã¾ã ã« Token ãŒå¿…é ˆãªã®ã‹?
CSRF å¯¾ç–ã¯ One Time Token ã‚’ form ãªã‚Šã«ä»˜ä¸Žã—ã¦ã€ã‚µãƒ¼ãƒå´ã§ãƒã‚§ãƒƒã‚¯ã™ã‚Œã°è‰¯ã„ã€‚ ãã‚Œã‚’ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§ã‚µãƒãƒ¼ãƒˆã—ã¦ã‚‹ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ãªã©ã‚‚ã‚ã‚‹ã—ã€ãªãã¦ã‚‚ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã§ã„ãã‚‰ã§ã‚‚å¯¾å¿œã§ãã‚‹ã€‚ ã©ã†ã›å®Œå…¨ã«ã‚¹ãƒ†ãƒ¼ãƒˆãƒ¬ã‚¹ãªã‚µãƒ¼ãƒ“ã‚¹ã¯ãªã‹ãªã‹ãªã„ã®ã§ã€ã‚µãƒ¼ãƒå´ã« redis ã‚„ memcache ã‚’ç”¨æ„ã™ã‚‹ã®ã‚‚åˆ¥ã«å¤§å¤‰ã˜ã‚ƒãªã„ã€‚ ãªã®ã§ã€ CSRF å¯¾ç–ã¨ã—ã¦ Token ã‚’ä»˜ä¸Žã™ã‚‹ã®ã¯ã€æœ€ã‚‚å®‰å…¨ã§æŽ¨å¥¨ã§ãã‚‹æ–¹å¼ã§ã¯ã‚ã‚‹ã€‚ ã£ã¦ã„ã†ã®ã‚’è¸ã¾ãˆãŸä¸Šã§ã€ã‚‚ã† SameSite=Lax ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã ã‘ã©ã€ä»Šã§ã‚‚ Token å¿…é ˆãªã®ï¼Ÿã¿ãŸã„ãªã®ãŒãŸã³ãŸã³è©±ã«å‡ºã‚‹ã®ã§ã€ã„ã„åŠ æ¸›ã¾ã¨ã‚ã‚‹ã€‚ å‰æ ã“ã®è©±ã¯ã€ã‚¹ã‚³ãƒ¼ãƒ—ãŒã©ã“ãªã®ã‹ã«ã‚ˆã£ã¦è©±ãŒå¤šå°‘å¤‰ã‚ã‚‹ã®ã§ã€ãã“ã‚’çµžã‚‹ã€‚ ä»Šå›žã¯ Passive ã§ã¯ãªã Active ã«å¯¾ç–ã—ã¦ã„ãå ´åˆã‚’è€ƒãˆã‚‹ã®ã§ã€å‰æã‚’ã“ã†ã™ã‚‹ã€‚ SameSite=l
teppeis 2024/01/19
è„†å¼±æ€§å¯¾ç–ã§å¤ã„ç’°å¢ƒã‚’è€ƒæ…®ã™ã‚‹ã‹ã¯å„ã‚µãƒ¼ãƒ“ã‚¹ã§åˆ¤æ–ã™ã‚‹ã“ã¨ã€‚ä¾‹ãˆã°IEã§ãƒã‚°ã‚¤ãƒ³ã‚‚ã§ããªã„ã‚ˆã†ãªã‚µãƒ¼ãƒ“ã‚¹ãŒCSRFå¯¾ç–ã ã‘IEè€ƒæ…®ã™ã‚‹æ„å‘³ãªã„ã‚ˆã

csrf

security

cookie
ãƒªãƒ³ã‚¯
CVE-2023-45857 (CWE-359) XSRF-TOKEN value is disclosed to an unauthorised actor Â· Issue #6006 Â· axios/axios
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
teppeis 2023/10/27
axios

csrf

vulnerability

security
ãƒªãƒ³ã‚¯
ä»Šæ™‚ã® CSRF å¯¾ç–ã£ã¦ãªã«ã‚’ã™ã‚Œã°ã„ã„ã®ï¼Ÿ | Basicinc Enjoy Hacking!
ã“ã‚“ã«ã¡ã¯ @zaru ã§ã™ã€‚ä»Šå›žã¯æ˜”ã‹ã‚‰ã‚ã‚‹ CSRF (ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ»ãƒ•ã‚©ãƒ¼ã‚¸ã‚§ãƒª) ã®ä»Šæ™‚ã®å¯¾ç–ã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ã‚‚ã—ã€è¨˜äº‹ä¸ã«é–“é•ã„ãŒã‚ã‚Œã° @zaru ã¾ã§ DM ã‚‚ã—ãã¯ãƒ¡ãƒ³ã‚·ãƒ§ãƒ³ã‚’ãã ã•ã„ (ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ç´°ã‹ã„éƒ¨åˆ†ã«ã¤ã„ã¦ã®ç†è§£ãŒä¹ã—ã„â€¦) ã€‚ 2022/08/29 : å¾³ä¸¸ã•ã‚“ã‹ã‚‰ãƒ•ã‚£ãƒ¼ãƒ‰ãƒãƒƒã‚¯é ‚ã„ãŸå†…å®¹ã‚’åæ˜ ã—ã¾ã—ãŸã€‚å¾³ä¸¸ã•ã‚“ã€ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ï¼ èªè¨¼ã‚ã‚Šãƒ»ãªã—ã§å¯¾ç–æ–¹æ³•ãŒé•ã†ç‚¹ ãƒˆãƒ¼ã‚¯ãƒ³ç¢ºèªæ–¹å¼ã®ãƒ‡ãƒ¡ãƒªãƒƒãƒˆã®ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã«ã¤ã„ã¦ã®è¨€åŠã‚’å‰Šé™¤ã€ä»£ã‚ã‚Šã« Cookie æ”¹å¤‰ãƒªã‚¹ã‚¯ã‚’è¿½è¨˜ Cookie æ”¹ã–ã‚“å¯èƒ½æ€§ã«ã¤ã„ã¦å¾³ä¸¸ã•ã‚“ã®å‹•ç”»ãƒªãƒ³ã‚¯ã‚’è¿½è¨˜ SameSite å±žæ€§ã§é˜²ã’ãªã„å…·ä½“çš„ãªã‚±ãƒ¼ã‚¹ã‚’è¿½è¨˜ nginx èª¬æ˜ŽãŒé–¢ä¿‚ãªã‹ã£ãŸã®ã§å‰Šé™¤ ãã‚‚ãã‚‚ CSRF ã£ã¦ãªã«ï¼Ÿ æ˜”ã‹ã‚‰ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚’ã‚„ã£ã¦ã„ã‚‹æ–¹ã§ã‚ã‚Œã°ã€Œã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ã€ é¨’å‹•ã¨è¨€ãˆã°
teppeis 2022/08/31
csrf
ãƒªãƒ³ã‚¯
2022å¹´1æœˆã«ãŠã„ã¦CSRFæœªå¯¾ç–ã®ã‚µã‚¤ãƒˆã¯ã©ã®æ¡ä»¶ã§è¢«å®³ã‚’å—ã‘ã‚‹ã‹
ã‚µãƒžãƒª2020å¹´2æœˆã«Google Chromeã¯Cookieã®ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã®æŒ™å‹•ã‚’samesite=laxã«å¤‰æ›´ã—ã¾ã—ãŸãŒã€2022å¹´1æœˆ11æ—¥ã«Firefoxã‚‚åŒæ§˜ã®ä»•æ§˜ãŒå°Žå…¥ã•ã‚Œã¾ã—ãŸã€‚ã“ã®å¤‰æ›´ã¯ãƒ–ãƒ©ã‚¦ã‚¶å´ã§CSRFè„†å¼±æ€§ã‚’ç·©å’Œã™ã‚‹ãŸã‚ã®ã‚‚ã®ã§ã€ç‰¹å®šã®æ¡ä»¶ä¸‹ã§ã¯ã€ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆå´ã§CSRFå¯¾ç–ã‚’ã—ã¦ã„ãªãã¦ã‚‚CSRFæ”»æ’ƒã‚’å—ã‘ãªããªã‚Šã¾ã™ã€‚ã“ã®è¨˜äº‹ã§ã¯ã€ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆsamesite=laxã«ã¤ã„ã¦ã®åŸºç¤Žçš„ãªèª¬æ˜Žã«åŠ ãˆã€æœ€è¿‘ã®ãƒ–ãƒ©ã‚¦ã‚¶ã®æŒ™å‹•ã®é•ã„ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ ï¼ˆ2022å¹´1æœˆ29æ—¥è¿½è¨˜ï¼‰ æœ¬æ—¥ç¢ºèªã—ãŸã¨ã“ã‚ã€Firefoxã«ãŠã‘ã‚‹ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆsamesite=laxã¯ã‚ãƒ£ãƒ³ã‚»ãƒ«ã•ã‚Œã€å¾“æ¥ã®æŒ™å‹•ã«æˆ»ã£ãŸã‚ˆã†ã§ã™ï¼ˆFirefox 96.0.3ã«ã¦ç¢ºèªï¼‰ã€‚ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆsamesite=laxè‡ªä½“ã¯å…ˆè¡Œã—ã¦Google Chromeã«ã¦å®Ÿè£…ã•ã‚Œã¦ã„ã¾ã—ãŸãŒã€ç´°ã‹ã„æŒ™å‹•ã®å·®ç•°ã§æ—¢å˜ã‚µã‚¤ãƒˆã«ä¸å…·åˆãŒ
teppeis 2022/01/30
browser

csrf

cookie
ãƒªãƒ³ã‚¯
Building Secure JavaScript Applications
Building Secure JavaScript Applications A few weeks back, I've attended SFNode, where Randall Degges gave a presentation on JWTs, mostly on why you avoid using them. The talk was amazing, and also reminded me of an article I wanted to write for a long time now - how one can build secure JavaScript applications. Here we go! In this article, I will go through the most frequently asked question about
teppeis 2018/01/19
jwt

security

auth

csrf

xss

atode
ãƒªãƒ³ã‚¯
OWASP Top 10 Lists are Art, Not Science
I attended the OWASP Top 10 data capture discussion session today at #OWASPSummit2017 in London. Andrew van der Stock lead the session and was asking how we could improve the data collection process, and what we thought the obstacles were to people submitting their data. My answer was that the drama around OWASP â€œdataâ€ collection comes from we project leaders perpetuating the false belief that wha
teppeis 2017/12/01
csrf

owasp

security
ãƒªãƒ³ã‚¯
ã•ã‚ˆãªã‚‰CSRF(?) 2017
ã¯ã˜ã‚ã« 2017å¹´ã€ã¤ã„ã«OWASP Top 10ãŒæ›´æ–°ã•ã‚Œã¾ã—ãŸã€‚ç†è€…ãŒä¸€ç•ªå°è±¡çš„ã ã£ãŸã®ã¯ã€ŒTop 10ã«CSRFãŒå…¥ã£ã¦ã„ãªã„ã€ã¨ã„ã†ã“ã¨ã§ã™ã€‚ ãªãœCSRFãŒåœå¤–ã«ãªã£ã¦ã—ã¾ã£ãŸã®ã‹ã¯4ãƒšãƒ¼ã‚¸ã®ãƒªãƒªãƒ¼ã‚¹ãƒŽãƒ¼ãƒˆã§è»½ãèª¬æ˜Žã•ã‚Œã¦ã„ã¾ã™ã€‚ã€Œretired, but not forgottenã€ã¤ã¾ã‚Šã€Œå¼•é€€ã—ãŸã...ã§ã‚‚å›ã®äº‹ã¯å¿˜ã‚Œã¦ãªã„ã‚ˆã€ã¨ã„ã†æ„Ÿã˜ã§ã—ã‚‡ã†ã‹ã€‚å…¨ç±³ãŒCSRFã®ãŸã‚ã«æ³£ããã†ã§ã™ã€‚ ãã‚Œã¯ã•ã¦ãŠãã€å…·ä½“çš„ã«ã¯ã€Œas many frameworks include CSRF defenses, it was found in only 5% of applications.ã€ã¨ã„ã†éƒ¨åˆ†ãŒå¼•é€€ç†ç”±ã ã¨æ€ã‚ã‚Œã¾ã™ã€‚ã€Œå¤šãã®ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ãŒCSRFå¯¾ç–ã‚’å‚™ãˆãŸçµæžœã€5%ã®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ã—ã‹CSRFã¯è¦‹ã¤ã‹ã‚‰ãªã‹ã£ãŸã€ã¨ã„ã†ã®ãŒå¼•é€€ã®ç†ç”±ã§ã™ã€‚ ã“ã®ç†ç”±ã‚’èªã‚€ã¨ã€ã€Œã¨ã„ã†ã“
teppeis 2017/11/30
csrf
ãƒªãƒ³ã‚¯
Railsã®CSRFä¿è·ã‚’è©³ã—ãèª¿ã¹ã¦ã¿ãŸï¼ˆç¿»è¨³ï¼‰ï½œTechRacho by BPSæ ªå¼ä¼šç¤¾
æ¦‚è¦ åŽŸè‘—è€…ã®è¨±è«¾ã‚’å¾—ã¦ç¿»è¨³ãƒ»å…¬é–‹ã„ãŸã—ã¾ã™ã€‚ è‹±èªžè¨˜äº‹: A Deep Dive into CSRF Protection in Rails å…¬é–‹æ—¥: 2017/07/31 è‘—è€…: Alex Taylor ã‚µã‚¤ãƒˆ: Ruby Inside 2017/10/23: åˆç‰ˆå…¬é–‹ 2021/11/26: æ›´æ–° ç¾åœ¨Railsã‚’ä½¿ã£ã¦ã„ã‚Œã°CSRFä¿è·ã‚’ä½¿ã†ã“ã¨ãŒã‚ã‚‹ã§ã—ã‚‡ã†ã€‚ã“ã®æ©Ÿèƒ½ã¯Railsã®ã»ã¼åˆæœŸã‹ã‚‰å˜åœ¨ã—ã€å³åº§ã«å°Žå…¥ã—ã¦é–‹ç™ºã‚’æ¥½ã«ã§ãã‚‹Railsã®æ©Ÿèƒ½ã®ã²ã¨ã¤ã§ã™ã€‚ CSRFï¼ˆCross-Site Request Forgeryï¼‰ã‚’ç°¡å˜ã«èª¬æ˜Žã™ã‚‹ã¨ã€æ‚ªæ„ã®ã‚ã‚‹ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒã‚µãƒ¼ãƒãƒ¼ã¸ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’æé€ ã—ã¦æ£å½“ãªã‚‚ã®ã«è¦‹ã›ã‹ã‘ã€èªè¨¼æ¸ˆã¿ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’è£…ã†ã¨ã„ã†æ”»æ’ƒæ‰‹æ³•ã§ã™ã€‚Railsã§ã¯ã€ä¸€æ„ã®ãƒˆãƒ¼ã‚¯ãƒ³ã‚’ç”Ÿæˆã—ã¦é€ä¿¡ã®ãŸã³ã«çœŸæ£æ€§ã‚’ç¢ºèªã™ã‚‹ã“ã¨ã§ã“ã®ç¨®ã®æ”»æ’ƒã‹ã‚‰ä¿è·ã—ã¾ã™ã€‚ æœ€è¿‘ç§ãŒUnboun
teppeis 2017/10/23
rails

csrf
ãƒªãƒ³ã‚¯
Angular 4.3ã§è¿½åŠ ã•ã‚ŒãŸHttpClientModuleã«ã¤ã„ã¦ã®ãƒ¡ãƒ¢ - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article?
teppeis 2017/07/19
ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§JSONãƒ‘ãƒ¼ã‚¹ã€ãƒ¬ã‚¹ãƒãƒ³ã‚¹åž‹ã®æŒ‡å®šã€interceptorå¯¾å¿œã€progress event, CSRFå¯¾å¿œãªã©

angular

http

csrf
ãƒªãƒ³ã‚¯
Cross-Site Request Forgery Prevention - OWASP Cheat Sheet Series
Introduction Index Alphabetical Index ASVS Index MASVS Index Proactive Controls Index Top 10 Cheatsheets Cross-Site Request Forgery Prevention Cheat SheetÂ¶ IntroductionÂ¶ A Cross-Site Request Forgery (CSRF) attack occurs when a malicious web site, em ail, blog, instant message, or program tricks an authenticated user's web browser into performing an unwanted action on a trusted site. If a target use
teppeis 2017/06/16
csrf

security

owasp
ãƒªãƒ³ã‚¯
Using CORS policies to implement CSRF protection | Mixmax
June 13, 2017 Using CORS policies to implement CSRF protection This post is a follow-on to our CORS post back in December. We'll describe how traditional CORS policies aren't sufficient defense against cross-site request forgery (CSRF) attacks, and unveil a new Node module that layers CSRF protection on top of such policies, cors-gate. We'll show how an Origin-based approach has fewer moving parts
teppeis 2017/06/16
csrf

cors

xhr
ãƒªãƒ³ã‚¯
159464 â€“ Implement Same-Site cookies
teppeis 2017/02/21
https://scotthelme.co.uk/csrf-is-dead/

webkit

issue

cookie

csrf
ãƒªãƒ³ã‚¯
795346 - (samesite-cookies) Add SameSite support for cookies
Shared components used by Firefox and other Mozilla software, including handling of Web content; Gecko, HTML, CSS, layout, DOM, scripts, images, networking, etc. Issues with web page layout probably go here, while Firefox user interface issues belong in the Firefox product. (More info)
teppeis 2017/02/21
https://scotthelme.co.uk/csrf-is-dead/

cookie

csrf
ãƒªãƒ³ã‚¯
Cross-Site Request Forgery is dead!
Scott Helme Security researcher, entrepreneur and international speaker who specialises in web techno logies. More posts by Scott Helme. After toiling with Cross-Site Request Forgery on the web for, well forever really, we finally have a proper solution. No technical burden on the site owner, no difficult implementation, it's trivially simple to deploy, it's Same-Site Cookies. As old as the Web its
teppeis 2017/02/21
SameSite Cookieã‚’ä½¿ãˆã°CSRFå¯¾ç–ã§ãã‚‹ã®ã§ã¯ã€ã¨ã„ã†è©±ã€‚ãŸã ã—ç¾çŠ¶ã§ã¯Chromeé™å®š

csrf

cookie
ãƒªãƒ³ã‚¯
CSRFãƒˆãƒ¼ã‚¯ãƒ³ ã‚¤ãƒ³ã‚¿ãƒ“ãƒ¥ãƒ¼ã‚º - Qiita
VAddyã¨CSRFãƒˆãƒ¼ã‚¯ãƒ³ VAddyã¯è„†å¼±æ€§è¨ºæ–ã‚’å®Ÿè¡Œã™ã‚‹éš›ã«ã€CSRFãƒˆãƒ¼ã‚¯ãƒ³ã‚’æœ€æ–°ã®ã‚‚ã®ã«æ›´æ–°ã—ãªãŒã‚‰å‹•ä½œã—ã¾ã™ã€‚ãã®ãŸã‚ã€Œã©ã®ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ãŒCSRFãƒˆãƒ¼ã‚¯ãƒ³ã‹ï¼Ÿã€ã‚’åˆ¤æ–ã™ã‚‹ãƒã‚¸ãƒƒã‚¯ãŒå˜åœ¨ã—ã¦ã„ã¾ã™ã€‚æœ€è¿‘ã‚ã‚‹ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ï¼ˆå¾Œè¿°ï¼‰ã«ã¤ã„ã¦ã€ŒCSRFãƒˆãƒ¼ã‚¯ãƒ³ã‚’æ£ã—ãèªè˜ã§ããªã„ã€ã¨ã„ã†ãƒã‚°ã‚’ä¿®æ£ã—ãŸã®ã§ã™ãŒã€è‰¯ã„æ©Ÿä¼šãªã®ã§ãƒ¡ã‚¸ãƒ£ãƒ¼ãªãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã‚„CMSã‚’ä¸å¿ƒã«CSRFãƒˆãƒ¼ã‚¯ãƒ³ã®å®Ÿè£…ã‚’ã–ã£ã¨è¿½ã£ã¦ã¿ã¾ã—ãŸã€‚ä¸€è¦§ã«ã—ã¦ã‚‚é¢ç™½ããªã„ã®ã§ã€ä»®æƒ³ã‚¤ãƒ³ã‚¿ãƒ“ãƒ¥ãƒ¼å½¢å¼ã«ã¾ã¨ã‚ã¦ã‚ã‚Šã¾ã™ã€‚GitHubä¸Šã§è»½ãè¿½ã£ãŸã‚‚ã®ãŒå¤šã„ã®ã§ã€æœ€æ–°ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ãªã‹ã£ãŸã‚Šã€è§£é‡ˆãŒé–“é•ã£ã¦ã„ã‚‹ç®‡æ‰€ãŒã‚ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ ãã‚Œã§ã¯ã€ã©ã†ãžã€‚ Ruby on Rails é‡‘åºŠ(ä»¥ä¸‹ã€é‡‘)ã€Œã“ã‚“ã«ã¡ã¯ã€‚ã‚ˆã†ã“ãã€‚ã€ RoRã€Œã“ã‚“ã«ã¡ã¯ã€ é‡‘ã€Œç›¸å¤‰ã‚ã‚‰ãšã‚·ã‚§ã‚¢é«˜ã„ã‚ˆã†ã§ã™ãã€‚ã€ RoRã€Œã¯ã„ã€ãŠã‹ã’ã•ã¾ã§ã€‚ã“ã®é–“ã¯ãƒ«ãƒžãƒ³24
teppeis 2016/12/22
csrf

rails
ãƒªãƒ³ã‚¯
Caching the Uncacheable: CSRF Security
Why FastlyProductsServicesSolutionsDevelopersPartnersResourcesPricing Caching the Uncacheable: CSRF SecurityCross-Site Request Forgery attacks are a risk for any web application that accepts user data. The best mitigation technique is to use an "authenticity token" that the server generates when building forms for the user and checks when the forms are submitted. Unfortunately, the presence of thi
teppeis 2016/12/11
CSRFãƒˆãƒ¼ã‚¯ãƒ³ã«ã‚ˆã‚‹ã‚ãƒ£ãƒƒã‚·ãƒ¥ç„¡åŠ¹ã‚’å›žé¿ã™ã‚‹æ–¹æ³• (2014)

csrf

performance

cache

cdn
ãƒªãƒ³ã‚¯
Edgeã®ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒãƒ¼å½è£…
ã€Œè„†å¼±æ€§"&'<<>\ Advent Calendar 2016ã€9æ—¥ç›®ã®è¨˜äº‹ã§ã™ã€‚ è¿½è¨˜ ------------------------------------------------------------- MSRCã‹ã‚‰ãƒŸã‚¹ã ã£ãŸã¨ã®ãƒ¡ãƒ¼ãƒ«ãŒã‚ã‚Šã¾ã—ãŸã€‚ ç„¡äº‹ã‚±ãƒ¼ã‚¹ãŒä½œã‚‰ã‚Œã€è„†å¼±æ€§ã¨ã—ã¦å¯¾å¿œã—ã¦ è²°ãˆã‚‹ã“ã¨ã«ãªã‚Šã¾ã—ãŸã€‚ ------------------------------------------------------------- å…ˆæ—¥Microsoftã«Edgeã®ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒãƒ¼å½è£…ã®ãƒã‚°ã‚’å ±å‘Šã—ãŸã¨ã“ã‚ã€è„†å¼±æ€§ã§ã¯ãªã„ã¨è¨€ã‚ã‚ŒãŸã®ã§å…¬é–‹ã—ã¾ã™ã€‚ ä»¥ä¸‹ãŒå†ç¾ã‚³ãƒ¼ãƒ‰ã§ã™ã€‚ãŸã å˜ã«é•·ã„URLã«ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã—ã¦ã‚ã’ã‚Œã°ã„ã„ã ã‘ã€‚ <a href="#" onclick="window.w=window.open('https://www.google.com');go()">g
teppeis 2016/12/10
edge

csrf

security
ãƒªãƒ³ã‚¯
XSSã‚„CSRFãƒªã‚¹ã‚¯ã‚’è»½æ¸›ã™ã‚‹ã€Entry Point Regulationã¨ã¯ - ASnoKaze blog
Entry Point Regulation ã¨ã¯ åå°„åž‹XSSãƒ»XSSIãƒ»CSRFã®ãƒªã‚¹ã‚¯ã‚’è»½æ¸›ã™ã‚‹ãƒ¦ãƒ¼ã‚¶ã‚¨ãƒ¼ã‚¸ã‚§ãƒ³ãƒˆä¸Šã®ä»•çµ„ã¿ã¨ã—ã¦ã€W3Cã§Entry Point Regulationã¨ã„ã†ä»•æ§˜ãŒç–å®šä¸ã§ã™ã€‚ Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®å£(Entry Point)ã«å¹¾ã¤ã‹ã®åˆ¶é™ã‚’ã‹ã‘ã‚‹ã“ã¨ãŒå‡ºæ¥ã¾ã™ã€‚åˆ¥ã‚ªãƒªã‚¸ãƒ³ã‹ã‚‰ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã®æ™‚ã«ã€ã‚¯ã‚¨ãƒªãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã‚„HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒœãƒ‡ã‚£(POSTãƒ¡ã‚½ãƒƒãƒ‰)ãŒä»˜ã„ã¦ã„ã‚Œã°ãƒ–ãƒãƒƒã‚¯ã™ã‚‹ã€ã¨è¨€ã£ãŸäº‹ãŒãƒžãƒ‹ãƒ•ã‚§ã‚¹ãƒˆã§æŒ‡ç¤ºã§ãã‚‹ã‚ˆã†ã«ãªã‚Šãã†ã§ã™ã€‚ EPRã«ãŠã‘ã‚‹ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚«ãƒ†ã‚´ãƒª å„ã‚¨ãƒ³ãƒ‰ãƒã‚¤ãƒ³ãƒˆ(URL)ã¯ã©ã®ã‚ˆã†ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’å—ã‘ä»˜ã‘ã‚‹ã“ã¨ãŒå¯èƒ½ã‹æŒ‡å®šã§ãã¾ã™ã€‚ãã®æ™‚ã«æŒ‡å®šã™ã‚‹ãƒªã‚¯ã‚¨ã‚¹ãƒˆã¯ä»¥ä¸‹ã«åˆ†é¡žã•ã‚Œã¾ã™ navigational requestï¼šcontext frame typeã¯"top-level", "auxiliary", "neste
teppeis 2015/10/27
atode

security

xss

csrf
ãƒªãƒ³ã‚¯
Cross-Site Request Forgeries and You
23 Sep 2008 Cross-Site Request Forgeries and You As the web becomes more and more pervasive, so do web-based security vulnerabilities. I talked a little bit about the most common web vulnerability, cross-site scripting, in Protecting Your Cookies: HttpOnly. Although XSS is incredibly dangerous, it's a fairly straightforward exploit to understand. Do not allow users to insert arbitrary HTML on your
teppeis 2015/02/02
csrf
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸