[B! security][http] uokadaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

uokada id:uokada

securityã¨httpã«é–¢ã™ã‚‹uokadaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (10)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

HTTP/2 Rapid Resetï¼šè¨˜éŒ²çš„ãªæ”»æ’ƒã‚’åˆ†è§£ã™ã‚‹(ç¿»è¨³è¨˜äº‹ï¼‰
ã“ã®è¨˜äº‹ã¯ä»¥ä¸‹ã®ãƒ–ãƒã‚°ã®ç¿»è¨³ã§ã™ã€‚ å…¬å¼ç¿»è¨³ãŒå®Œäº†æ¬¡ç¬¬å‰Šé™¤ã—ã¾ã™ã€‚ æŠ€è¡“æƒ…å ±ã«èª¤ã‚ŠãŒã‚ã‚‹å ´åˆã€é æ…®ãªãã€ã‚€ã—ã‚ç©æ¥µçš„ã«@kameoncloudã¾ã§é€£çµ¡ä¸‹ã•ã„ã€‚ 2023å¹´8æœˆ25æ—¥ã‹ã‚‰ã€å¤šãã®ãŠå®¢æ§˜ã‚’è¥²ã£ãŸç•°å¸¸ã«å¤§è¦æ¨¡ãªHTTPæ”»æ’ƒã«æ°—ä»˜ãå§‹ã‚ã¾ã—ãŸã€‚ã“ã‚Œã‚‰ã®æ”»æ’ƒã¯å½“ç¤¾ã®è‡ªå‹•DDoSã‚·ã‚¹ãƒ†ãƒ ã«ã‚ˆã£ã¦æ¤œçŸ¥ã•ã‚Œã€è»½æ¸›ã•ã‚Œã¾ã—ãŸã€‚ã—ã‹ã—ã€ã“ã‚Œã‚‰ã®æ”»æ’ƒãŒè¨˜éŒ²çš„ãªè¦æ¨¡ã«é”ã™ã‚‹ã¾ã§ãã‚Œã»ã©æ™‚é–“ã¯ã‹ã‹ã‚Šã¾ã›ã‚“ã§ã—ãŸã€‚ã“ã‚Œã¯ã€éŽåŽ»æœ€å¤§ã®æ”»æ’ƒã®ç´„3å€ã®è¦æ¨¡ã§ã—ãŸã€‚ æ‡¸å¿µã•ã‚Œã‚‹ã®ã¯ã€æ”»æ’ƒè€…ãŒã‚ãšã‹2ä¸‡å°ã®ãƒœãƒƒãƒˆãƒãƒƒãƒˆã§ã“ã®ã‚ˆã†ãªæ”»æ’ƒã‚’è¡ŒãˆãŸã¨ã„ã†äº‹å®Ÿã§ã‚ã‚‹ã€‚ä»Šæ—¥ã§ã¯ã€æ•°åä¸‡å°ã‹ã‚‰æ•°ç™¾ä¸‡å°ã®ãƒžã‚·ãƒ³ã§æ§‹æˆã•ã‚Œã‚‹ãƒœãƒƒãƒˆãƒãƒƒãƒˆãŒå˜åœ¨ã™ã‚‹ã€‚ã‚¦ã‚§ãƒ–å…¨ä½“ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆæ•°ã¯é€šå¸¸1ç§’é–“ã«10å„„ã‹ã‚‰30å„„ã«éŽãŽãªã„ã“ã¨ã‚’è€ƒãˆã‚‹ã¨ã€ã“ã®æ–¹æ³•ã‚’ä½¿ãˆã°ã€ã‚¦ã‚§ãƒ–å…¨ä½“ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã«ç›¸å½“ã™ã‚‹ã‚‚ã®ã‚’å°‘æ•°ã®ã‚¿ãƒ¼ã‚²ãƒƒãƒˆã«é›†ä¸ã•ã›ã‚‹ã“ã¨ãŒã§ãã‚‹å¯èƒ½æ€§
uokada 2023/10/12
http

security
ãƒªãƒ³ã‚¯
ãƒžãƒ«ãƒãƒã‚¤ãƒˆæ–‡å—ã¨URL | æŠ€è¡“è€…ãƒ–ãƒã‚° | ä¸‰äº•ç‰©ç”£ã‚»ã‚ãƒ¥ã‚¢ãƒ‡ã‚£ãƒ¬ã‚¯ã‚·ãƒ§ãƒ³æ ªå¼ä¼šç¤¾
MBSDã§Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚¹ã‚ãƒ£ãƒŠã®é–‹ç™ºã‚’ã—ã¦ã„ã‚‹å¯ºç”°ã§ã™ã€‚ å‰è¨˜äº‹ã§ã¯æ£è¦è¡¨ç¾ã§ã®URLã®ãƒã‚§ãƒƒã‚¯ã«ã¤ã„ã¦æ›¸ãã¾ã—ãŸã€‚ä»Šå›žã¯ãã®ç¶šãã§ãƒžãƒ«ãƒãƒã‚¤ãƒˆæ–‡å—ã‚’ä½¿ã£ãŸæ”»æ’ƒã«ã¤ã„ã¦æ›¸ããŸã„ã¨æ€ã„ã¾ã™ã€‚ å‰ææ¡ä»¶ æœ¬è¨˜äº‹ã§æƒ³å®šã™ã‚‹ã®ã¯ã€ãƒ–ãƒ©ã‚¦ã‚¶ã‹ã‚‰ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã¨ã—ã¦æ¸¡ã•ã‚Œã¦æ¥ã‚‹URLã‚’ã€ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã‚„ãƒªãƒ³ã‚¯ç‰ã®URLã¨ã—ã¦ä½¿ã†ã‚±ãƒ¼ã‚¹ã§ã™ã€‚ãã®ä¸ã§ã‚‚ã€ä»¥ä¸‹ã®ã‚ˆã†ã«ã‚µãƒ–ãƒ‰ãƒ¡ã‚¤ãƒ³éƒ¨åˆ†ï¼ˆâ˜…ã®éƒ¨åˆ†ï¼‰ã‚’å¯å¤‰ã«ã™ã‚‹çŠ¶æ³ã‚’ä¸»ã«æƒ³å®šã—ã¾ã™ã€‚ https://â˜….example.jp/â€¦ æ”»æ’ƒã®ç›®æ¨™ã¯ã€ç•°ãªã‚‹ãƒ‰ãƒ¡ã‚¤ãƒ³ï¼ˆevilï¼‰ã®URLã‚’ä¸Žãˆã¦ãƒã‚§ãƒƒã‚¯ã‚’ã™ã‚ŠæŠœã‘ã‚‹ã“ã¨ã§ã™ã€‚å‰å›žã®è¨˜äº‹ã«ã‚‚æ›¸ãã¾ã—ãŸãŒã€ã“ã®çŠ¶æ³ã¯ï¼ˆåŠè§’è‹±æ•°ç‰ã®ã‚µãƒ–ãƒ‰ãƒ¡ã‚¤ãƒ³ã—ã‹å—ã‘å…¥ã‚Œãªã„ã‚ˆã†ãªå ´åˆã‚’é™¤ãï¼‰ã€Œ/ã€ã€Œ?ã€ã€Œ#ã€ã€Œ\ã€ã®ã„ãšã‚Œã‹ã‚’ã‚µãƒ–ãƒ‰ãƒ¡ã‚¤ãƒ³ã«å…¥ã‚Œã‚‹ã“ã¨ã§æ”»ç•¥ã§ãã‚‹ã“ã¨ãŒå¤§åŠã§ã™ã€‚ ä»Šå›žã¯ã“ã‚Œã‚‰ã®è¨˜å·ãŒå…¨ã¦ä½¿ç”¨ã§ããªã„ã‚ˆã†ã«å¯¾ç–ã•ã‚Œã¦ã„ã‚‹ã“
uokada 2023/02/17
URL

security

HTTP

RFC
ãƒªãƒ³ã‚¯
CORS(Cross-Origin Resource Sharing)ã«ã‚ˆã‚‹ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³é€šä¿¡ã®å‚¾å‘ã¨å¯¾ç– | DevelopersIO
CORS(Cross-Origin Resource Sharing)ã£ã¦ä½•ï¼Ÿ CORS(Cross-Origin Resource Sharing)ã¯ã€ãã®åã®é€šã‚Šã€ãƒ–ãƒ©ã‚¦ã‚¶ãŒã‚ªãƒªã‚¸ãƒ³(HTMLã‚’èªã¿è¾¼ã‚“ã ã‚µãƒ¼ãƒã®ã“ã¨)ä»¥å¤–ã®ã‚µãƒ¼ãƒã‹ã‚‰ãƒ‡ãƒ¼ã‚¿ã‚’å–å¾—ã™ã‚‹ä»•çµ„ã¿ã§ã™ã€‚å„ç¤¾ã®ãƒ–ãƒ©ã‚¦ã‚¶ã«ã¯ã€ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³é€šä¿¡ã‚’æ‹’å¦ã™ã‚‹ä»•çµ„ã¿ãŒå®Ÿè£…ã•ã‚Œã¦ã„ã¾ã™ã€‚ã“ã‚Œã¯ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã‚’é˜²æ¢ã™ã‚‹ãŸã‚ã§ã™ã€‚Aã¨ã„ã†ã‚µã‚¤ãƒˆã«è¨ªå•ã—ãŸã®ã«ã€Bã¨ã„ã†ã‚µã‚¤ãƒˆã«å‘ã‘ã¦å€‹äººæƒ…å ±ã‚’é€ã£ã¦ã„ãŸã¨ã„ã†ã®ã¯å›°ã‚Šã¾ã™ã‚ˆãã€‚ä¾‹ãˆã°ã€ã‚ªãƒªã‚¸ãƒ³ã‹ã‚‰èªã¿è¾¼ã‚“ã HTMLå†…ã®JavaScriptã§JSONãƒ‡ãƒ¼ã‚¿ã‚’èªã¿è¾¼ã‚€ã¨ã—ã¾ã—ã‚‡ã†ã€‚JSONãƒ‡ãƒ¼ã‚¿ãŒåŒã˜ã‚µãƒ¼ãƒã«ã‚ã‚Œã°æ™®é€šã«èªã¿è¾¼ã‚ã¾ã™ãŒã€åˆ¥ã®ã‚µãƒ¼ãƒã«ã‚ã‚‹å ´åˆã¯èªã¿è¾¼ã‚ã¾ã›ã‚“ã€‚ã¾ãå®Ÿéš›ã®ã¨ã“ã‚ã¯JSONPã¨ã„ã†ä»•çµ„ã¿ã‚’ä½¿ã£ã¦ã§ãã¡ã‚ƒã£ãŸã‚Šã—ã¾ã™ãŒã€æŠœã‘é“çš„ãªã‚„ã‚Šæ–¹ã§ä½¿ã‚ã‚Œã¦ã„ã¾ã—ãŸã€‚CO
uokada 2020/01/01
CORS

http

security
ãƒªãƒ³ã‚¯
CORS (Cross-Origin Resource Sharing) ã£ã¦ãªã«ï¼Ÿ
å…ˆæ—¥CORS(Cross-Origin Resource Sharing)ã§ãƒãƒžã£ãŸã®ã§ã€ä»Šæ›´ã ã‘ã©å¾©ç¿’ã€‚Same Origin Policy(åŒä¸€ã‚ªãƒªã‚¸ãƒ³ãƒãƒªã‚·ãƒ¼)ã«ã¤ã„ã¦åŸºæœ¬çš„ãªã¨ã“ã‚ã‹ã‚‰èª¿ã¹ç›´ã—ã¾ã—ãŸã€‚ ã‚ªãƒªã‚¸ãƒ³ã¨ã¯ ã‚ªãƒªã‚¸ãƒ³ ï¼ ã‚¹ã‚ãƒ¼ãƒ ã€ãƒ›ã‚¹ãƒˆã€ãƒãƒ¼ãƒˆã®çµ„ã¿åˆã‚ã› (â€»ã‚¹ã‚ãƒ¼ãƒ ã«ã‚ˆã£ã¦å¾®å¦™ã«é•ã†ã“ã¨ã‚‚ã‚ã‚‹) http://www.exsample.com:80/index.htmlã®URLã‚’ä¾‹ã«ã™ã‚‹ã¨ ã‚¹ã‚ãƒ¼ãƒ ï¼ http:// ãƒ›ã‚¹ãƒˆ ï¼ www.exsample.com ãƒãƒ¼ãƒˆ ï¼ 80 (ãƒãƒ¼ãƒˆç•ªå·ã€Œ80ã€ã¯çœç•¥å¯ãªã®ã§æ™®æ®µè¦‹ã‹ã‘ã‚‹ã“ã¨ã¯å°‘ãªã„) åŒä¸€ã‚ªãƒªã‚¸ãƒ³ãƒãƒªã‚·ãƒ¼ã¨ã¯ TL;DR ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’å®ˆã‚‹ãŸã‚ã®é‡è¦ãªä»•çµ„ã¿ ã‚ã‚‹ãƒšãƒ¼ã‚¸ã‚’é–‹ã„ãŸã¨ãã«ã€é–¢é€£ã™ã‚‹ãƒªã‚½ãƒ¼ã‚¹(JavaScriptç‰)ã‚’åŒã˜ã‚ªãƒªã‚¸ãƒ³ã‹ã‚‰ã—ã‹å–å¾—ã—ãªã„ ãã†ã—ãªã„ã¨å€‹äººæƒ…å ±ã®ä¿è·ã‚‚å¤–éƒ¨ã‹ã‚‰ã®æ”»æ’ƒã«ã‚‚ã‚¬ãƒ
uokada 2020/01/01
CORS

http

security
ãƒªãƒ³ã‚¯
ã‚ªãƒªã‚¸ãƒ³é–“ãƒªã‚½ãƒ¼ã‚¹å…±æœ‰ (CORS) - HTTP | MDN
HTTP ã‚¬ã‚¤ãƒ‰ HTTP ã®æ¦‚è¦ å…¸åž‹çš„ãª HTTP ã‚»ãƒƒã‚·ãƒ§ãƒ³ HTTP ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ MIME ã‚¿ã‚¤ãƒ—ï¼ˆIANA ãƒ¡ãƒ‡ã‚£ã‚¢ç¨®åˆ¥ï¼‰ HTTP ã®åœ§ç¸® HTTP ã‚ãƒ£ãƒƒã‚·ãƒ¥ HTTP èªè¨¼ HTTP Cookie ã®ä½¿ç”¨ HTTP ã®ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆ HTTP æ¡ä»¶ä»˜ããƒªã‚¯ã‚¨ã‚¹ãƒˆ HTTP ç¯„å›²ãƒªã‚¯ã‚¨ã‚¹ãƒˆ ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ãƒã‚´ã‚·ã‚¨ãƒ¼ã‚·ãƒ§ãƒ³ HTTP/1.x ã®ã‚³ãƒã‚¯ã‚·ãƒ§ãƒ³ç®¡ç† HTTP ã®é€²åŒ– ãƒ—ãƒãƒˆã‚³ãƒ«ã®ã‚¢ãƒƒãƒ—ã‚°ãƒ¬ãƒ¼ãƒ‰ã®ä»•çµ„ã¿ ãƒ—ãƒã‚ã‚·ã‚µãƒ¼ãƒãƒ¼ã¨ãƒˆãƒ³ãƒãƒªãƒ³ã‚° HTTP ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãƒ’ãƒ³ãƒˆ HTTP ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ã‚µã‚¤ãƒˆã®å®‰å…¨åŒ– HTTP Observatory Permissions Policy ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒãƒªã‚·ãƒ¼ (CSP) ã‚ªãƒªã‚¸ãƒ³é–“ãƒªã‚½ãƒ¼ã‚¹å…±æœ‰ (CORS) Cross-Origin Resource Policy (CORP) Strict-Transport-Securit
uokada 2020/01/01
CORS

http

security
ãƒªãƒ³ã‚¯
Cookieã«ã‹ã‚ã‚‹ Sec-HTTP-State ãƒ˜ãƒƒãƒ€ã®ææ¡ˆ - ASnoKaze blog
20190424 è¿½è¨˜ IETFã«ææ¡ˆä»•æ§˜ãŒæå‡ºã•ã‚Œã¾ã—ãŸ https://tools.ietf.org/html/draft-west-http-state-tokens-00 Cookieã®æ§˜ã€…ãªå•é¡Œã‚’è§£æ±ºã™ã‚‹ãŸã‚ã«ã€Webã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼ç•Œéšˆã§æ´»èºã•ã‚Œã‚‹Mike Westæ°ã‹ã‚‰ã€ŒTightening HTTP State Managementã€ã¨ã„ã†Cookieã«å¤‰ã‚ã‚‹HTTPã«ãŠã„ã¦ã‚¹ãƒ†ãƒ¼ãƒˆã‚’æ‰±ã†ä»•çµ„ã¿ãŒææ¡ˆã•ã‚Œã¦ã„ã¾ã™ã€‚ ç¾åœ¨ã¯IETFã®HTTPbis WGã®MLã«æŠ•ç¨¿ã•ã‚ŒãŸã ã‘ã§ä»•æ§˜ãŒæ£å¼ã«internet-draftã¨ã—ã¦æå‡ºã•ã‚ŒãŸã‚‚ã®ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ã¾ã ã¾ã ã©ã†ãªã‚‹ã‹ã¯å…¨ç„¶ã‚ã‹ã‚‰ãªã„çŠ¶æ…‹ã§ã™ã€‚ ã“ã®ææ¡ˆã§ã¯ã€ç¾åœ¨ã®Cookieã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¨éžåŠ¹çŽ‡æ€§ã¨ãƒ—ãƒ©ã‚¤ãƒã‚·ãƒ¼ã®å•é¡ŒãŒã‚ã‚‹ã¨è¨€ã£ã¦ã„ã¾ã™ã€‚ ç¾åœ¨ã®cookieã¯ã€Same-Origin-Policyã¨ã¯ç•°ãªã‚Šã‚ªãƒªã‚¸ãƒ³ã‚’è¶…ãˆã¦
uokada 2018/08/15
http

security
ãƒªãƒ³ã‚¯
XSSã‚’é˜²ãæ–°ã—ã„XSS-Protectionãƒ˜ãƒƒãƒ€ - ASnoKaze blog
evalã¨reportOnlyã«ã¤ã„ã¦è¿½è¨˜ã—ã¾ã—ãŸ (2016/10/10) 2016/10/20 ä»•æ§˜åã¯ä»¥ä¸‹ã®é€šã‚Šã«ãªã‚Šã¾ã—ãŸã€‚Anti-XSS Response-Time Uniqueness Requirement ã¾ãŸã€ãƒ˜ãƒƒãƒ€åã¯ã€XSS-Protectionãƒ˜ãƒƒãƒ€ã§ã¯ãªãã€ARTURãƒ˜ãƒƒãƒ€ã¨ãªã£ã¦ãŠã‚Šã¾ã™ãŒã€ã¾ãŸå¤‰æ›´ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ Googleã®èª¿æŸ»ã«ã‚ˆã‚‹ã¨ã€CSPã«ã‚ˆã‚‹XSSã®é˜²æ¢ã¯ç¾å®Ÿçš„ã«ãƒ‡ãƒ—ãƒã‚¤ã®æ¬ é™¥ã«ã‚ˆã‚ŠXSSã®é˜²æ¢åŠ¹æžœãŒãªã„ã“ã¨ã‚’ç¤ºã—ã¦ã„ã¾ã™ã€‚èª¿æŸ»ã¯ã€ŒCSP Is Dead, Long Live CSP!ã€ã¨ã—ã¦ACMã®ã‚«ãƒ³ãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã§ç™ºè¡¨ã•ã‚Œã€ãƒšãƒ¼ãƒ‘ãƒ¼ã‚‚é–²è¦§ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ 9æœˆã«è¡Œã‚ã‚ŒãŸW3C TPAC 2016ã®WebAppSecã®ãƒŸãƒ¼ãƒ†ã‚£ãƒ³ã‚°ã§è°è«–ã•ã‚Œã€Googleã®Mike Westæ°ã‚ˆã‚Šæ–°ã—ãXSS Protectionã¨ã„ã†ä»•æ§˜ãŒææ¡ˆã•ã‚Œã¦
uokada 2016/10/09
å®Ÿç”¨ã‚¤ãƒ¡ãƒ¼ã‚¸ãŒã‚¤ãƒžã‚¤ãƒåˆ†ã‹ã‚‰ã‚“ã®ã§å‹‰å¼·ã—ã‚ˆã€‚

security

XSS

HTTP

browser
ãƒªãƒ³ã‚¯
Fingerprintè§£èª¬ã‚µã‚¤ãƒˆ
2013å¹´ã®ã€ŒCookieless Monster: Exploring the Ecosystem of Web-based Device Fingerprintingã€ã«ã‚ˆã‚‹ã¨ã€Alexa ã®ã‚¢ã‚¯ã‚»ã‚¹æ•°Top1ä¸‡ã®ã‚µã‚¤ãƒˆã®ã†ã¡ã€4%ã®ã‚µã‚¤ãƒˆãŒFingerprintã«é–¢ã™ã‚‹æŠ€è¡“ã‚’ç”¨ã„ã¦ã„ã‚‹ã“ã¨ãŒç¤ºã•ã‚Œã¾ã—ãŸã€‚ã¾ãŸã€2014å¹´ã®ã€ŒThe Web Never Forgets: Persistent Tracking Mechanisms in the Wildã€ã§ã¯ã€Alexa ã®ã‚¢ã‚¯ã‚»ã‚¹æ•°Top10ä¸‡ã®ã‚µã‚¤ãƒˆã®ã†ã¡ã€5.5%ã®ã‚µã‚¤ãƒˆãŒFingerprintã«é–¢ã™ã‚‹æŠ€è¡“ã‚’ç”¨ã„ã¦ãŠã‚Šã€ä»Šå¾Œã‚‚å¢—ãˆã¦ã„ãã“ã¨ãŒäºˆæƒ³ã•ã‚Œã¾ã™ã€‚ ã§ã¯ã€Fingerprintã¨ã¯ä¸€ä½“ã©ã®ã‚ˆã†ãªã‚‚ã®ãªã®ã§ã—ã‚‡ã†ã‹ï¼ŸFingerprintã®ãã‚‚ãã‚‚ã®èªžæºã¯ã€è‹±èªžã§ã€ŒæŒ‡ç´‹ã€ã¨ã„ã†æ„å‘³ã§ã™ãŒã€Webä¸Šã§ã¯ã€ŒWebã‚µã‚¤ãƒˆåˆ©ç”¨è€…ã®
uokada 2015/04/13
HTTP

security

fingerprint

web
ãƒªãƒ³ã‚¯
1åˆ†ã§ã‚ã‹ã‚‹ã€ŒX-ãƒŠãƒ³ãƒˆã‚«ã€HTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ - è‘‰ã£ã±æ—¥è¨˜
æœ€è¿‘ã®ãƒ¢ãƒ€ãƒ³ãªWebãƒ–ãƒ©ã‚¦ã‚¶ãŒã‚µãƒãƒ¼ãƒˆã—ã¦ã„ã‚‹ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢é€£ã—ãã†ãª X- ãªHTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã‚’ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ãã‚Œä»¥å¤–ã«ã‚‚ã‚ã£ãŸã‚‰æ•™ãˆã¦ãã ã•ã„ã€‚ X-XSS-Protection 0:XSSãƒ•ã‚£ãƒ«ã‚¿ã‚’ç„¡åŠ¹ã«ã™ã‚‹ã€‚ 1:XSSãƒ•ã‚£ãƒ«ã‚¿ã‚’æœ‰åŠ¹ã«ã™ã‚‹ã€‚ XSSãƒ•ã‚£ãƒ«ã‚¿ã‚’æœ‰åŠ¹ã«ã™ã‚‹ã“ã¨ã§ã‚¨ãƒ³ãƒ‰ãƒ¦ãƒ¼ã‚¶ãŒXSSã®è¢«å®³ã«ã‚ã†å¯èƒ½æ€§ãŒä½Žæ¸›ã™ã‚‹ãŒã€ã¾ã‚Œã«èª¤æ¤œçŸ¥ã™ã‚‹ã“ã¨ã§ç”»é¢ã®è¡¨ç¤ºãŒä¹±ã‚Œã‚‹ã“ã¨ã‚‚ã‚ã‚‹ã€‚IE8+ã€Safariã€Chrome(å¤šåˆ†) ã§æœ‰åŠ¹ã€‚IEã§ã¯ã€ŒX-XSS-Protection: 1; mode=blockã€ã¨ã„ã†æŒ‡å®šã‚‚å¯èƒ½ã€‚ 2008/7/2 - IE8 Security Part IV: The XSS FilterBug 27312 â€“ [XSSAuditor] Add support for header X-XSS-Protection X-Content-Ty
uokada 2014/09/24
XSS

security

browser

header

http
ãƒªãƒ³ã‚¯
è‰¦éšŠã“ã‚Œãã—ã‚‡ã‚“ã®é€šä¿¡ãŒã¨ã¦ã‚‚ã˜ã‚ƒãªã„ã‘ã©è¦‹ã¦ã‚‰ã‚Œãªã„
ãã®æ–‡å—åˆ—æ¤œç´¢ã€std::string::findã ã‘ã§å¤§ä¸ˆå¤«ã§ã™ã‹ï¼Ÿã€Sapporo.cpp ç¬¬8å›žå‹‰å¼·ä¼šï¼ˆ2014.12.27ï¼‰ã€‘Hiro H.
uokada 2014/01/22
HTTPSã®é€šä¿¡ã£ã¦ã‚µãƒ¼ãƒãƒ¼ã¸ã®è² è·ãŒä½•å€ã‚‚å¢—ãˆã‚‹ã‹ã‚‰æ°—è»½ã«å°Žå…¥å‡ºæ¥ãªã„ã‚“ã§ã™ã‚ˆã€œ 2000rpsãŒ400rpsã¾ã§ãƒ‘ãƒ•ã‚©ãƒ¼ãƒžãƒ³ã‚¹è½ã¡ãŸã‚Šã™ã‚‹ã‚“ã‚ˆ ãªã®ã§ä¸€éƒ¨ã®ã¿HTTPSå°Žå…¥ãŒé€²ã‚“ã§åˆæ ¼ç‚¹ã‹ãªã¨æ€ã†

HTTP

security
ãƒªãƒ³ã‚¯
1