[B! security][web] uokadaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

uokada id:uokada

securityã¨webã«é–¢ã™ã‚‹uokadaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãªãœWebã‚µãƒ¼ãƒ“ã‚¹ã®é¸å®šã«ãŠã„ã¦SAML/SSOãŒé‡è¦ãªã®ã‹
ã“ã®è¨˜äº‹ã¯ corp-engr æƒ…ã‚·ã‚¹Slackï¼ˆã‚³ãƒ¼ãƒãƒ¬ãƒ¼ãƒˆã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ x æƒ…ã‚·ã‚¹ï¼‰Advent Calendar 2020 #3 ã®æœ€çµ‚æ—¥ï¼ˆ25æ—¥ç›®ï¼‰ã§ã™ã€‚ ä»Šå¹´æƒ…ã‚·ã‚¹Slackã¯3æœ¬ã®ã‚¢ãƒ‰ãƒ™ãƒ³ãƒˆã‚«ãƒ¬ãƒ³ãƒ€ãƒ¼ãŒå®Ÿæ–½ã•ã‚Œã¦ãŠã‚Šã¾ã™ã®ã§ã€æ˜¯éž3æœ¬ã¨ã‚‚è¦—ã„ã¦ã„ã£ã¦ãã ã•ã„ï¼ ã€åˆå¿ƒè€…å„ªå…ˆæž ã€‘corp-engr æƒ…ã‚·ã‚¹Slackï¼ˆã‚³ãƒ¼ãƒãƒ¬ãƒ¼ãƒˆã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ x æƒ…ã‚·ã‚¹ï¼‰ Advent Calendar 2020 #2corp-engr æƒ…ã‚·ã‚¹Slackï¼ˆã‚³ãƒ¼ãƒãƒ¬ãƒ¼ãƒˆã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ x æƒ…ã‚·ã‚¹ï¼‰Advent Calendar 2020 #3ã¾ãŸã€æƒ…ã‚·ã‚¹Slackã¯ã“ã¡ã‚‰ã®å‚åŠ ãƒªãƒ³ã‚¯ã‹ã‚‰å‚åŠ å¯èƒ½ã§ã™ ç›®æ¬¡TL;DRã‚¯ãƒ©ã‚¦ãƒ‰ãƒã‚¤ãƒ†ã‚£ãƒ–ãªæ™‚ä»£ã®ãƒ“ã‚¸ãƒã‚¹ã§ã¯Webã‚µãƒ¼ãƒ“ã‚¹æ´»ç”¨ã¯å¿…é ˆWebã‚µãƒ¼ãƒ“ã‚¹ã‚’ã‚»ã‚ãƒ¥ã‚¢ã«åˆ©ç”¨ã—ã¦ã„ãã«ã¯ç®¡ç†ã‚„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é¢ã§ã®å·¥æ•°ãƒ»ã‚³ã‚¹ãƒˆãŒå¢—ãˆã‚‹ã“ã®å·¥æ•°ãƒ»ã‚³ã‚¹ãƒˆã‚’ä¸‹ã’ã‚‹ã“ã¨ã“ããŒWebã‚µãƒ¼ãƒ“ã‚¹
uokada 2022/07/06
security

web

webservice
ãƒªãƒ³ã‚¯
ãªã‚“ã¨ãªã CORS ãŒã‚ã‹ã‚‹...ã¯ã‚‚ã†çµ‚ã‚ã‚Šã«ã™ã‚‹ã€‚ - Qiita
Access to XMLHttpRequest at 'http://localhost:8081' from origin 'http://localhost:8080' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:8080' is ther
uokada 2020/11/10
CORS

web

security

XSS
ãƒªãƒ³ã‚¯
Web ã«ãŠã‘ã‚‹æŠ€è¡“ã®è§£é‡ˆã¨ã‚¨ã‚³ã‚·ã‚¹ãƒ†ãƒ ã«ã‚ˆã‚‹åˆæ„å½¢æˆãƒ—ãƒã‚»ã‚¹ã«ã¤ã„ã¦ | blog.jxck.io
Intro ã€Œãƒ¦ãƒ¼ã‚¶ãŒæ„å›³ã™ã‚‹æŒ™å‹•ã€ã¨ã¯ä½•ã‹ã€‚æŠ€è¡“çš„ã«å¯èƒ½ã§ã‚ã‚‹ãŒã€Œã‚„ã‚‰ãªã„æ–¹ãŒè‰¯ã„ã“ã¨ã€ã¯ã€èª°ãŒã©ã†æ±ºã‚ã‚‹ã®ã‹ã€‚ Web ã«ã¯ä»•æ§˜ã€å®Ÿè£…ã€ãƒ‡ãƒ—ãƒã‚¤ã€ãã—ã¦ãƒ¦ãƒ¼ã‚¶ã®åˆ©ç”¨ã¨ãƒ•ã‚£ãƒ¼ãƒ‰ãƒãƒƒã‚¯ã«ã‚ˆã£ã¦ã€ãã†ã—ãŸåˆæ„ãŒã‚†ã‚‹ã‚„ã‹ã«å½¢æˆã•ã‚Œã¦ã„ãä»•çµ„ã¿ãŒã‚ã‚‹ã¨ç†è€…ã¯è€ƒãˆã¦ã„ã‚‹ã€‚ ã—ã‹ã—ã€ã“ã‚Œã¯æ˜Žæ–‡åŒ–ã•ã‚Œã¦ã„ã‚‹ã‚ã‘ã§ã‚‚ãªãã€ãã®å…¨ä½“åƒã‚’æŠŠæ¡ã™ã‚‹ã®ã¯ä¸€èˆ¬ã«ã¯é›£ã—ã„ã ã‚ã†ã€‚ ä»Šå›žã¯ã€ã¡ã‚‡ã†ã©ä½•åº¦ç›®ã‹ã®è°è«–ãŒå†ç™ºã—ã¦ã„ã‚‹ ping å±žæ€§ã‚’ä¾‹ã«ã€ã“ã®åˆæ„å½¢æˆã®æ¦‚è¦³ã«ã¤ã„ã¦è§£èª¬ã‚’è©¦ã¿ã‚‹ã€‚ ãƒªãƒ³ã‚¯ã® ping å±žæ€§ <a> ã«ã¯ ping ã¨ã„ã†å±žæ€§ãŒã‚ã‚Šã€ä»¥ä¸‹ã®ã‚ˆã†ã« URL ã‚’æŒ‡å®šã™ã‚‹ã€‚ <a href=https:example.com ping=/path/to/report>example.com</a> HTML Standard - ping Attribute ã“ã®ãƒªãƒ³ã‚¯ã¯ã€ã‚¯ãƒªãƒƒã‚¯ã™ã‚‹ã¨ https
uokada 2019/05/04
pingã¨ãã®å‘¨è¾ºã«ã¤ã„ã¦ã€‚

web

browser

security
ãƒªãƒ³ã‚¯
Fingerprintè§£èª¬ã‚µã‚¤ãƒˆ
2013å¹´ã®ã€ŒCookieless Monster: Exploring the Ecosystem of Web-based Device Fingerprintingã€ã«ã‚ˆã‚‹ã¨ã€Alexa ã®ã‚¢ã‚¯ã‚»ã‚¹æ•°Top1ä¸‡ã®ã‚µã‚¤ãƒˆã®ã†ã¡ã€4%ã®ã‚µã‚¤ãƒˆãŒFingerprintã«é–¢ã™ã‚‹æŠ€è¡“ã‚’ç”¨ã„ã¦ã„ã‚‹ã“ã¨ãŒç¤ºã•ã‚Œã¾ã—ãŸã€‚ã¾ãŸã€2014å¹´ã®ã€ŒThe Web Never Forgets: Persistent Tracking Mechanisms in the Wildã€ã§ã¯ã€Alexa ã®ã‚¢ã‚¯ã‚»ã‚¹æ•°Top10ä¸‡ã®ã‚µã‚¤ãƒˆã®ã†ã¡ã€5.5%ã®ã‚µã‚¤ãƒˆãŒFingerprintã«é–¢ã™ã‚‹æŠ€è¡“ã‚’ç”¨ã„ã¦ãŠã‚Šã€ä»Šå¾Œã‚‚å¢—ãˆã¦ã„ãã“ã¨ãŒäºˆæƒ³ã•ã‚Œã¾ã™ã€‚ ã§ã¯ã€Fingerprintã¨ã¯ä¸€ä½“ã©ã®ã‚ˆã†ãªã‚‚ã®ãªã®ã§ã—ã‚‡ã†ã‹ï¼ŸFingerprintã®ãã‚‚ãã‚‚ã®èªžæºã¯ã€è‹±èªžã§ã€ŒæŒ‡ç´‹ã€ã¨ã„ã†æ„å‘³ã§ã™ãŒã€Webä¸Šã§ã¯ã€ŒWebã‚µã‚¤ãƒˆåˆ©ç”¨è€…ã®
uokada 2015/04/13
HTTP

security

fingerprint

web
ãƒªãƒ³ã‚¯
ãƒã‚°ã‚¢ã‚¦ãƒˆæ©Ÿèƒ½ã®ç›®çš„ã¨å®Ÿç¾æ–¹æ³•
ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ãŠã‘ã‚‹ãƒã‚°ã‚¢ã‚¦ãƒˆæ©Ÿèƒ½ã«é–¢é€£ã—ã¦ã€ãã®ç›®çš„ã¨å®Ÿç¾æ–¹æ³•ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ è°è«–ã®å‰æ ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ã€èªè¨¼æ–¹å¼ã¨ã—ã¦ã€ã„ã‚ã‚†ã‚‹ãƒ•ã‚©ãƒ¼ãƒ èªè¨¼ã‚’å‰æã¨ã—ã¦ã„ã¾ã™ã€‚ãƒ•ã‚©ãƒ¼ãƒ èªè¨¼ã¯ä¿—ãªè¨€ã„æ–¹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ãŒã€HTMLãƒ•ã‚©ãƒ¼ãƒ ã§IDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®å…¥åŠ›ãƒ•ã‚©ãƒ¼ãƒ ã‚’ä½œæˆã—ã€ãã®å…¥åŠ›å€¤ã‚’ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³å´ã§æ¤œè¨¼ã™ã‚‹èªè¨¼æ–¹å¼ã®ã“ã¨ã§ã™ã€‚IDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®å…¥åŠ›ã¯æœ€åˆã®1å›žã§ã™ã¾ã›ãŸã„ãŸã‚ã€é€šå¸¸ã¯Cookieã‚’ç”¨ã„ã¦èªè¨¼çŠ¶æ…‹ã‚’ä¿æŒã—ã¾ã™ã€‚ãƒã‚°ã‚¢ã‚¦ãƒˆæ©Ÿèƒ½ã¨ã¯ã€ä¿æŒã•ã‚ŒãŸèªè¨¼çŠ¶æ…‹ã‚’ç ´æ£„ã—ã¦ã€èªè¨¼ã—ã¦ã„ãªã„çŠ¶æ…‹ã«æˆ»ã™ã“ã¨ã§ã™ã€‚ Cookieã‚’ç”¨ã„ãŸèªè¨¼çŠ¶æ…‹ä¿æŒ å‰è¿°ã®ã‚ˆã†ã«ã€èªè¨¼çŠ¶æ…‹ã®ä¿æŒã«ã¯Cookieã‚’ç”¨ã„ã‚‹ã“ã¨ãŒä¸€èˆ¬çš„ã§ã™ãŒã€Cookieã« auth=1 ã¨ã‹ã€userid=tokumaru ãªã©ã®ã‚ˆã†ã«ã€ãƒã‚°ã‚¤ãƒ³çŠ¶æ…‹ã‚’ã€Œãã®ã¾ã¾ã€Cookieã«ä¿æŒã™ã‚‹ã¨è„†å¼±æ€§ã«ãªã‚Šã¾ã™
uokada 2013/02/15
security

web

cookie
ãƒªãƒ³ã‚¯
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - ãƒ‘ã‚¹ãƒ¢ã¯ä¹—è»Šå±¥æ´ã‚’ç¬¬ä¸‰è€…æä¾›ï¼Ÿ ä»–ç¤¾ã®ãƒ“ãƒƒã‚°ãƒ‡ãƒ¼ã‚¿ã«å–ã‚Šè¾¼ã¾ã‚Œã‚‹å¯èƒ½æ€§
â– ãƒ‘ã‚¹ãƒ¢ã¯ä¹—è»Šå±¥æ´ã‚’ç¬¬ä¸‰è€…æä¾›ï¼Ÿ ä»–ç¤¾ã®ãƒ“ãƒƒã‚°ãƒ‡ãƒ¼ã‚¿ã«å–ã‚Šè¾¼ã¾ã‚Œã‚‹å¯èƒ½æ€§ å‰å›žã®æ—¥è¨˜ã®ç¶šãã€‚ ã‚ã®å¾Œã€ãƒ‘ã‚¹ãƒ¢ç¤¾ã®æ‹…å½“è€…ã¨ä½•ã‚’è©±ã—ãŸã‹ã¨ã„ã†ã¨ã€åŒç¤¾ã®å€‹äººæƒ…å ±ä¿è·æ–¹é‡ã«åã—ã¦ã„ã‚‹ã®ã§ã¯ãªã„ã‹ã¨ã„ã†ç‚¹ã¨ã€å€‹äººæƒ…å ±ä¿è·æ³•ã«é•åã—ã¦ã„ã‚‹ã®ã§ã¯ãªã„ã‹ã¨ã„ã†ç‚¹ã§ã‚ã£ãŸã€‚ é›»è©±ã™ã‚‹å‰ã®æ™‚ç‚¹ã§ã¯ã€ã€Œä¹—è»Šå±¥æ´è‡ªä½“ã¯å€‹äººæƒ…å ±ã§ã¯ãªã„*1ã€ã¨ã„ã†è¦‹è§£ã‚‚å‡ºã‚‹ã‹ãª*2ã¨äºˆæƒ³ã—ã¦ã„ãŸãŒã€æ‹…å½“è€…ã¯ã€å‰å›žã®æœ€å¾Œã®éƒ¨åˆ†ã§ç¤ºã—ãŸã‚ˆã†ã«ã€ã‚ã£ã•ã‚Šã¨å€‹äººæƒ…å ±ã ã¨èªã‚ãŸãŸã‚ã€ãã“ã¯è«–ç‚¹ã«ãªã‚‰ãªã‹ã£ãŸã€‚ ã¾ãšè¿½æ±‚ã—ãŸã®ã¯ã€åˆ©ç”¨ç›®çš„ã®æ˜Žç¤ºã€‚ å€‹äººæƒ…å ±ä¿è·æ³•ã¯ã€ç¬¬18æ¡ã§ã€å€‹äººæƒ…å ±ã‚’å–å¾—ã—ãŸã¨ãã¯é€Ÿã‚„ã‹ã«ãã®åˆ©ç”¨ç›®çš„ã‚’æœ¬äººã«é€šçŸ¥åˆã¯å…¬è¡¨ã—ãªã‘ã‚Œãªã°ã‚‰ãªã„ã¨å®šã‚ã¦ãŠã‚Šã€ãã®ä¾‹å¤–ã¨ã—ã¦ã€ã€Œã‚ã‚‰ã‹ã˜ã‚åˆ©ç”¨ç›®çš„ã‚’å…¬è¡¨ã—ã¦ã„ã‚‹å ´åˆã‚’é™¤ãã€ã¨ã—ã¦ã„ã‚‹ã€‚è¨˜åPASMOã‚’ä½œã£ã¦åˆ©ç”¨ã‚’å§‹ã‚ã‚‹ã¨ã€ä¹—è»Šå±¥æ´ã‚’ãƒ‘ã‚¹ãƒ¢ç¤¾ã»ã‹ã«å–å¾—ã•ã‚Œã‚‹ã“ã¨ã«ãªã‚‹ãŒã€ãã®ä¹—è»Šå±¥
uokada 2012/02/29
analytics

security

web

privacy
ãƒªãƒ³ã‚¯
1