マクロな視点から捉える Web セキュリティ / Web Security from the Macro Perspective

ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FCΠϯϑϥετϥΫνϟΛར༻ͨ͠߈ܸͱαΠυνϟωϧ߈ܸͷ࣮ફͱධՁ :0/&6$)* 5BLBTIJ !MNU@TXBMMPX IUUQTTIJGUKTJOGP

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ຊߨٛࢿྉʹ͍ͭͯ 4QFBLFS%FDLެ։൛޲͚ͷิ଍ ຊߨٛࢿྉ͸ʮηΩϡϦςΟɾΩϟϯϓશࠃେձΦϯϥΠϯʯͷ ϓϩμΫτηΩϡϦςΟτϥοΫ#ͷߨٛͰར༻͞Εͨ΋ͷͰ͢ɻ ৄࡉIUUQTXXXJQBHPKQKJO[BJDBNQ[FOLPLV@QSPHSBN@MJTUIUNMMJTU@C

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ຊߨٛࢿྉʹ͍ͭͯ 4QFBLFS%FDLެ։൛޲͚ͷิ଍ ߨٛͷϚςϦΞϧ͸ҎԼͷ(JU)VC3FQPTJUPSZʹશͯ֨ೲͯ͋͠Γ·͢ɻ IUUQTHJUIVCDPNMNUTXBMMPXTFDDBNQC

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ XIPBNJ 4FFIUUQTTIJGUKTJOGP ‣ :0/&6$)* 5BLBTIJถ಺وࢤ ‣ 5XJUUFS!MNU@TXBMMPX ‣
ԿΛ͍ͯ͠Δਓʁ ‣ ηΩϡϦςΟΤϯδχΞ!גࣜձࣾ'MBUU4FDVSJUZ ‣ #!౦ژେֶཧֶ෦৘ใՊֶՊ ‣ ηΩϡϦςΟɾΩϟϯϓͱͷؔ܎ੑ͸ʁ ‣ ೥தԝେձ8FCηΩϡϦςΟΫϥεଔۀ ‣ ೥ϛχΩϟϯϓJOԬࢁߨࢣ ‣ ೥શࠃେձߨࢣʢ#ʣ ‣ Ҏ߱ηΩϡϦςΟɾΩϟϯϓڠٞձߨࢣҭ੒(޿ใ(

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ XIPBNJ ׆ಈ঺հ ‣ ػց͕ಈ͍͍ͯΔͷΛݟΔͷ͕޷͖Ͱ͢ɻ ‣ ༡ͼͷҰ؀ͱͯ͠ɺ౓ʑंྠͷ࠶ൃ໌Λ͍ͯ͠·͢ɻ ‣
ྫ-JOVY͕ಈ࡞͢Δ3*4$7$16Λࣗ࡞ͨ͠ ೥౓$16࣮ݧ༨ڵ IUUQTEJBSZTIJGUKTJOGPCVJMEJOHBSJTDWDQVGPSMJOVY

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ XIPBNJ ׆ಈ঺հ ‣ ಈ͍͍ͯΔػցͷηΩϡϦςΟΛߟ͑Δͷ΋޷͖Ͱ͢ɻ ‣ ݸਓతͳ׆ಈͱͯ͠͸ɺ5IFPSFUJDBMͱ1SBDUJDBMͷؒʹҐஔ͢ΔΑ͏ͳ߈ܸ ख๏ͷݕ౼ɾௐࠪΛ͍ͯ͠·͢ɻ
‣ ྫ"3PVHI*EFBPG#MJOE3FHVMBS&YQSFTTJPO*OKFDUJPO"UUBDL IUUQTEJBSZTIJGUKTJOGPCMJOESFHVMBSFYQSFTTJPOJOKFDUJPO import re import sys secret = "this_is_secret_value" r = input("Give a regexp to search: ") _ = timeout(re.match(r, secret), 5) print("Done :P") ৚݅͑͞ἧ͑͹TFDSFUͷ ಺༰͕ϦʔΫͰ͖Δʂ

͸͡Ίʹ 1SFGBDF

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ຊߨٛͷ໨త ‣ 8FCΞϓϦέʔγϣϯͷηΩϡϦςΟΛɺैདྷΑΓ΋େہతʹϨϏϡʔͰ͖Δ ਓࡐΛ૿΍͢͜ͱɻ ‣ 8FCΞϓϦέʔγϣϯͷҰߦҰߦΛηΩϡΞʹॻͨ͘Ίͷํ๏࿦ɺ͍Θ͹8FCΞϓϦ έʔγϣϯͷϛΫϩͳηΩϡϦςΟ؍఺ʹؔͯ͠͸ɺ͢Ͱʹଟ͘ͷॻ੶΍8FCαΠτ ͷจݙʹΑΓઆ໌͞Ε͍ͯ·͢ɻ
‣ ຊߨٛͰ͸ɺ8FCΞϓϦέʔγϣϯΛ࣮Քಇʹ͍࣋ͬͯ͘ࡍʹ࣋ͨͳͯ͘͸ͳΒͳ͍ɺ 8FCΞϓϦέʔγϣϯͷϚΫϩͳηΩϡϦςΟ؍఺ΛओʹऔΓѻ͍͖ͬͯ·͢ɻ ‣ ࠷ઌ୺ͷ8FCηΩϡϦςΟྖҬʹڵຯΛֶ࣋ͬͨੜΛ૿΍͢͜ͱɻ ‣ ͥͻ๻ͱҰॹʹ8FCηΩϡϦςΟʹ͍ͭͯߟ͍͖͑ͯ·͠ΐ͏ʂ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ͱ΋ɺߨٛ͸࣌ؒΆ͖ͬΓͳͷͰʜ ‣ ߨٛ͸I͔͋͠Γ·ͤΜ͔ΒɺԿ΋͔΋͓఻͑Ͱ͖ΔΘ͚Ͱ͸͋Γ·ͤΜ ‣ ͔͠͠ɺ͜ͷݶΒΕͨ࣌ؒͷதͰɺҎԼΛఏڙͰ͖ͨΒͱࢥ͍ͬͯ·͢ɻ ‣ ֶशͷ౔୆Λங͘ػձ ‣
ຊߨٛͰ͸ɺ͸͡Ίʹɺ8FCηΩϡϦςΟྖҬͷ֓؍ʹ͍ͭͯऔΓѻ͍·͢ɻ ‣ ຊߨٛʹඞཁͳൣғͷ஌ࣝ͸ɺͰ͖Δ͚ͩTFMGDPOUBJOFEͳܗͰऔΓѻ͍·͢ɻ ‣ 8FCηΩϡϦςΟྖҬͷֶशΛਐΊ͍ͯ͘Լ஍Λ࡞Γ·͠ΐ͏ɻ ‣ ֶशͷࢦ਑ΛಘΔػձ ‣ 0QUJPOBMͱ͍͏෇ه͕͋Δԋश͸ɺΑΓਂ͘ߨٛͷຊےΛֶͿͨΊͷ΋ͷͰ͢ɻ ‣ "EWBODFEͱ͍͏෇ه͕͋Δԋश͸ɺߨٛͷຊےͱ͸ඞͣ͠΋ؔ܎ͷͳ͍ɺൃలత ͳ࿩୊ΛֶͿͨΊͷ΋ͷͰ͢ɻ ‣ ʮ͜͏͍͏ੈք͕͋ΔΜͩʯͱ͍͏ؾ͖ͮΛͨ͘͞Μಘͯ΋Β͑Δͱخ͍͠Ͱ͢ɻ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ͦͷଞ஫ҙࣄ߲ ‣ ຊߨٛ͸߈ܸٕज़ʹؔ͢Δઆ໌ΛؚΜͰ͍·͢ɻ ‣ ͜ͷΑ͏ͳઆ໌Λఏڙ͍ͯ͠Δͷ͸ɺडߨऀͷօ༷ʹݪཧ΍ϦεΫΛ͔ͬ͠Γͱ ཧղ͍ͯͨͩͨ͘͠ΊͰ͋Γɺ൜ࡑߦҝΛॿ௕͢ΔͨΊͰ͸͋Γ·ͤΜɻ ‣ αΠόʔηΩϡϦςΟؔ࿈๏੍΍ٕज़ऀྙཧʹ൓͠ͳ͍ߦಈΛٻΊ·͢ɻ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ͓͠ͳ͕͖ ‣ $IBQUFS͍·ͷʮ8FCηΩϡϦςΟʯͱ͸ ‣ 8FCηΩϡϦςΟͳΔ޿େͳྖҬͷதͷԿΛຊߨ͕ٛऔΓѻ͏ͷ͔Λ໌ྎʹ͠·͢ɻ ‣ $IBQUFSҰ؏ੑΛอͪͳ͕Βͭͳ͛Δ ‣
$IBQUFSͰಋೖ͢Δ؍఺ͷҰͭͰ͋Δɺιϑτ΢ΣΞؒͷҰ؏ੑʢ$SPTTTPGUXBSF *ODPOTJTUFODZʣʹ͍ͭͯऔΓѻ͍·͢ɻ ‣ $IBQUFSαΠυνϟωϧ߈ܸͷجૅ ‣ $IBQUFSͰಋೖ͢Δ؍఺ͷҰͭͰ͋Δɺ8FCΞϓϦέʔγϣϯͷαΠυνϟωϧ଱ ੑʹ͍ͭͯऔΓѻ͍·͢ɻ

͍·ͷʮ8FCηΩϡϦςΟʯͱ͸ $IBQUFS

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ͍·ͷʮ8FCηΩϡϦςΟʯͱ͸ ‣ 8FCηΩϡϦςΟྖҬͷؔ৺Λ੔ཧ͍ͯͨ͘͠Ίʹ͸ɺݱঢ়ͷ8FCͷ֓؍Λ ʢେࡶ೺Ͱྑ͍ͷͰʣ௫ΜͰ͓͘ඞཁ͕͋Δɻ ‣ ͦ͜Ͱɺ͔͜͜Β͸ɺ͜ͷΑ͏ͳྲྀΕͰ࿩ΛਐΊ͍ͯ͘ɻ ‣ ·ͣ8FCશମΛ޿͘ݟ౉͢ʢ4FDUJPOʣɻ
‣ ݟ౉ͨ͠ཁૉͷ͏ͪɺαʔόαΠυ8FCγεςϜʹ͋ͨΔ෦෼ͷߏ੒ཁૉΛɺຊߨٛ ͰඞཁͳൣғͰ֬ೝ͢Δʢ4FDUJPOd4FDUJPOʣɻ ‣ ͦͷ্Ͱɺ8FCηΩϡϦςΟʹ͍ͭͯߟ͑Δʢ4FDUJPOʣɻ

8FCΛΈΘͨ͢ $IBQUFS4FDUJPO

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FCΛΈΘͨ͢ ‣ 8FCΞϓϦέʔγϣϯ͸ɺΫϥΠΞϯταΠυͷγεςϜʢFH8FCϒϥ΢ βʣͱαʔόαΠυͷγεςϜʢFH8FCαʔό΍ΞϓϦέʔγϣϯαʔόʣ ͕௨৴͠ɺڠௐಈ࡞͢Δ͜ͱʹΑΓ੒Γཱ͍ͬͯΔɻ αʔόαΠυ 8FCγεςϜ
ΫϥΠΞϯταΠυ 8FCγεςϜ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ‣ 8FCϒϥ΢β্Ͱ͸ଟ͘ͷ8FCϖʔδ͕ฒߦͯ͠؅ཧɾॲཧ͞Ε͍ͯΔɻ ‣ ۙ೥͸4JOHMF1BHF"QQMJDBUJPOʢ41" ͱݺ͹ΕΔܗଶͷ8FCϖʔδ͕૿͑ɺ༷ʑͳ ϩδοΫ͕8FCϖʔδʹࡌΔΑ͏ʹͳ͖͍ͬͯͯΔɻ ΫϥΠΞϯταΠυ8FCγεςϜ
8FCϒϥ΢β

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ‣ αʔόαΠυͷ8FCγεςϜ΋αʔόαΠυ8FCΞϓϦέʔγϣϯͱɺϛυ ϧ΢ΣΞʢσʔλετΞ΍ϩʔυόϥϯα౳ʣ͕͏·͘ڠௐಈ࡞͢Δ͜ͱʹΑΓ ࣮ݱ͞Ε͍ͯΔɻ αʔόαΠυ8FCγεςϜ ϛυϧ΢ΣΞ αʔόαΠυ8FCΞϓϦέʔγϣϯ
αʔόαΠυ8FCγεςϜ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ αʔόαΠυ8FCγεςϜ ΋͏͢͜͠ϒϨΠΫμ΢ϯ͢Δ ͲΜͳ΋ͷ͕͋Δʁ ˠ4FDUJPOͰ֬ೝ ϛυϧ΢ΣΞ αʔόαΠυ8FCΞϓϦέʔγϣϯ ͲΜͳ;͏ʹ࡞Δʁ
ˠ4FDUJPOͰ֬ೝ Ͳ͏΍ͬͯಈ͔͢ʁ ˠ4FDUJPOͰ֬ೝ

αʔόαΠυ8FCΞϓϦέʔγϣϯͷ ΞʔΩςΫνϟ $IBQUFS4FDUJPO

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ యܕతͳΞʔΩςΫνϟ ‣ αʔόαΠυ8FCΞϓϦέʔγϣϯͷయܕతͳΞʔΩςΫνϟ ‣ .POPMJUIJD"SDIJUFDUVSF ‣ ෳ਺ͷػೳΛେ͖ͳͭͷΞϓϦέʔγϣϯͱͯ͠ߏ੒͢ΔΞʔΩςΫνϟ ‣
.JDSPTFSWJDFT"SDIJUFDUVSF ‣ ۀ຿ػೳ΍νʔϜΛ୯Ґͱͯ͠ಠཱͨ͠αʔϏεʢ.JDSPTFSWJDFʣΛ࡞ΓɺͦΕΒ ͷ૯ମͱͯ͠ΞϓϦέʔγϣϯΛߏ੒͢ΔΞʔΩςΫνϟ .POPMJUIJD"SDIJUFDUVSF .JDSPTFSWJDFT"SDIJUFDUVSF

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ‣ ෳ਺ͷػೳ͕ͭͷΞϓϦέʔγϣϯʹ٧Ί͜·ΕΔΞʔΩςΫνϟͷ͜ͱɻ .POPMJUIJD"SDIJUFDUVSF ػೳ ػೳ ػೳ ػೳ
ػೳ ػೳ αʔόαΠυ8FCΞϓϦέʔγϣϯ ‣ ༷ʑͳཁૉ͔ΒͳΔ ‣ ϓϨθϯςʔγϣϯ૚ ‣ ϏδωεϩδοΫ૚ ‣ σʔλετΞΛऔΓѻ͏૚ ‣ ʜ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ .POPMJUIJD"SDIJUFDUVSF ߏ੒ͷΠϝʔδ ػೳ ػೳ ػೳ ػೳ ػೳ
ػೳ αʔόαΠυ8FCγεςϜ αʔόαΠυ8FCΞϓϦέʔγϣϯ ϩʔυόϥϯα౳ σʔλετΞ౳

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ‣ ෳ਺ͷػೳ͕ͭͷΞϓϦέʔγϣϯʹ٧Ί͜·ΕΔΞʔΩςΫνϟͷ͜ͱɻ .POPMJUIJD"SDIJUFDUVSF ՝୊ ػೳ ػೳ
ػೳ ػೳ ػೳ ػೳ αʔόαΠυ8FCΞϓϦέʔγϣϯ ‣ ༷ʑͳཁૉ͔ΒͳΔ ‣ ϓϨθϯςʔγϣϯ૚ ‣ ϏδωεϩδοΫ૚ ‣ σʔλετΞΛऔΓѻ͏૚ ‣ ʜ ίʔυϕʔε͕༰қʹ ංେԽͯ͠͠·͏

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ .POPMJUIJD"SDIJUFDUVSF ՝୊ ػೳ ػೳ ػೳ ػೳ
ػೳ ػೳ αʔόαΠυ8FCγεςϜ αʔόαΠυ8FCΞϓϦέʔγϣϯ σʔλετΞ౳ ϩʔυόϥϯα౳ εέʔϧ͚ͤͨ͞Ε͹શମΛ ಈ࡞ͤ͞ͳͯ͘͸͍͚ͳ͍

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ .JDSPTFSWJDFT"SDIJUFDUVSF ‣ ۀ຿ػೳ΍νʔϜΛ୯Ґͱͯ͠ಠཱͨ͠αʔϏεʢ.JDSPTFSWJDFʣΛ࡞Γɺͦ ΕΒͷ૯ମͱͯ͠ΞϓϦέʔγϣϯΛߏ੒͢Δɺͱ͍͏ΞʔΩςΫνϟͷ͜ͱɻ ‣ Ͳ͏෼ׂʢ%FDPNQPTFʣ͢Δͷ͕࠷ద͔͸ॾઆ͋Δɻ .JDSPTFSWJDF
.JDSPTFSWJDF .JDSPTFSWJDF .JDSPTFSWJDF .JDSPTFSWJDF

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ .JDSPTFSWJDFT"SDIJUFDUVSF "1*(BUFXBZ1BUUFSOʹΑΔߏ੒ͷΠϝʔδ αʔόαΠυ8FCγεςϜ ڞ༗σʔλετΞ ήʔτ΢ΣΠ .JDSPTFSWJDF .JDSPTFSWJDF
.JDSPTFSWJDF .JDSPTFSWJDF

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ .JDSPTFSWJDFT"SDIJUFDUVSF ‣ ۀ຿ػೳ΍νʔϜΛ୯Ґͱͯ͠ಠཱͨ͠αʔϏεʢ.JDSPTFSWJDFʣΛ࡞Γɺͦ ΕΒͷ૯ମͱͯ͠ΞϓϦέʔγϣϯΛߏ੒͢Δɺͱ͍͏ΞʔΩςΫνϟɻ ‣ Ͳ͏෼ׂʢ%FDPNQPTFʣ͢Δͷ͕࠷ద͔͸ॾઆ͋Δɻ .JDSPTFSWJDF
.JDSPTFSWJDF .JDSPTFSWJDF .JDSPTFSWJDF .JDSPTFSWJDF ίʔυϕʔε͕શମతʹૄ݁ ߹ʹͳΔ͜ͱ͕ظ଴Ͱ͖Δ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ .JDSPTFSWJDFT"SDIJUFDUVSF ‣ ۀ຿ػೳ΍νʔϜΛ୯Ґͱͯ͠ಠཱͨ͠αʔϏεʢ.JDSPTFSWJDFʣΛ࡞Γɺͦ ΕΒͷ૯ମͱͯ͠ΞϓϦέʔγϣϯΛߏ੒͢Δɺͱ͍͏ΞʔΩςΫνϟɻ ‣ Ͳ͏෼ׂʢ%FDPNQPTFʣ͢Δͷ͕࠷ద͔͸ॾઆ͋Δɻ .JDSPTFSWJDF
.JDSPTFSWJDF .JDSPTFSWJDF .JDSPTFSWJDF .JDSPTFSWJDF খ͍͞୯ҐͷσϓϩΠ͕ ͠΍͘͢ͳΔ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ .JDSPTFSWJDFT"SDIJUFDUVSF "1*(BUFXBZ1BUUFSOʹΑΔߏ੒ͷΠϝʔδ αʔόαΠυ8FCγεςϜ ڞ༗σʔλετΞ ήʔτ΢ΣΠ .JDSPTFSWJDF .JDSPTFSWJDF
.JDSPTFSWJDF .JDSPTFSWJDF ͏·͘΍Ε͹.JDSPTFSWJDF ୯ҐͰεέʔϧͤ͞ΒΕΔ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ۜͷ஄ؙ͸ͳ͍ ‣ .POPMJUIJD"SDIJUFDUVSFΑΓ.JDSPTFSWJDFT"SDIJUFDUVSFΛ࠾༻͢Δ৔߹ͷ ΄͏͕ͭΒ͍͜ͱ΋໪࿦͋Δɻ ‣ τϥϯβΫγϣϯ؅ཧ ‣ ͨ͘͞ΜͷΠϯλʔϑΣΠεఆٛ
‣ αʔϏεؒͷґଘؔ܎ͷ؅ཧ ‣ FUD ‣ ؔ৺ͷ෼཭ʹΑΔޮ཰Խͱɺ෼཭ͷͨΊͷੜ͡ΔΦʔόʔϔουͷͤΊ͍͕͗͋ ൃੜ͢Δ͜ͱΛɺ࠾༻࣌ʹ͸೦಄ʹஔ͘ͱΑ͍͔΋͠Εͳ͍ɻ ‣ 8FCͷจ຺Ͱͷ.POPMJUIJD"SDIJUFDUVSFWT.JDSPTFSWJDFT"SDIJUFDUVSFͱ͍ ͏࿩୊ʹݶΒͣɺʮૄ݁߹ʯΛ࣮ݱ͠Α͏ͱ͢Δͱɺେମಉ͡Α͏ͳนʹͿ͔ͭΔʜ

αʔόαΠυ8FCγεςϜͷ ࣮ߦ؀ڥ $IBQUFS4FDUJPO

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ‣ ࡞ͬͨΞϓϦέʔγϣϯ͸ɺಈ͔ͯ͠Α͏΍͘໾ʹཱͭɻ ‣ ಈ͔ͨ͢Ίʹ͸ʜ ‣ ಈ͔ͨ͢Ίͷ౔୆ʢҎ࣮߱ߦج൫ͱݺͿʣ͕ඞཁ ‣ ϛυϧ΢ΣΞ͕ඞཁ
ΞϓϦέʔγϣϯΛಈ͔ͨ͢Ίʹ ϛυϧ΢ΣΞ αʔόαΠυ8FCΞϓϦέʔγϣϯ αʔόαΠυ8FCγεςϜ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ࣮ߦج൫Λ͔Β४උ͢Δͷ͸େม ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ ؔ਺ ؔ਺
‣ αʔϏεΛӡ༻͢ΔͨΊʹϋʔυ΢ΣΞ͔Β༻ҙ͢Δ৔߹ʜ ‣ ૿΍͢ͷʹ΋ݮΒ͢ͷʹ΋ʹؾ߹͕ඞཁʹͳΔɻ ‣ ૿΍ͦ͏ʹ΋ߪೖʹ͕͔͔࣌ؒΔ ‣ ݮΒͨ͢Ίʹ͸ద੾ʹഇغ͢Δඞཁ͕͋Δ ‣ ʮյΕ͏Δʯͱ͍͏ҙࣝΛڧ࣋ͨ͘Ͷ͹ͳΒͳ͍ɻ ‣ ؒҧͬͯػثʹίʔώʔΛ͜΅͢ͱյΕΔ ‣ ಈ͔͠ଓ͚͍ͯΔ͚ͩͰ΋յΕΔ ‣ ͏·͘΍͍ͬͯ͘ʹ͸े෼ͳઐ໳ੑͱܦݧ͕ඞཁͰ͋Δɻ ‣ ͭΒ͍ ˞Ϋϥ΢υ؀ڥʹ΋େن໛ো֐͸ͨ·ʹ͋ΔͷͰɺʮյΕΔʯ͜ͱΛҙࣝ͠ͳͯ͘͸͍͚ͳ͍ͷ͸ ෺ཧػثΛऔΓѻ͏৔߹ಛ༗ͷͭΒ͞ɺͱ͍͏Θ͚Ͱ͸ͳ͍͕ʜ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ࣮ߦج൫ͷԾ૝Խɾந৅Խͷਐߦ ‣ ௕೥ʹ౉ͬͯΞϓϦέʔγϣϯͷ࣮ߦج൫ͷԾ૝Խɾந৅Խ͕ਐΊΒΕ͖ͯͨɻ ‣ *OGSBTUSVDUVSFBTB4FSWJDF *BB4 ‣
1MBUGPSNBTB4FSWJDF 1BB4 ‣ $POUBJOFSBTB4FSWJDFʢ$BB4ʣ ‣ 'VODUJPOBTB4FSWJDF 'BB4 ‣ ࠓͰ͸ඇৗʹखܰʹ࣮ߦج൫͕࡞੒ɾഁغͰ͖ΔΑ͏ʹͳ͍ͬͯΔɻ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 9BB4͕ఏڙ͢ΔൣғʢΠϝʔδʣ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ *BB4͕ఏڙ͢Δج൫ ؔ਺
ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ $BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ 1BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ 'BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ࣮ߦج൫ͷԾ૝Խɾந৅Խͷਐߦ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ *BB4͕ఏڙ͢Δج൫ ؔ਺
ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ $BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ 1BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ 'BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ϋʔυ΢ΣΞ͸9BB4ఏڙଆ͕ ؅ཧͯ͘͠ΕΔˠخ͍͠ʂ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ࣮ߦج൫ͷԾ૝Խɾந৅Խͷਐߦ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ *BB4͕ఏڙ͢Δج൫ ؔ਺
ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ $BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ 1BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ 'BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ͍Ζ͍Ζ؅ཧͯ͘͠ΕΔͷͰɺࣗ ෼͕औΓѻ͏΂͖ϨΠϠ͚ͩʹؔ ৺ΛڱΊΒΕΔˠخ͍͠ʂ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ΠϯϑϥετϥΫνϟͷίʔυԽ ‣ Ծ૝Խɾந৅Խ͞Εɺϋʔυ΢ΣΞͷ ΍Γ͘Γ͕Ӆṭ͞ΕͨΞϓϦέʔγϣ ϯ࣮ߦج൫͸ɺ΄΅७ਮͳιϑτ΢Σ Ξͱಉ౳ʹऔΓѻ͑ΔΑ͏ʹɻ ‣ ίϚϯυҰͭͰԾ૝ϚγϯΠϯελϯε
Λ֬อͨ͠Γʜ ‣ ίʔυʹΑΓΠϯϑϥετϥΫνϟͷߏ ੒Λهड़ɾ؅ཧͨ͠Γʜ ‣ ॴҦ*OGSBTUSVDUVSFBT$PEFʢ*B$ʣ ‣ ຊߨٛͷԋश؀ڥ΋5FSSBGPSNͰߏ ੒͕هड़ɾ؅ཧ͞Ε͍ͯΔɻ resource "google_container_cluster" "challenge_cluster" { name = "challenges" location = "asia-northeast1" initial_node_count = 1 cluster_autoscaling { enabled = true resource_limits { resource_type = "cpu" minimum = 3 maximum = 32 } resource_limits { resource_type = "memory" minimum = 3 maximum = 32 } } ...

αʔόαΠυ8FCγεςϜͷ ϛυϧ΢ΣΞ $IBQUFS4FDUJPO

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ΞϓϦέʔγϣϯΛࢧ͑Δଘࡏ ‣ ΞϓϦέʔγϣϯ͸ଟ͘ͷϛυϧ΢ΣΞʹࢧ͑ΒΕͯಈ࡞͢Δɻ ‣ σʔλετΞʢ,743%#ʣ ‣ ϩʔυόϥϯα ‣
8FC"QQMJDBUJPO'JSFXBMM ‣ FUD ϛυϧ΢ΣΞ αʔόαΠυ8FCΞϓϦέʔγϣϯ αʔόαΠυ8FCγεςϜ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ϛωʔδυͳϛυϧ΢ΣΞ ‣ ϚωʔδυͳܗͰఏڙ͞Ε͍ͯΔϛυϧ΢ΣΞ΋ͨ͘͞Μ͋Δɻ ‣ σʔλετΞͷྫ ‣ $MPVE42-΍"NB[PO3%4ͷΑ͏ͳ3%# ‣
$MPVE%BUBTUPSF΍%ZOBNP%#ͷΑ͏ͳ,74 ‣ FUD ‣ ηΩϡϦςΟؔ࿈ͷػೳΛऔΓѻͬͯ͘ΕΔϛυϧ΢ΣΞͷྫ ‣ ΞΫηε੍ޚʹศརͳ$MPVE*EFOUJUZ"XBSF1SPYZ ‣ "848"'ͷΑ͏ͳ8"' ‣ FUD

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ʮ૊Έ߹ΘͤΔ͜ͱͰ࡞Δʯ ‣ ·ͱΊΔͱɺΞϓϦέʔγϣϯͷ࣮ߦج൫΍ϛυϧ΢ΣΞ͸ʜ ‣ ϋʔυ΢ΣΞͷ੍໿͕ʢΫϥ΢υϕϯμʹΑΓʣ͏·͘Ӆṭ͞ΕΔΑ͏ʹͳͬͨɻ ‣ ༰қʹมߋ΍औࣺબ୒͕Ͱ͖ΔΑ͏ʹͳͬͨɻ ‣
ΞϓϦέʔγϣϯ։ൃͱ͍ۙํ๏Ͱߏ੒Ͱ͖ΔΑ͏ʹͳͬͨɻ ‣ ݁Ռɺʮ૊Έ߹ΘͤΔ͜ͱͰ࡞ΔʯతΞϓϩʔν͕औΓ΍͘͢ͳͬͨɻ ‣ ݱ୅ͷ8FCΞϓϦέʔγϣϯʹٻΊΒΕ͍ͯΔʮ౰ͨΓલ඼࣭ʯʢDGङ໺Ϟσϧʣ͸ߴ͍ɻ ‣ ྫෳࡶͳػೳཁ݅ ߴՄ༻ੑ ߴ଎ͳಈ࡞ ‣ શ෦͔Β࡞ΕΔͷ͸͔͍͍͕ͬ͜ɺߴ͍ʮ౰ͨΓલ඼࣭ʯΛୡ੒͢Δͷ͸ࠔ೉ɻ ‣ ৴པͰ͖Δ΋ͷΛ૊Έ߹ΘͤΔ͜ͱͰɺϕʔεͷʮ౰ͨΓલ඼࣭ʯΛఈ্͛͠ͳ͕Βɺ ࣗ෼͕࣮ݱ͢Δ΂͖͜ͱʹ஫ྗ͢Δ͜ͱ͕Ͱ͖Δʢخ͍͠ʂʣ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ʮܗͰߟ͑ΔαʔόʔϨεઃܭʯ IUUQTBXTBNB[PODPNKQTFSWFSMFTTQBUUFSOTTFSWFSMFTTQBUUFSO

8FCηΩϡϦςΟ $IBQUFS4FDUJPO

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FCηΩϡϦςΟ ‣ ٞ࿦ͷൣғΛ໌֬ʹ͢ΔͨΊʹɺҎޙ͸ʮ8FCηΩϡϦςΟʯͱ͍͏ྖҬΛɺ ҎԼͷྖҬʹ෼͚ͯߟ͑Δɻ ‣ ΫϥΠΞϯταΠυ8FCγεςϜͷηΩϡϦςΟ ‣ αʔόαΠυ8FCγεςϜͷηΩϡϦςΟ
αʔόαΠυ 8FCγεςϜ ΫϥΠΞϯταΠυ 8FCγεςϜ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FCηΩϡϦςΟ ‣ ٞ࿦ͷൣғΛ໌֬ʹ͢ΔͨΊɺҎޙ͸ʮ8FCηΩϡϦςΟʯͱ͍͏ྖҬΛɺҎ ԼͷྖҬʹ෼͚ͯߟ͑Δɻ ‣ ΫϥΠΞϯταΠυ8FCγεςϜͷηΩϡϦςΟ ‣ αʔόαΠυ8FCγεςϜͷηΩϡϦςΟ
αʔόαΠυ 8FCγεςϜ ΫϥΠΞϯταΠυ 8FCγεςϜ ͪ͜Β͸ࠓ೔ͷߨٛͰ͸ׂѪ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FCηΩϡϦςΟ ‣ ٞ࿦ͷൣғΛ໌֬ʹ͢ΔͨΊɺҎޙ͸ʮ8FCηΩϡϦςΟʯͱ͍͏ྖҬΛɺҎ ԼͷྖҬʹ෼͚ͯߟ͑Δɻ ‣ ΫϥΠΞϯταΠυ8FCγεςϜͷηΩϡϦςΟ ‣ αʔόαΠυ8FCγεςϜͷηΩϡϦςΟ
αʔόαΠυ 8FCγεςϜ ΫϥΠΞϯταΠυ 8FCγεςϜ ͪ͜ΒΛηΩϡΞʹอͭʹ͸Ͳ͏͢Ε͹ʁ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ αʔόαΠυ8FCγεςϜͷηΩϡϦςΟ ΞϓϦέʔγϣϯΞʔΩςΫνϟͷมԽΛ࠶ߟ͢Δ αʔόαΠυ8FCγεςϜ ڞ༗σʔλετΞ ήʔτ΢ΣΠ .JDSPTFSWJDF .JDSPTFSWJDF
.JDSPTFSWJDF .JDSPTFSWJDF ϙΠϯτ੹຿ͷ෼ࢄ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ αʔόαΠυ8FCγεςϜͷηΩϡϦςΟ ΞϓϦέʔγϣϯΞʔΩςΫνϟͷมԽΛ࠶ߟ͢Δ αʔόαΠυ8FCγεςϜ ڞ༗σʔλετΞ ήʔτ΢ΣΠ .JDSPTFSWJDF .JDSPTFSWJDF
.JDSPTFSWJDF .JDSPTFSWJDF ϙΠϯτ࿈ܞͷ૿Ճ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ‣ ΞϓϦέʔγϣϯͷ࣮ߦج൫΍ϛυϧ΢ΣΞ͸ʜ ‣ ϋʔυ΢ΣΞͷ੍໿͕ʢΫϥ΢υϕϯμʹΑΓʣ͏·͘Ӆṭ͞ΕΔΑ͏ʹͳͬͨɻ ‣ ༰қʹมߋ΍औࣺબ୒͕Ͱ͖ΔΑ͏ʹͳͬͨɻ ‣ ΞϓϦέʔγϣϯ։ൃͱ͍ۙํ๏Ͱߏ੒Ͱ͖ΔΑ͏ʹͳͬͨɻ
‣ ݁Ռɺʮ૊Έ߹ΘͤΔ͜ͱͰ࡞ΔʯతΞϓϩʔν͕औΓ΍͘͢ͳͬͨʂ ‣ ݱ୅ͷ8FCΞϓϦέʔγϣϯʹٻΊΒΕ͍ͯΔʮ౰ͨΓલ඼࣭ʯ͸ߴ͍ɻ ‣ ྫෳࡶͳػೳཁ݅ ߴՄ༻ੑ ߴ଎ͳಈ࡞ ‣ ࢀߟङ໺Ϟσϧ ‣ શ෦͔Β࡞ΕΔͷ͸͔͍͍͕ͬ͜ɺߴ͍ʮ౰ͨΓલ඼࣭ʯΛୡ੒͢Δͷ͸ࠔ೉ɻ ‣ ৴པͰ͖Δ΋ͷΛ૊Έ߹ΘͤΔ͜ͱͰɺϕʔεͷʮ౰ͨΓલ඼࣭ʯΛఈ্͛͠ͳ͕Βɺ ࣗ෼͕࣮ݱ͢Δ΂͖͜ͱʹ஫ྗ͢Δ͜ͱ͕Ͱ͖Δɻ αʔόαΠυ8FCγεςϜͷηΩϡϦςΟ ߏ੒ɾ࣮ߦ؀ڥͷมԽΛ࠶ߟ͢Δ ϙΠϯτ࿈ܞͷ૿Ճ ϙΠϯτಈ࡞ج൫ͷଟ༷Խ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ αʔόαΠυ8FCγεςϜͷηΩϡϦςΟ มԽ͔Β࠶ߟ͢Δ ‣ αʔόαΠυ8FCγεςϜ͕ܴ͑ͨมԽ ‣ ੹຿ͷ෼ࢄʜݩདྷαʔόαΠυ8FCΞϓϦέʔγϣϯͷ࣮૷தͰըҰత ʹऔΓѻΘΕ͍ͯͨ੹຿͕ɺ෼ࢄ͢ΔΑ͏ʹͳͬͨɻ ‣
࿈ܞͷ૿Ճʜͭͷૢ࡞ͷ࣮ݱͷͨΊʹɺෳ਺ͷιϑτ΢ΣΞ͕ؒ࿈ܞ͠ ͯಈ͘͜ͱ͕૿͖͑ͯͨɻ ‣ ಈ࡞ج൫ͷଟ༷ԽʜΞϓϦέʔγϣϯͷಈ࡞ج൫͕ɺ։ൃऀ͕༰қʹऔΓ ѻ͑Δର৅΁ͱมԽͨ͠ɻ ‣ ͦ͜Ͱɺ͜ͷྖҬͷηΩϡϦςΟΛɺҎԼͷ؍఺ʹ෼ׂͯ͠ߟ͑ͯΈΑ͏ɻ ‣ ηΩϡΞʹͭ͘Δ ‣ ηΩϡΞʹͭͳ͛Δ ‣ ηΩϡΞʹ͏͔͢͝

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ηΩϡΞʹͭ͘Δ ‣ ·ͣ͸ίϯϙʔωϯτͷ֤ʑ͕ηΩϡΞʹ࡞ΒΕ͍ͯΔ͜ ͱ͕ɺ͢΂ͯͷେલఏɻ ‣ ·ͣ͸ʰମܥతʹֶͿ҆શͳ8FCΞϓϦέʔγϣϯͷ࡞Γ ํʱʢ௨শಙؙຊʣΛҰ௨Γಡ΋͏ɻ ‣
8FCʹ·ͭΘΔجૅతͳ੬ऑੑΛɺ͜ͷߨٛ࣌ؒͷதͰҰ௨Γ औΓѻ͏ͷ͸೉͍͠ͷͰʜ ‣ ຊߨٛͰ͸ۙ೥੝Γ্͕͍ͬͯΔτϐοΫͱͯ͠ɺαΠυ νϟωϧ߈ܸʹ͍ͭͯͷΈऔΓѻ͏ɻ .JDSPTFSWJDF ػೳ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ηΩϡΞʹͭͳ͛Δ ‣ ࡞ͬͨίϯϙʔωϯτಉ࢜͸ηΩϡΞʹͭͳ͛ΒΕ͍ͯΔ͔Ͳ͏͔ɺͱ͍͏؍఺ ΋ඇৗʹॏཁʹͳ͖͍ͬͯͯΔɻ ‣ ຊߨٛͰ͸ɺʮηΩϡΞʹͭͳ͛Δʯͱ͍͏ߦҝΛɺ͞ΒʹҎԼͷͭʹϒϨΠ Ϋμ΢ϯͯ͠ߟ͍͑ͯ͘ɻ ‣
ηΩϡΞͳܦ࿏Ͱͭͳ͛Δ ‣ Ұ؏ੑΛอͪͳ͕Βͭͳ͛Δ .JDSPTFSWJDF .JDSPTFSWJDF ϛυϧ΢ΣΞ ΞϓϦέʔγϣϯ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ηΩϡΞʹͭͳ͛Δ ηΩϡΞͳܦ࿏Ͱͭͳ͛Δ ‣ αʔϏεؒͷ௨৴ΛͲ͏ηΩϡΞʹߦ͏͔ɺ΋ඇৗʹॏཁͳ؍఺ɻ ‣ αʔϏεؒͷ௨৴ܦ࿏ʹ͸౪ௌɾվ͟ΜΛૂ͏߈ܸऀ͕͍Δ͔΋ʜ ‣ ͭͷίϯϙʔωϯτ͕৵֐͞ΕΔ͜ͱͰɺࢥΘ͵ͱ͜Ζ͔Β௨৴͕ߦͳΘ
ΕΔ͔΋͠Εͳ͍ʜ ‣ ຊߨٛͰ͸औΓѻΘͳ͍͕ɺ༷ʑͳϓϨΠϠʔ͕ؤு͍ͬͯΔͷͰɺ௥͍͔͚ͯ ΈΔͱָ͍͔͠΋͠Εͳ͍ɻ ‣ ྫ*TUJPͳͲͷ4FSWJDF.FTIϓϩμΫτͳͲ ‣ ͍ΘΏΔθϩτϥετϞσϧ͕ࠜఈʹ͋Δ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ‣ ͭͷγεςϜͷ࣮ݱʹؔΘΔʜ ‣ ࢓༷͕૿͑Δ΄ͲɺͦΕΒͷ࢓༷ؒͷҰ؏ੑ͕໰୊ʹͳΔ͜ͱ΋૿͑Δɻ ‣ ιϑτ΢ΣΞ͕૿͑Δ΄ͲɺͦΕΒͷ࣮૷ؒͷҰ؏ੑ͕໰୊ʹͳΔ͜ͱ΋૿͑Δɻ ‣ ຊߨٛͰ͸ɺʢ8FCʹؔ࿈ͨ͠ʣҰ؏ੑͷܽ೗͕ট͘໰୊ͷྫͷ͏ͪɺҎԼΛऔΓ্͛Δɻ
‣ )5513FRVFTU4NVHHMJOH ‣ Ωϟογϡʹؔ࿈ͨ͠߈ܸ ‣ ϨεϙϯεϘσΟͷੜ੒ʹؔΘΔॲཧܥͷ࢓༷ࠩΛར༻ͨ͠߈ܸ ηΩϡΞʹͭͳ͛Δ Ұ؏ੑΛอͪͳ͕Βͭͳ͛Δ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ηΩϡΞʹ͏͔͢͝ ‣ ಈ࡞ج൫ΛηΩϡΞʹอͭ͜ͱ΍ɺͦͷಈ࡞ج൫ಛ༗ͷηΩϡϦςΟϦεΫΛ೺ Ѳͭͭ͠ΞϓϦέʔγϣϯΛ։ൃ͢Δɺͱ͍͏ͷ΋ͭͷେࣄͳ؍఺ɻ ‣ ࣌ؒͷ౎߹্औΓѻ͑ͳ͍͕ɺۙ೥͸͜ͷτϐοΫʹֶ͍ͭͯͿͨΊͷϚςϦΞ ϧ͕ͲΜͲΜ૿͖͍͑ͯͯΔͷͰɺֶͼ΍͘͢ͳ͖͍ͬͯͯΔɻ ‣
/*4541ͷΑ͏ͳΨΠυϥΠϯ ‣ #VTUB,VCFͷΑ͏ͳϋϯζΦϯϚςϦΞϧ ‣ IUUQTDPOUBJOFSTFDVSJUZEFWͷΑ͏ͳจݙ ‣ FUD

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ ͍·ͷʮ8FCηΩϡϦςΟʯͱ͸ αʔόαΠυ 8FCγεςϜ ΫϥΠΞϯταΠυ 8FCγεςϜ ‣
ٞ࿦ͷൣғΛ໌֬ʹ͢ΔͨΊʹɺҎޙ͸ʮ8FCηΩϡϦςΟʯͱ͍͏ྖҬΛɺ ҎԼͷྖҬʹ෼͚ͯߟ͑Δɻ ‣ ΫϥΠΞϯταΠυ8FCγεςϜͷηΩϡϦςΟ ‣ αʔόαΠυ8FCγεςϜͷηΩϡϦςΟ

͜ͷηΩϡϦςΟΛҎԼͷ̏؍఺͔Βߟ͑Α͏ ‣ ηΩϡΞʹͭ͘Δ ‣ ηΩϡΞʹͭͳ͛Δ ‣ ηΩϡΞʹ͏͔͢͝

͜ͷηΩϡϦςΟΛҎԼͷ̏؍఺͔Βߟ͑Α͏ ‣ ηΩϡΞʹͭ͘Δ ‣ ηΩϡΞʹͭͳ͛Δ ‣ ηΩϡΞʹ͏͔͢͝ ηΩϡΞͳܦ࿏Ͱͭͳ͛Δ Ұ؏ੑΛอͬͯͭͳ͛Δ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ ͍·ͷʮ8FCηΩϡϦςΟʯͱ͸ αʔόαΠυ 8FCγεςϜ ΫϥΠΞϯταΠυ 8FCγεςϜ ;
‣ ͪ͜ΒΛֶͿͨΊͷૉࡐ΋ݱࡏ४උதʜ ‣ ϦϦʔεͰ͖ͨΒ5XJUUFS౳ͰҊ಺͠·͢ɻ ‣ $IFDLJUPVUIUUQTUXJUUFSDPNMNU@TXBMMPX

Ұ؏ੑΛอͪͳ͕Βͭͳ͛Δ $IBQUFS

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ‣ ͭͷγεςϜͷ࣮ݱʹؔΘΔʜ ‣ ࢓༷͕૿͑Δ΄ͲɺͦΕΒͷ࢓༷ؒͷҰ؏ੑ͕໰୊ʹͳΔ͜ͱ΋૿͑Δɻ ‣ ιϑτ΢ΣΞ͕૿͑Δ΄ͲɺͦΕΒͷ࣮૷ؒͷҰ؏ੑ͕໰୊ʹͳΔ͜ͱ΋૿͑Δɻ ‣ ͔͜͜Β͸ɺʢ8FCʹؔ࿈ͨ͠ʣҰ؏ੑͷܽ೗͕ট͘໰୊ͷྫͷ͏ͪɺҎԼΛऔΓ্͛Δɻ
‣ )5513FRVFTU4NVHHMJOH ‣ Ωϟογϡʹؔ࿈ͨ͠߈ܸ ‣ ϨεϙϯεϘσΟͷੜ੒ʹؔΘΔॲཧܥͷ࢓༷ࠩΛར༻ͨ͠߈ܸ Ұ؏ੑΛอͪͳ͕Βͭͳ͛Δ

)5513FRVFTU4NVHHMJOH $IBQUFS4FDUJPO

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ )551ͱ5$1ίωΫγϣϯ ‣ )551d)551ͷ௨৴͸5$1ίωΫγϣϯͷ্ͰߦͳΘΕΔɻ ‣ ˞)551͸26*$ͱ͍͏6%1্ͷτϥϯεϙʔτϓϩτίϧ͕ผ్༻͍ΒΕΔ ‣ )551Ͱ͸ಛผͳϔομΛར༻͠ͳ͍ݶΓɺճϦΫΤετɾϨεϙϯεͷ ૹड৴Λ͢Δͨͼʹ5$1ίωΫγϣϯΛੜ੒ɾഁغ͍ͯͨ͠ɻ
‣ ͜Ε͸8FCϖʔδͷେ͖ͳύϑΥʔϚϯεωοΫʹͳΔɻ ‣ ͍͍ͪͪXBZ)BOETIBLF͕ඞཁͳΘ͚ͳͷͰʜ ΫϥΠΞϯτ 8FCαʔό ͭͷ5$1ίωΫγϣϯ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 5$1ίωΫγϣϯͷ࠶ར༻ ‣ )551ʜConnection: Keep-AliveϔομΛɺίωΫγϣϯͷ࠶ར༻Λࢦ ࣔ͢ΔͨΊʹར༻Ͱ͖Δɻ ‣ )551ʜ͸͡Ί͔ΒConnection: closeϔομʹΑΓίωΫγϣϯͷऴྃ
͕໌ࣔ͞Εͳ͍ݶΓɺίωΫγϣϯ͕࠶ར༻͞ΕΔɻ ‣ )551ʜͭͷίωΫγϣϯ಺ʹετϦʔϜͱ͍͏Ծ૝తͳ૒ํ޲௨৴࿏͕ෳ਺ ઃ͚ΒΕɺ)551ΑΓ΋ߋʹߴ౓ͳܗͰίωΫγϣϯ͕࠶ར༻͞ΕΔɻ ΫϥΠΞϯτ 8FCαʔό ͭͷ5$1ίωΫγϣϯ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ίωΫγϣϯ͕࠶ར༻͞Ε͍ͯΔ༷ࢠ ԋशʢ0QUJPOBMʣ,FFQ"MJWFͷڍಈΛ֬ೝ͢Δ8JSFTIBSLͰݟͯΈΑ͏

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ $POUFOU-FOHUI5SBOTGFS&ODPEJOH ‣ ιέοτதΛྲྀΕΔσʔλͷ͏ͪɺͲ͔͜ΒɾͲ͜·Ͱ͕ϦΫΤετ PSϨεϙ ϯε ͔Λࣔͨ͢Ίʹ͸ɺҎԼͷΑ͏ͳϔομ͕༻͍ΒΕΔɻ ‣ $POUFOU-FOHUIϔομ
‣ 5SBOTGFS&ODPEJOHϔομ ΫϥΠΞϯτ 8FCαʔό

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ $POUFOU-FOHUI ‣ $POUFOU-FOHUIϔομʜϦΫΤετʢPSϨεϙϯεʣͷૹ৴࣌ʹɺϦΫΤε τϘσΟ PSϨεϙϯεϘσΟ ͷαΠζΛ఻͑ΔͨΊͷϔομ ‣ ϦΫΤετ
PSϨεϙϯε ͕ѹॖ͞Ε͍ͯΔ৔߹͸ѹॖޙͷαΠζ͕ࢦఆ͞ΕΔ ‣ ਐ਺Ͱදه͞ΕΔ POST / HTTP/1.1 Host: example.com Content-Length: 8 test\r\n aa ϘσΟͷ௕͞ͷࢦఆ όΠτͷϘσΟ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ‣ 5SBOTGFS&ODPEJOHϔομ ‣ ϦΫΤετ PSϨεϙϯε ͷసૹํࣜΛද͢ϔομ ‣ DIVOLFE΍EFqBUF౳ɺ͍͔ͭ͘ͷσΟϨΫςΟϒ͕ଘࡏ͢Δ
‣ DIVOLFEσΟϨΫςΟϒ͕ࢦఆ͞Εͨ৔߹ ‣ (16 ਐ਺Ͱදه͞ΕͨνϟϯΫͷαΠζ)\r\n(࣮ࡍͷσʔλ)\r\nΛͭͷνϟϯΫͱͯ͠ɺ ίωΫγϣϯ্ʹਵ࣌νϟϯΫ͕ૹ৴͞Ε͍ͯ͘ ‣ αΠζͷνϟϯΫ͕ϦΫΤετ PSϨεϙϯε ͷऴ୺Λҙຯ͢Δ 5SBOTGFS&ODPEJOH POST / HTTP/1.1 Host: example.com Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n సૹʹDIVOLFEํࣜ Λར༻͢Δ͜ͱͷએݴ νϟϯΫ νϟϯΫ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 3'$ʹΑΔͱʜ ‣ *GBNFTTBHFJTSFDFJWFEXJUICPUIB5SBOTGFS&ODPEJOHBOEB$POUFOU -FOHUIIFBEFSpFME UIF5SBOTGFS&ODPEJOHPWFSSJEFTUIF$POUFOU -FOHUI IUUQTUPPMTJFUGPSHIUNMSGDTFDUJPOΑΓҾ༻
‣ ͭ·Γɺ$POUFOU-FOHUIϔομͱ5SBOTGFS&ODPEJOHϔομ͕ͱ΋ʹࢦఆ͞Ε ͨ৔߹͸ɺ$POUFOU-FOHUIϔομ͕ແࢹ͞ΕΔ΂͖Ͱ͋Δɻ POST / HTTP/1.1 Host: example.com Content-Length: 18 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n ແࢹ͞ΕΔ ར༻͞ΕΔ νϟϯΫྻͱͯ͠ ղऍ͞ΕΔ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 3'$ʹΑΔͱʜ ‣ *GBNFTTBHFJTSFDFJWFEXJUIPVU5SBOTGFS&ODPEJOHBOEXJUIFJUIFSNVMUJQMF $POUFOU-FOHUIIFBEFSpFMETIBWJOHEJ⒎FSJOHpFMEWBMVFTPSBTJOHMF $POUFOU-FOHUIIFBEFSpFMEIBWJOHBOJOWBMJEWBMVF UIFOUIFNFTTBHF GSBNJOHJTJOWBMJEBOEUIFSFDJQJFOU.645USFBUJUBTBOVOSFDPWFSBCMFFSSPS *GUIJTJTBSFRVFTUNFTTBHF
UIFTFSWFS.645SFTQPOEXJUIB #BE 3FRVFTU TUBUVTDPEFBOEUIFODMPTFUIFDPOOFDUJPO IUUQTUPPMTJFUGPSH IUNMSGDTFDUJPOΑΓҾ༻ ‣ ͭ·ΓɺϦΫΤετதʹ஋ͷҟͳΔ$POUFOU-FOHUIϔομ͕ෳ਺͋Δͱ͖͸ɺ #BE3FRVFTU͕ฦ٫͞ΕΔ΂͖ɻ POST / HTTP/1.1 Host: example.com Content-Length: 18 Content-Length: 30 ஋͕ҟͳΔ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ͱ΋ɺ࣮ࡍͷιϑτ΢ΣΞͷڍಈ͸ʜ ‣ ࣮ࡍͷιϑτ΢ΣΞͷ࣮૷ͷதʹ͸3'$ͱ͸ҟͳΔڍಈΛऔΔ΋ͷ͕͋ͬͨɻ ‣ ༷ʑͳιϑτ΢ΣΞʹ$7&͕෇༩͞Ε͍ͯΔɻ ‣ ͦ΋ͦ΋3'$ʹ४ڌ͍ͯ͠ͳ͔ͬͨύλʔϯ΍ɺ४ڌ͠Α͏ͱ͍ͯͨ͠΋ͷͷɺ;ͱ͠ ͨσʔλͷਖ਼نԽͷ຤ʹ3'$४ڌͰͳ͘ͳ͍ͬͯͨύλʔϯ΋͋Δɻ
Transfer-Encoding:[\x0b]chunked Transfer-Encoding : xchunked )"1SPYZͰ࢖͑ͨ ߈ܸϕΫλ (PͷOFUIUUQͰ࢖͑ͨ ߈ܸϕΫλ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ‣ ΫϥΠΞϯτ͔Β࣮ࡍͷ8FCΞϓϦέʔγϣϯʹ౸ୡ͢Δ·Ͱͷؒʹ͸ɺ -PBE#BMBODFS౳ͷ)551௨৴Λதܧ͢ΔΑ͏ͳαʔό͕͠͹͠͹ஔ͔ΕΔɻ ‣ Ҏ߱Ͱ͸ศ্ٓʜ ‣ ࣮ࡍͷ8FCΞϓϦέʔγϣϯαʔόΛʮόοΫΤϯυαʔόʯͱݺͿ ‣
ͦͷલͰ)551௨৴Λதܧ͢ΔΑ͏ͳαʔόΛʮϑϩϯτΤϯυαʔόʯͱݺͿ ‣ ˞͜ͷลͷݺͼํ͸IUUQTQPSUTXJHHFSOFUSFTFBSDIIUUQEFTZODBUUBDLTSFRVFTUTNVHHMJOHSFCPSO͔ΒआΓͨ΋ͷ )551௨৴ͷ࿈࠯ ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ )5513FRVFTU4NVHHMJOHʢ)34 ‣ )5513FRVFTU4NVHHMJOHʢ)34ʣʜ͋ΔϦΫΤετͷॲཧʹؔ༩͢Δɺ ,FFQ"MJWFͳίωΫγϣϯʹΑΓ઀ଓ͞Εͨ)551Λղऍ͢Διϑτ΢ΣΞ ʢPSϋʔυ΢ΣΞʣ͕ͨͪɺҰ؏ੑͳ͘)551ϦΫΤετͷऴ୺Λղऍ͢Δ৔ ߹ʹߦ͑Δɺ͜ͷղऍࠩΛར༻ͨ͠߈ܸͷ͜ͱɻ ‣ ݹ͘͸೥ͷ8BUDIpSFͷ8IJUFQBQFSͳͲͰใࠂ͞Ε͍ͯΔɻ
ࢀߟ8IJUFQBQFSIUUQTXXXDHJTFDVSJUZDPNMJC)5513FRVFTU4NVHHMJOHQEG ‣ ೥ͷ1PSU4XJHHFSͷൃදʹΑΓվΊͯ஫໨ΛूΊΔΑ͏ʹͳͬͨɻ ࢀߟ1PSU4XJHHFSʹΑΔهࣄIUUQTQPSUTXJHHFSOFUSFTFBSDIIUUQEFTZODBUUBDLT SFRVFTUTNVHHMJOHSFCPSO ‣ !SFHJMFSPʹΑΔ༷ʑͳใࠂ΋ษڧʹͳΔɻ ࢀߟ%&'$0/ͰͷൃදIUUQTXXXZPVUVCFDPNXBUDI WE76J1T.1:

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$- ঢ়گઃఆ ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό
όοΫΤϯυ αʔό 5SBOTGFS&ODPEJOHΛ ༏ઌ͢ΔͱԾఆ $POUFOU-FOHUIΛ ༏ઌ͢ΔͱԾఆ ͭͷίωΫγϣϯ͕ ࠶ར༻͞ΕΔͱԾఆ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$- ΫϥΠΞϯτଆ͔ΒᐆດͳϦΫΤετ͕ૹ৴͞Εͨͱ͢Δ ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό
όοΫΤϯυ αʔό POST / HTTP/1.1 Host: example.com Content-Length: 3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n ‣ ·ͣࠨͷྫͷΑ͏ͳϦΫΤετ͕ൃ ߦ͞Εͨͱ͢Δɻ ‣ ͜ͷϦΫΤετ͸ҎԼͷϔομΛ ྆ํؚΜͰ͍Δɻ ‣ $POUFOU-FOHUIϔομ ‣ 5SBOTGFS&ODPEJOHϔομ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$- ϑϩϯτΤϯυαʔό͕5SBOTGFS&ODPEJOHϔομΛ༏ઌͨ͠ͱ͢Δͱʜ POST / HTTP/1.1
Host: example.com Content-Length: 3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό ‣ ϑϩϯτΤϯυαʔό͕ԾఆͲ͓Γ 5SBOTGFS&ODPEJOHϔομΛ༏ઌ ͨ͠ͱ͢Δͱɺ͜ͷϦΫΤετϘ σΟͷ͢΂͕ͯόοΫΤϯυαʔό ʹ޲͚ͯૹ৴͞ΕΔɻ ‣ ͜Ε͸3'$௨ΓͷڍಈͰ͋Δɻ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$- ίωΫγϣϯதʹͭ໨ͷϦΫΤετ͕ૹ৴͞ΕΔ POST / HTTP/1.1
Host: example.com Content-Length:3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n όοΫΤϯυαʔόʹ ૹ৴͞ΕΔσʔλ ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$- όοΫΤϯυαʔό͕$POUFOU-FOHUIϔομΛ༏ઌͨ͠ͱ͢Δͱʜ POST / HTTP/1.1
Host: example.com Content-Length:3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n όοΫΤϯυαʔό͕ ॲཧ͢Δൣғ ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό ॲཧ͞Εͣʹ࢒Δൣғ όοΫΤϯυαʔό͸ɺPOST ~ a\r\n·Ͱͷൣғ͕ϦΫΤετͩͱ ࢥͬͯॲཧ͢Δ Ҏ߱͸ॲཧ͞Εͣʹɺ ίωΫγϣϯதʹ࢒Δ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5& ΫϥΠΞϯτଆ͔ΒผͷϦΫΤετ͕ૹ৴͞Εͨͱ͢Δ ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό
όοΫΤϯυ αʔό GET / HTTP/1.1 Host: example.com ‣ Ұํɺઌड़ͷϦΫΤετͷޙʹɺࠨ ͷྫͷΑ͏ͳʢͳΜͷม఩΋ͳ͍ʣ ϦΫΤετ͕ૹ৴͞Εͨͱ͢Δɻ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$- ίωΫγϣϯதʹͭ໨ͷϦΫΤετ͕ૹ৴͞ΕΔ POST / HTTP/1.1
Host: example.com Content-Length:3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n GET / HTTP/1.1 ... όοΫΤϯυαʔό͕ ͢Ͱʹॲཧͨ͠ൣғ ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό ॲཧ͞Ε͍ͯͳ͍ൣғ ৽͘͠ૹ৴͞Εͨൣғ ޙଓͷϦΫΤετ͕ ϑϩϯτΤϯυαʔό͔Β ૹ৴͞ΕΔ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$- ͭ໨ͷϦΫΤετ͕ॲཧ͞ΕΔ POST / HTTP/1.1
Host: example.com Content-Length:3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n GET / HTTP/1.1 ... όοΫΤϯυαʔό͕ ͢Ͱʹॲཧͨ͠ൣғ ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό όοΫΤϯυαʔό͕ ଓ͍ͯॲཧ͢Δൣғ όοΫΤϯυαʔό͸࢒ͬͨ ෦෼͔ΒॲཧΛ࢝ΊΔ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$-͜͜·ͰͰԿ͕ى͔ͬͨ͜ POST / HTTP/1.1 Host: example.com
Content-Length: 3 Transfer-Encoding: chunked a\r\n ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό POST / HTTP/1.1 Host: example.com Content-Length: 3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n GET / HTTP/1.1 ... 0123456789\r\n 0\r\n GET / HTTP/1.1 ... ϑϩϯτΤϯυαʔό͕தܧͨ͠ϦΫΤετ όοΫΤϯυαʔό͕ॲཧͨ͠ϦΫΤετ ʺ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$-͜͜·ͰͰԿ͕ى͔ͬͨ͜ POST / HTTP/1.1 Host: example.com
Content-Length: 3 Transfer-Encoding: chunked a\r\n ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό POST / HTTP/1.1 Host: example.com Content-Length: 3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n GET / HTTP/1.1 ... 0123456789\r\n 0\r\n GET / HTTP/1.1 ... ϑϩϯτΤϯυαʔό͕தܧͨ͠ϦΫΤετ όοΫΤϯυαʔό͕ॲཧͨ͠ϦΫΤετ ʺ ߈ܸऀ͸ޙଓͷϦΫΤετͷઌ಄ʹ ೚ҙͷόΠτྻΛ෇ՃͰ͖Δʂ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5& ঢ়گઃఆ ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό
όοΫΤϯυ αʔό $POUFOU-FOHUIΛ ༏ઌ͢ΔͱԾఆ 5SBOTGFS&ODPEJOHΛ ༏ઌ͢ΔͱԾఆ ͭͷίωΫγϣϯ͕ ࠶ར༻͞ΕΔͱԾఆ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5& ΫϥΠΞϯτଆ͔ΒᐆດͳϦΫΤετ͕ૹ৴͞Εͨͱ͢Δ ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό
όοΫΤϯυ αʔό POST / HTTP/1.1 Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIX ‣ ·ͣࠨͷྫͷΑ͏ͳϦΫΤετ͕ൃ ߦ͞Εͨͱ͢Δɻ ‣ ͜ͷϦΫΤετ͸ҎԼͷϔομΛ ྆ํؚΜͰ͍Δɻ ‣ $POUFOU-FOHUIϔομ ‣ 5SBOTGFS&ODPEJOHϔομ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5& ϑϩϯτΤϯυαʔό͕$POUFOU-FOHUIϔομΛ༏ઌͨ͠ͱ͢Δͱʜ POST / HTTP/1.1
Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIX ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό ‣ ϑϩϯτΤϯυαʔό͕ԾఆͲ͓Γ $POUFOU-FOHUIϔομΛ༏ઌͨ͠ ͱ͢Δͱɺ͜ͷϦΫΤετϘσΟͷ ͢΂͕ͯόοΫΤϯυαʔόʹ޲͚ ͯૹ৴͞ΕΔɻ ‣ $POUFOU-FOHUIΛ༏ઌ͢Δͷ͸3'$ ҧ൓͕ͩɺݱ࣮ੈքͷΞϓϦέʔγϣϯ Ͱ΋ྫ͕͍͔ͭ͘ใࠂ͞Ε͍ͯΔʢޙ ड़ʣɻ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5& ίωΫγϣϯதʹͭ໨ͷϦΫΤετ͕ૹ৴͞ΕΔ POST / HTTP/1.1
Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIX ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό όοΫΤϯυαʔόʹ ૹ৴͞ΕΔσʔλ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5& όοΫΤϯυαʔό͕5SBOTGFS&ODPEJOHϔομΛ༏ઌͨ͠ͱ͢Δͱʜ POST / HTTP/1.1
Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIX ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό όοΫΤϯυαʔό͕ ॲཧ͢Δൣғ ॲཧ͞Εͣʹ࢒Δൣғ όοΫΤϯυαʔό͸ɺPOST ~ 0\r\n·Ͱͷൣғ͕ϦΫΤετͩͱ ࢥͬͯॲཧ͢Δ Ҏ߱͸ॲཧ͞Εͣʹɺ ίωΫγϣϯதʹ࢒Δ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5& ΫϥΠΞϯτଆ͔ΒผͷϦΫΤετ͕ૹ৴͞Εͨͱ͢Δ ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό
όοΫΤϯυ αʔό GET / HTTP/1.1 Host: example.com ‣ Ұํɺઌड़ͷϦΫΤετͷޙʹɺࠨ ͷྫͷΑ͏ͳʢͳΜͷม఩΋ͳ͍ʣ ϦΫΤετ͕ૹ৴͞Εͨͱ͢Δɻ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5& ίωΫγϣϯதʹͭ໨ͷϦΫΤετ͕ૹ৴͞ΕΔ POST / HTTP/1.1
Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIXGET / HTTP/1.1 ... ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό όοΫΤϯυαʔό͕ ͢Ͱʹॲཧͨ͠ൣғ ॲཧ͞Ε͍ͯͳ͍ൣғ ৽͘͠ૹ৴͞Εͨൣғ ޙଓͷϦΫΤετ͕ ϑϩϯτΤϯυαʔό͔Β ૹ৴͞ΕΔ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5& ͭ໨ͷϦΫΤετ͕ॲཧ͞ΕΔ POST / HTTP/1.1
Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIXGET / HTTP/1.1 ... ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό όοΫΤϯυαʔό͕ ͢Ͱʹॲཧͨ͠ൣғ όοΫΤϯυαʔό͕ ଓ͍ͯॲཧ͢Δൣғ όοΫΤϯυαʔό͸࢒ͬͨ ෦෼͔ΒॲཧΛ࢝ΊΔ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5&͜͜·ͰͰԿ͕ى͔ͬͨ͜ POST / HTTP/1.1 Host: example.com
Content-Length: 9 Transfer-Encoding: chunked 0\r\n ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό POST / HTTP/1.1 Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIX GET / HTTP/1.1 ... PREFIXGET / HTTP/1.1 ... ϑϩϯτΤϯυαʔό͕தܧͨ͠ϦΫΤετ όοΫΤϯυαʔό͕ॲཧͨ͠ϦΫΤετ ʺ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5&͜͜·ͰͰԿ͕ى͔ͬͨ͜ POST / HTTP/1.1 Host: example.com
Content-Length: 9 Transfer-Encoding: chunked 0\r\n ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό POST / HTTP/1.1 Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIX GET / HTTP/1.1 ... PREFIXGET / HTTP/1.1 ... ϑϩϯτΤϯυαʔό͕தܧͨ͠ϦΫΤετ όοΫΤϯυαʔό͕ॲཧͨ͠ϦΫΤετ ߈ܸऀ͸ࠓճ΋ޙଓͷϦΫΤετͷ ઌ಄ʹ೚ҙͷόΠτྻΛ෇ՃͰ͖Δʂ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ )34߈ܸͷར༻ઌ ‣ )34੬ऑੑʹΑΓɺҎԼͷΑ͏ͳૢ࡞͕ՄೳʹͳΔͷͰʜ ‣ ޙଓͷϦΫΤετͷϦΫΤετϥΠϯͷ੍ޚɾϔομͷ෇Ճ ‣ ޙଓͷϦΫΤετͷϘσΟͷมߋ ‣
౰વɺҎԼͷΑ͏ͳ߈ܸʹར༻Ͱ͖Δɻ ‣ ޙଓͷϦΫΤετͷ%P4 ‣ ࣗ༝౓ͷߴ͍ϦΫΤετͷൃߦ ‣ 8FC$BDIF1PJTPOJOH౳ͷΩϟογϡʹؔ࿈ͨ͠߈ܸʢޙड़ʣ ‣ ·ͨɺ8FCΞϓϦέʔγϣϯݻ༗ͷػೳΛ࢖ͬͨ߈ܸʹ΋ར༻Ͱ͖Δɻ ‣ ϦιʔεΛ౤ߘɾӾཡͰ͖ΔΑ͏ͳػೳ͕͋Δ8FCΞϓϦέʔγϣϯʢFHܝࣔ൘ʣʹ͓͍ͯ ͸ɺଞऀͷϦΫΤετ಺༰ΛϦʔΫͰ͖Δ৔߹͕͋Δɻ ‣ 944੬ऑੑ͕͋Δ৔߹ɺͦΕΛ᠘ϖʔδʹ༠ಋ͢ΔͳͲͷૢ࡞ͳ͠ʹɺผͷϢʔβͷϒϥ΢β্ ͰൃՐͤ͞ΒΕΔ৔߹͕͋Δɻ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ )34߈ܸͷରࡦ ‣ )34͸ɺ͋ΔϦΫΤετͷॲཧʹؔ༩͢Δɺ,FFQ"MJWFͳίωΫγϣϯʹΑΓ ઀ଓ͞Εͨ)551Λղऍ͢Διϑτ΢ΣΞʢPSϋʔυ΢ΣΞʣ͕ͨͪɺҰ؏ੑ ͳ͘)551ϦΫΤετͷऴ୺Λղऍ͢Δ৔߹ʹߦ͑Δɺ͜ͷղऍࠩΛར༻ͨ͠ ߈ܸͷ͜ͱɺͩͬͨͷͰɺରࡦ͸ʜ ‣ ํ਑ϑϩϯτΤϯυαʔόͱόοΫΤϯυؒͷ,FFQ"MJWFͳίωΫγϣϯΛࣺͯΔ
‣ ຖճίωΫγϣϯΛுΓ௚͢Α͏ʹ͢Δ ‣ )551Λར༻͢Δ ‣ ํ਑)551ϦΫΤετͷऴ୺ͷղऍͷҰ؏ੑΛอͭ ‣ ར༻͢Διϑτ΢ΣΞΛ࠷৽ʹอͭ ‣ ϦΫΤετΛ࠷΋ΫϥΠΞϯτʹ͍ۙҐஔͰਖ਼نԽͯ͠͠·͏ ‣ )551ϦΫΤετͷॲཧʹؔ༩͢Διϑτ΢ΣΞΛ౷Ұ͢Δʢ͜Ε͸ඇݱ࣮తʣ

Ωϟογϡʹؔ࿈ͨ͠߈ܸ $IBQUFS4FDUJPO

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FCʹ͓͚ΔΩϟογϡ ‣ Ωϟογϡ˺औಘͨ͠ϦιʔεΛɺΑΓߴ଎ʹΞΫηεͰ͖ΔҐஔʹҰ࣌తʹ อଘ͠ɺͦͷޙͦΕΛར༻͢Δ͜ͱͰɺॲཧͷߴ଎Խɾෛՙͷ௿ݮΛਤΔ࢓૊Έɻ ‣ 8FCʹ͓͚ΔΩϟογϡ͸ʜ ‣ 8FCϒϥ΢βͰ΋ߦͳΘΕΔɻ
‣ Ωϟογϡαʔό౳ͷϛυϧ΢ΣΞͰ΋ߦͳΘΕΔɻ ‣ ʢαʔόαΠυʣ8FCΞϓϦέʔγϣϯ͕࠷దԽͷͨΊʹߦ͏৔߹΋͋Δɻ ΫϥΠΞϯτ Ωϟογϡ αʔό ΦϦδϯ αʔό

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ωϟογϡͷڍಈ Ωϟογϡϛε࣌ ΫϥΠΞϯτ Ωϟογϡ αʔό ΦϦδϯ
αʔό ཁٻϦιʔε͕·ͩΩϟογϡ ͞Ε͍ͯͳ͍৔߹ʜ Ωϟογϡ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ωϟογϡͷڍಈ Ωϟογϡϛε࣌ ΫϥΠΞϯτ Ωϟογϡ αʔό ΦϦδϯ
αʔό όοΫΤϯυαʔό͔Β౰֘Ϧιʔε Λऔಘɾอଘͯ͠ʜ Ωϟογϡ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ωϟογϡͷڍಈ Ωϟογϡϛε࣌ ̏ ΫϥΠΞϯτ Ωϟογϡ αʔό ΦϦδϯ
αʔό औಘ͖ͯͨ͠ϦιʔεΛฦ٫͢Δ Ωϟογϡ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ωϟογϡͷڍಈ Ωϟογϡώοτ࣌ ΫϥΠΞϯτ Ωϟογϡ αʔό ΦϦδϯ
αʔό ཁٻϦιʔε͕طʹΩϟογϡ ͞Ε͍ͯΔ৔߹ʜ Ωϟογϡ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ωϟογϡͷڍಈ Ωϟογϡώοτ࣌ ΫϥΠΞϯτ Ωϟογϡ αʔό ΦϦδϯ
αʔό ΩϟογϡࡁΈϦιʔεΛฦ٫͢Δ Ωϟογϡ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ $POUFOU%FMJWFSZ/FUXPSLʢ$%/ʣ ‣ $%/ੈքதͷ઀ଓ఺ʢ1P1ʣʹΩϟογϡαʔό͕഑ஔ͞ΕͨωοτϫʔΫ ‣ ίϯςϯπΛ഑৴͢ΔΦϦδϯαʔόͷϦιʔε͕֤ΩϟογϡαʔόͰอ؅͞ΕΔɻ ‣ ΤϯυϢʔβͷ͔ۙ͘ΒΩϟογϡΛ഑৴͢Δ͜ͱͰɺΑΓߴ଎ͳମݧ͕ఏڙͰ͖Δɻ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ωϟογϡʹؔ͢Δجຊతͳ໰୊ ‣ ͳΜͰ΋͔ΜͰ΋Ωϟογϡ͢Ε͹͍͍ɺͱ͍͏Θ͚Ͱ͸ͳ͍ɻ ‣ Ωϟογϡͷର৅΍༗ޮظݶ͸ʮ͍͍ײ͡ʯʹ؅ཧͯ͠΍Δඞཁ͕͋Δɻ ‣ ී௨Ωϟογϡαʔό͸ೝূɾೝՄͷΑ͏ͳߴ౓ͳػೳΛ࣋ͨͳ͍ͷͰɺຊདྷΞΫηε ʹೝূɾೝՄΛཁ͢ΔΑ͏ͳϦιʔε͕Ωϟογϡ͞Εͯ͠·͏ͱɺେ͖ͳ৘ใྲྀग़ʹ
ͭͳ͕ΔՄೳੑ͕͋Δɻ ΫϥΠΞϯτ Ωϟογϡ αʔό ΦϦδϯ αʔό Ωϟογϡ Ϣʔβݸผͷ Ϧιʔε

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ωϟογϡͷ੍ޚ ‣ ઌ߲ͷΑ͏ͳࣄ৘͔Β΋࡯͞ΕΔΑ͏ʹɺΩϟογϡ͸੍ޚͰ͖Δɻ ‣ ओʹ੍ޚ͍ͨ͜͠ͱ͸ʜ ‣ ԿΛΩϟογϡ͢Δ͔ ‣
Ωϟογϡ͢ΔͳΒɺ͍ͭ·ͰΩϟογϡ͢Δ͔ ‣ ੍ޚʹ͸ओʹҎԼ͕ར༻͞ΕΔɻ ‣ $BDIF$POUSPMϔομ ‣ &YQJSFTϔομ ‣ Ωϟογϡαʔό΍$%/αʔϏεݻ༗ͷػೳ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ $BDIF$POUSPMϔομ ‣ ˞ຊདྷ͸ϦΫΤετɾϨεϙϯεͷ྆ํͷ੍ޚʹ࢖͑Δϔομ͕ͩɺҎ߱Ͱ͸Ϩεϙϯεத ͷ$BDIF$POUSPMϔομʹ͍ͭͯͷΈߟ͑Δɻ ‣ $BDIF$POUSPMϨεϙϯεϔομ͸ɺҎԼͷΑ͏ͳσΟϨΫςΟϒΛࣔ͢͜ͱͰɺͦͷϦ ιʔεΛΩϟογϡ͢ΔଆͷڍಈΛ੍ޚ͢ΔͨΊʹ༻͍ΒΕΔɻ ‣
NBYBHFTNBYBHFʜఴ͑ΒΕͨύϥϝʔλͱͱ΋ʹɺ༗ޮظݶʢඵʣΛࣔ͢ ‣ OPDBDIFʜΦϦδϯαʔό΁ͷ֬ೝͳ͠Ωϟογϡ͕࠶ར༻͞Εͯ͸ͳΒͳ͍͜ͱΛࣔ͢ ‣ OPTUPSFʜΩϟογϡ͞Εͯ͸ͳΒͳ͍͜ͱΛࣔ͢ ‣ QVCMJDQSJWBUFʜϦιʔε͕ಛఆͷݸਓ޲͚Ͱ͋ΔͰ͸ͳ͍͜ͱΛࣔ͢ ‣ FUD Cache-Control: directive, directive, ...

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ &YQJSFTϔομ ‣ &YQJSFTϔομͷ஋͸ɺͦͷϦιʔεͷΩϟογϡͷ༗ޮظݶΛࣔ͢ɻ ‣ ྫ8FE 0DU(.5 ‣ $BDIF$POUSPMϔομʹTNBYBHFNBYBHFσΟϨΫςΟϒ͕ࢦఆ͞Ε͍ͯ
Δ৔߹͸ɺͦͪΒ͕༏ઌ͞Εɺ&YQJSFTϔομ͸ແࢹ͞ΕΔɻ ‣ ࢀߟ3'$IUUQTIUUQXHPSHTQFDTSGDIUNMIFBEFSFYQJSFT Expires: HTTP-date

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ݻ༗ͷػೳʹΑΔ੍ޚ ‣ Ωϟογϡαʔό΍$%/αʔϏε͸ɺΩϟογϡ੍ޚͷͨΊͷಛผͳ࢓૊ΈΛ ఏڙ͍ͯ͠Δ৔߹͕͋Δɻ ‣ ͦͷΑ͏ͳ࢓૊Έͷྫ ‣ 7BSOJTI΍'BTUMZͰ͸7$-ͱ͍͏%4-ͰΩϟογϡػߏΛ੍ޚͰ͖Δɻ
‣ $MPVEqBSFͷΩϟογϡ͸1BHF3VMFͱ͍͏ϧʔϧʹΑΓ੍ޚͰ͖Δɻ ‣ "LBNBJʹ͓͍ͯ΋؅ཧը໘͔ΒΩϟογϡର৅΍ظݶΛ੍ޚͰ͖Δɻ ‣ FUD sub vcl_recv { if (req.url !~ "^/static") { return(pass); } } 63-͕TUBUJD͔Β ࢝·Βͳ͍৔߹ Ωϟογϡର৅֎ʹ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ωϟογϡͷઃఆ͸མͱ͕݀͠ଟ͍ Ωϟογϡαʔό$%/αʔϏεݻ༗ͷඇࣗ໌ͳڍಈ͕͋Δ IUUQTEPDTGBTUMZDPNKBHVJEFTDPOpHVSJOHDBDIJOH 'BTUMZ͸OPTUPSFͰ΋Ωϟογϡ͢Δ ͸͡Ί͔Β&YQJSF͍ͯ͠ΔΑ͏ͳϨεϙ ϯε͕࠶ར༻͞Ε͏ΔʢDG3FRVFTU
$PMMBQTJOHʣ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ωϟογϡͷઃఆ͸མͱ͕݀͠ଟ͍ $BDIF$POUSPMͰͷઃఆΛݻ༗ػೳ͕ΦʔόʔϥΠυ͠͏Δ ‣ Ωϟογϡαʔό$%/αʔϏεݻ༗ͷػೳͰΩϟογϡର৅΍༗ޮظݶΛࢦ ఆ͢Δͱɺ͜Ε͕$BDIF$POUSPMϔομͷઃఆΑΓ༏ઌ͞ΕΔ৔߹͕͋Δɻ ‣ ༏ઌ͞ΕΔ͔͞Εͳ͍͔΋αʔϏεґଘͳͷͰɺߟ͑Δ͜ͱ͕ଟ͍ɻ
‣ ·ͨɺޙʹ঺հ͢Δ8FC$BDIF%FDFQUJPOͷҰॿʹ΋ͳ͍ͬͯΔɻ IUUQTMFBSOBLBNBJDPNFOVTXFCIFMQJPOPDB(6*%%%'#'%"#&#%$%&IUNM

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ΩϟογϡΛ༻͍ͨඇࣗ໌ͳ߈ܸ ‣ ͜͜·Ͱ͸Ωϟογϡઃఆʹؔ͢Δɺҙਤͤ͵ϛεͷ࿩ͩͬͨɻ ‣ ҰํɺΩϟογϡػೳΛҙਤతʹར༻͢Δ߈ܸ΋ଘࡏ͍ͯ͠Δɻ ‣ 8FC$BDIF1PJTPOJOH ‣
޻෉ͯ͠ѱҙͷ͋ΔσʔλΛΩϟογϡͤ͞ɺͦΕΛଞऀʹ഑৴͢Δ߈ܸ ‣ $BDIF1PJTPOJOH%FOJBMPG4FSWJDFʢ$1%P4ʣ ‣ ޻෉ͯ͠ΤϥʔϖʔδΛΩϟογϡͤ͞Δ͜ͱʹΑΓαʔϏεͷ%P4Λى͜͢߈ܸ ‣ 8FC$BDIF%FDFQUJPOʢ8$%ʣ ‣ ຊདྷΩϟογϡ͞Εͳ͍΂͖Ͱ͋ΔϢʔβͷσʔλΛ޻෉ͯ͠Ωϟογϡͤ͞ɺͦ ΕΛ౪ΈݟΔ߈ܸ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FC$BDIF1PJTPOJOH ‣ 8FC$BDIF1PJTPOJOHʜѱҙͷ͋ΔίϯςϯπΛʢͳΜͱ͔ͯ͠ʣΩϟογϡ αʔόʹΩϟογϡͤ͞ɺͦΕΛଞऀʹ഑৴͢Δɺͱ͍͏߈ܸɻ ‣ +BWB4DSJQUΛ஫ೖͨ͠ϖʔδΛ഑৴͢Δ͜ͱͰ944߈ܸ͕Ͱ͖Δ ‣ ʢ৔߹ʹΑͬͯ͸ʣϚϧ΢ΣΞͷ഑෍αʔό౳ʹ΋ར༻Ͱ͖Δɻ
߈ܸऀ Ωϟογϡ αʔό ΦϦδϯ αʔό ߈ܸϦΫΤετΛૹ৴ ߈ܸऀʹΑΓૢ࡞͞Εͨ ίϯςϯπ͕ฦ٫͞ΕΔ ߈ܸऀʹΑΓૢ࡞͞Εͨ ίϯςϯπ͕Ωϟογϡ͞ΕΔ ߈ܸର৅ͷϢʔβ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FC$BDIF1PJTPOJOH ‣ 8FC$BDIF1PJTPOJOHʜѱҙͷ͋ΔίϯςϯπΛʢͳΜͱ͔ͯ͠ʣΩϟογϡ αʔόʹΩϟογϡͤ͞ɺͦΕΛଞऀʹ഑৴͢Δɺͱ͍͏߈ܸɻ ‣ +BWB4DSJQUΛ஫ೖͨ͠ϖʔδΛ഑৴͢Δ͜ͱͰ944߈ܸ͕Ͱ͖Δ ‣ ʢ৔߹ʹΑͬͯ͸ʣϚϧ΢ΣΞͷ഑෍αʔό౳ʹ΋ར༻Ͱ͖Δɻ
߈ܸऀ Ωϟογϡ αʔό ΦϦδϯ αʔό ߈ܸର৅ͷϢʔβ ߈ܸϦΫΤετΛૹ৴ ߈ܸऀʹΑΓૢ࡞͞Εͨ ίϯςϯπ͕ฦ٫͞ΕΔ ߈ܸऀʹΑΓૢ࡞͞Εͨ ίϯςϯπ͕Ωϟογϡ͞ΕΔ ߈ܸऀͱಉ͡ ϦιʔεΛཁٻ ߈ܸऀʹΑΓૢ࡞͞Εͨ ίϯςϯπ͕ฦ٫͞ΕΔ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FC$BDIF1PJTPOJOH ‣ ѱҙͷ͋Δίϯςϯπͷૠೖ͸ʁ ‣ Ωϟογϡʹ͸Ωʔʢ˺ΩϟογϡΛอ؅৔ॴ͔Β୳͢ͱ͖ʹ࢖ΘΕΔ৘ใʣ͕͋Δɻ ‣ 3FqFDUFE944੬ऑੑ͸ϒϥ΢β͔Βൃߦ͞ΕΔϦΫΤετ͕ى఺ͱͳΔͨΊɺ੍໿͕ ݫ͍͕͠ɺ߈ܸऀ͸ࣗ෼ͷखݩ͔ΒͰ͋Ε͹ɺࣗ༝ʹϦΫΤετ͕ૹ৴Ͱ͖Δɻ
‣ Ωϟογϡ͞ΕΔϖʔδ΁ͷϦΫΤετΛߦ͍ɺΩϟογϡΩʔͰ͸ͳ͍෦෼ʹΑΓ 3FqFDUFE944੬ऑੑ΍ɺ౎߹ͷྑ͍ϦΫΤετͷมԽ͕Ҿ͖ىͤ͜Ε͹ɺΩϟογϡ ܦ༝ͰଞऀΛ߈ܸͰ͖Δ͜ͱʹͳΔʂ ‣ ࢀߟจݙ ‣ 1SBDUJDBM8FC$BDIF1PJTPOJOH IUUQTQPSUTXJHHFSOFUSFTFBSDIQSBDUJDBMXFCDBDIFQPJTPOJOH ‣ 8FC$BDIF&OUBOHMFNFOU/PWFM1BUIXBZTUP1PJTPOJOH IUUQTQPSUTXJHHFSOFUSFTFBSDIXFCDBDIFFOUBOHMFNFOU

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ $BDIF1PJTPOFE%FOJBMPG 4FSWJDFʢ$1%P4ʣ ‣ ΩϟογϡͷΩʔҎ֎ͷ෦෼Λௐ੔͢Δ͜ͱͰΤϥʔϖʔδΛදࣔͤ͞Δ͜ͱ͕ Ͱ͖ɺ͔ͭΩϟογϡαʔό͕ͦΕΛΩϟογϡ͢Δͱ͖ɺͦΕΛ௨ͯ͠8FC ϖʔδͷදࣔ๦֐ʢ%P4ʣ͕Ͱ͖ͯ͠·͏ɺͱ͍͏໰୊ͷ͜ͱɻ IUUQTDQEPTPSH

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FC$BDIF%FDFQUJPO ߈ܸྫͷঢ়گઃఆ ߈ܸର৅ͷϢʔβ Ωϟογϡ αʔό ΦϦδϯ
αʔό NZQBHFͱNZQBHFGPPDTT͕ ಉ͘͡ϚΠϖʔδΛฦ͢ͱԾఆ͢Δ ύε͕ DTTͷܗΛ͍ͯ͠ΔϦιʔεΛ ໰౴ແ༻ͰΩϟογϡ͢ΔͱԾఆ͢Δ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FC$BDIF%FDFQUJPO ߈ܸର৅ͷϢʔβΛ༠ಋ͢Δ ߈ܸର৅ͷϢʔβ ߈ܸऀ Ͳ͏΍Β͜ͷ8FCϖʔδʹඒຯ͍͠ ͓ͦ͹ͷ৘ใ͕͋ΔΒ͍ͧ͠ʂ
͍͍࿩ͩͶɻݟͯΈΑ͏ʜ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FC$BDIF%FDFQUJPO ߈ܸର৅ͷϢʔβ͔ΒΈͨϦιʔεΛΩϟογϡͤ͞Δ ߈ܸର৅ͷϢʔβ Ωϟογϡ αʔό ΦϦδϯ
αʔό ༠ಋ͞ΕͯNZQBHFGPPDTT ʹΞΫηε Ωϟογϡ͕ͳ͍ͷͰ ΦϦδϯαʔόʹ໰͍߹Θͤ NZQBHFGPPDTT ʢத਎͸NZQBHFʣΛฦ٫ DTTܗࣜͷϦιʔεͳͷͰ Ծఆ௨ΓΩϟογϡ͢Δ Ϩεϙϯε͕ಧ͘ ߈ܸऀ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FC$BDIF%FDFQUJPO Ωϟογϡͤͨ͞ϦιʔεΛϦʔΫ͢Δ ߈ܸର৅ͷϢʔβ Ωϟογϡ αʔό ΦϦδϯ
αʔό ༠ಋ͞ΕͯNZQBHFGPPDTT ʹΞΫηε Ωϟογϡ͕ͳ͍ͷͰ ΦϦδϯαʔόʹ໰͍߹Θͤ NZQBHFGPPDTT ʢத਎͸NZQBHFʣΛฦ٫ DTTܗࣜͷϦιʔεͳͷͰ Ծఆ௨ΓΩϟογϡ͢Δ Ϩεϙϯε͕ಧ͘ ߈ܸऀ NZQBHFGPPDTT ʹΞΫηε Ωϟογϡ͔Βɺ߈ܸର৅ͷϢʔβ͔Βݟͨ NZQBHFGPPDTTNZQBHFͷத਎͕ฦΔ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FC$BDIF%FDFQUJPO ‣ 8FC$BDIF%FDFQUJPOʢ8$%ʣ߈ܸ ‣ ͋Δਓ1͕ΞΫηεͰ͖ΔϦιʔε3͕͋Δͱ͢Δɻ ‣ ·ͨɺ3Λࢦ͢63-Ͱ͋ͬͯɺ͔ͭΩϟογϡαʔό͕ΩϟογϡΛͯ͠͠·͏Α͏ ͳ63-͕ଘࡏ͢Δ৔߹Λߟ͑Δɻ
‣ ͜ͷͱ͖ɺਓ1Λɺͦͷ63-ʹ༠ಋ͢Δ͜ͱͰɺ3͕Ωϟογϡ͞ΕΔɻ ‣ ߈ܸऀ͸ޙ͔Βͦͷ63-ʹΞΫηε͢Δ͜ͱͰɺຊདྷ߈ܸऀ͕3ʹΞΫηεͰ͖ͳ͍ ৔߹Ͱ͋ͬͯ΋ɺΩϟογϡ͞Εͨ3ΛಘΔ͜ͱ͕Ͱ͖ͯ͠·͏ɻ ‣ ࢀߟจݙ ‣ 8FC$BDIF%FDFQUJPO"UUBDLʢ(JM ʣ IUUQTXXXCMBDLIBUDPNEPDTVTXFEOFTEBZVT(JM8FC$BDIF%FDFQUJPO"UUBDLXQQEG ‣ $BDIFEBOE$POGVTFE8FC$BDIF%FDFQUJPOJOUIF8JMEʢ.JSIFJEBSJFUBMʣ IUUQTXXXVTFOJYPSHDPOGFSFODFVTFOJYTFDVSJUZQSFTFOUBUJPONJSIFJEBSJ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷ୲อ͸೉͍͠ BOZUJNFZPVIBWFPVUPGCBOEQPMJDZBQQMJFESBUIFSUIBOIBWJOHUIFQPMJDZ BDUVBMMZDPOUBJOFEJOUIFSFTQPOTFJUTFMG UIFSF`TBDIBODFGPSJUUPCFPVUPG TZOD DBVTJOHNJTDPOpHVSBUJPOBOEQPUFOUJBMWVMOFSBCJMJUJFT 2VPUFEGSPNIUUQTXXXNOPUOFUCMPHTBGF@DEO

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ͜ΕΒͷ໰୊Λආ͚ΔͨΊʹ ‣ ΦϦδϯαʔό͔Β$BDIF$POUSPMϔομΛద੾ʹૹग़͠Α͏ɻ ‣ ద੾ʹOPTUPSF౳ͷσΟϨΫςΟϒΛૹग़͠Α͏ɻ ‣ Կ͕ద੾͔͸ঢ়گʹΑΔͷͰʢSFDBQ'BTUMZ͸OPTUPSFΛແࢹ͢Δʣɺదٓ3'$ ΍Ωϟογϡαʔό$%/αʔϏεͷ࢓༷ΛಡΈɺ͔֬ΊΔඞཁ͕͋Δɻ
‣ ΋ͪΖΜɺΩϟογϡͯ͠Α͍΋ͷ͸ੵۃతʹΩϟογϡ͍ͯ͘͠΂͖ɻ ‣ Ωϟογϡαʔό$%/αʔϏεͱΦϦδϯαʔόͷҰ؏ੑΛอͱ͏ɻ ‣ $BDIF$POUSPMϔομͰͷઃఆͱɺιϑτ΢ΣΞɾαʔϏεݻ༗ͷઃఆ͕৯͍ҧ͏Α͏ ͳ৔໘ΛɺͰ͖Δ͚ͩ࡞Βͳ͍͜ͱ͕େ੾Ͱ͋Δɻ ‣ ಛʹ1BUI$POGVTJPOʹ͸஫ҙ͢Δඞཁ͕͋Δɻ

ϨεϙϯεϘσΟͷੜ੒ʹؔΘΔ ॲཧܥͷ࢓༷ࠩΛར༻ͨ͠߈ܸ $IBQUFS4FDUJPO

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ϨεϙϯεϘσΟͷੜ੒ ‣ ϨεϙϯεϘσΟ͸༷ʑͳܗͰੜ੒͞ΕΔ <ul> {% for item
in items %} <li>{{ item.name }}</li> <p>{{ item.description }}</p> {% endfor %} </ul> ϧʔϓͷ։࢝ ϧʔϓͷऴྃ ม਺஋ͷల։ +JOKBςϯϓϨʔτ <?php $q = $_GET['q']; echo htmlspecialchars($q, ENT_QUOTES, 'UTF-8'); ?> 1)1εΫϦϓτ (&5ύϥϝʔλΛ Τεέʔϓͯ͠ग़ྗ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ςϯϓϨʔτΤϯδϯͷࠞ༻ ‣ ςϯϓϨʔτΤϯδϯ͸͠͹͠͹ݻ༗ͷه๏Λ࣋ͭɻ ‣ ςϯϓϨʔτΤϯδϯ͕ෳ਺༻͍ΒΕΔ৔߹ɺͦΕΒͷؒͷه๏ࠩʹΑΓɺΑ͖ ͤ͵੬ऑੑ͕ੜ·Εͯ͠·͏৔߹͕͋Δɻ ‣ ৄ͘͠͸ԋशΛࢀরͷ͜ͱɻ
‣ αʔόαΠυͰͷ)5.-ੜ੒ͱΫϥΠΞϯταΠυͰͷʢͳΜΒ͔ͷςϯϓϨʔτݴ ޠΛ༻͍ͨʣ)5.-ੜ੒͕ࠞ༻͞ΕΔέʔε͕୅දతɻ 8FCϒϥ΢β 8FCΞϓϦέʔγϣϯ {{ ... }}͸ม਺ల։༻ ͷه๏ͩͱࢥ͍ͬͯΔ {{ ... }}͸ͨͩͷ จࣈྻͩͱࢥ͍ͬͯΔ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ &EHF4JEF*ODMVEFTʢ&4*ʣ ‣ &EHF4JEF*ODMVEFTʢ&4*ʣʜ9.-ϕʔεͷϚʔΫΞοϓݴޠ ‣ <esi:include>౳ͷλάʹΑΓɺҎԼ͕දݱͰ͖Δɻ ‣ αϒϦιʔεͷಈతͳऔಘɾల։ ‣
؆୯ͳม਺ૢ࡞ ‣ 7BSOJTI 'BTUMZ ౳ͷ༷ʑͳιϑτ΢ΣΞ͕&4*ͷॲཧʹରԠ͍ͯ͠Δɻ <body> <h1>Foobar</h1> <esi:include src="/a?q=$(QUERY_STRING{param1})" /> <esi:include src="/b?q=$(HTTP_COOKIE{'TEST'})" /> </body> &4*ॲཧܥ͕͜ͷ ෦෼Λల։͢Δ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ &EHF4JEF*ODMVEFT*OKFDUJPO ‣ &4**OKFDUJPOʜ&4*λάΛʢ944߈ܸͱಉ͡ཁྖͰʣόοΫΤϯυαʔό͔ ΒͷϨεϙϯεʹ஫ೖ͢Δ͜ͱͰɺ్தͷ&4*ॲཧܥΛૢ࡞͢Δ߈ܸɻ ‣ 443'߈ܸ΍)5510OMZϑϥά͕෇༩͞Εͨ$PPLJFͷϦʔΫʹར༻Ͱ͖Δɻ ΫϥΠΞϯτ
&4*Λղऍ͢Δ ϑϩϯτΤϯυαʔό όοΫΤϯυ αʔό <esi:include> ͸ Ṗͷλάͩͱࢥ͍ͬͯΔ <esi:include> ͸ &4*λάͩͱࢥ͍ͬͯΔ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ରࡦ )5.-ੜ੒ॲཧͷ࢓༷ࠩΛར༻ͨ͠߈ܸ ‣ )5.-ͷੜ੒ॲཧ͸͋ΒΏΔ৔໘ͰߦͳΘΕΔɻ ‣ ͦΕΒॲཧܥͷؒʹ͸࢓༷͕ࠩ͋Δ৔߹͕͋Δɻ ‣ ಛघͳҙຯΛ࣋ͭจࣈͷछྨ
‣ ॲཧܥ͕࣋ͭػೳ ‣ )5.-ͷੜ੒ʹࢀՃ͢Δॲཧܥಉ࢜͸ʜ ‣ લఏͱͯ͠ɺͰ͖Δ͚ͩݮΒ͓ͯ͘͠ͱΑ͍ɻ ‣ &4*ͳͲ͸ɺ࢖Θͳͯ͘ࡁΉͷͰ͋Ε͹ɺແޮԽ͓ͯ͘͠ɻ ‣ Ͳ͏ͯ͠΋ෳ਺Λͭͳ͛Δඞཁ͕͋Δ৔߹ʹ͸ɺ࢓༷ࠩΛ͏·͘Ϋογϣϯͯ͠ɺҰ؏ ੑΛ࣋ͨͤͯ΍Δඞཁ͕͋Δɻ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ Ұ؏ੑΛอͪͳ͕Βͭͳ͛Δ ‣ ҎԼͷͭͷ߈ܸྫ͸ɺͲΕ΋ιϑτ΢ΣΞؒͷҰ؏ੑͷͳ͕͞ট͍ͨ໰୊Ͱ͋ Δͱଊ͑Δ͜ͱ͕Ͱ͖Δɻ ‣ )5513FRVFTU4NVHHMJOH ‣
$POUFOU-FOHUI5SBOTGFS&ODPEJOHϔομͷෆద੾ͳऔΓѻ͍ʹΑΓൃੜ͢ ΔɺதܧαʔόͱΞϓϦέʔγϣϯαʔόؒͷෆ੔߹Λ༻͍ͨ߈ܸ ‣ $BDIFʹؔ࿈ͨ͠߈ܸ ‣ 8FC$BDIF1PJTPOJOH 8FC$BDIF%FDFQUJPO $1%P4ͳͲ ‣ ϨεϙϯεϘσΟͷੜ੒ʹؔΘΔॲཧܥͷ࢓༷ࠩΛར༻ͨ͠߈ܸ ‣ 443 $43ͷෆద੾ͳࠞ༻΍&4**OKFDUJPO߈ܸͳͲ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ Ұ؏ੑΛอͪͳ͕Βͭͳ͛Δ ‣ 8FCΞϓϦέʔγϣϯͷߏஙʹඞཁͳίϯϙʔωϯτ͕૿͖͑ͯͨࠓɺͦΕΒ ΛҰ؏ੑΛอͪͳ͕Βͭͳ͛Δͱ͍͏ͷ͸ɺඇৗʹେ੾ͳ؍఺Ͱ͋Δɻ ‣ ྫ͑͹ɺҎԼͷΑ͏ͳ৔߹ʹ͸໰୊͕ൃੜͯ͠͠·͏ɻ ‣
࢓༷ͷؒʹҰ؏ੑ͕ͳ͍ͷʹɺͦΕͷࠩ෼ΛΫογϣϯͤͣʹͭͳ͛ͯ͠·ͬͨͱ͖ ‣ ࣮૷ͷؒʹҰ؏ੑ͕ͳ͍ͷʹɺͦΕʹؾ͕෇͔ͣʹͭͳ͛ͯ͠·ͬͨͱ͖ ‣ ֤ίϯϙʔωϯτΛઃܭ͢Δɾͭ͘Δଆͷਓʹ໰୊͕͋ΔΘ͚Ͱ͸͋Δͷ͕ͩʜ ‣ 8FCΞϓϦέʔγϣϯ։ൃऀͱͯ͠͸ɺҎԼͷ఺ʹཹҙ͠Α͏ɻ ‣ ࣗ෼ͷ࢖͓͏ͱ͍ͯ͠Δίϯϙʔωϯτ܈ʹɺ໰୊ʹͳΓͦ͏ͳʮࠩʯ͕ͳ͍͔ɻ ‣ ࣗ෼ͷ࢖༻͢Δίϯϙʔωϯτͷ࣮૷ʹط஌ͷ໰୊͕ͳ͍͔ ‣ ηΩϡϦςΟٕज़ऀͱͯ͠͸ɺͦ͏͍͏໰୊Λૣظʹൃݟͯ͠ɺੈͷத͔ΒηΩϡΞͰ ͳ͍΋ͷΛݮΒ͍͚ͯ͠ΔͱΑ͍

αΠυνϟωϧ߈ܸͷجૅ $IBQUFS

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ αΠυνϟωϧ߈ܸ ‣ αΠυνϟωϧ ‣ ॲཧͷ݁Ռൃੜͨ͠ʮ෭࣍తͳӨڹͷ͋ΒΘΕʯ͕؍ଌͰ͖Δܦ࿏ͷ͜ͱɻ ‣ ʮ෭࣍తͳӨڹͷ͋ΒΘΕʯͷྫ ‣
ॲཧͷফඅిྗͷมԽ ‣ ॲཧͷ࣮ߦ࣌ؒͷಛੑ ‣ αΠυνϟωϧ߈ܸʜ͋Δॲཧʹର͢ΔαΠυνϟωϧΛ؍ଌ͢Δ͜ͱͰɺͦ ͷॲཧʹؔΘΔ৘ใΛϦʔΫ͢Δ߈ܸͷ͜ͱɻ ೖྗ ग़ྗ ॲཧ ෭࣍తͳӨڹͷ͋ΒΘΕ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FCʹ͓͚ΔαΠυνϟωϧ߈ܸ ‣ 8FCʹ͓͍ͯ΋αΠυνϟωϧ߈ܸͷํ๏࿦͕௕Β͘ݕ౼͞Ε͖͍ͯͯΔɻ ‣ ࢀߟ'FMUFOBOE4DIOFJEFS ͷ$BDIFCBTFEUJNJOHBUUBDLT IUUQTEMBDNPSHEPJ ‣
8FCʹ͓͚ΔαΠυνϟωϧ߈ܸΛɺ࣍ͷ؍఺Ͱ෼ྨͯ͠ߟ͑Δ ‣ αʔόαΠυͷαΠυνϟωϧΛ༻͍ͨ߈ܸ ‣ 8FCϒϥ΢β಺ͷαΠυνϟωϧΛ༻͍ͨ߈ܸ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ αʔόαΠυͷαΠυνϟωϧΛ༻͍ͨ߈ܸ ‣ Θ͔Γ΍͍͢ྫαʔόαΠυϩδοΫ΁ͷλΠϛϯά߈ܸ ‣ ʢೖྗ γεςϜͷ಺෦ঢ়ଶʣʹԠͯ͡ɺॲཧʹཁ͢Δ࣌ؒ͸มԽ͢Δɻ ‣ ͏·͘ೖྗΛมԽͤ͞Δͱɺॲཧ࣌ؒΛ؍ଌ͢Δ͜ͱͰɺγεςϜͷ಺෦ঢ়ଶΛਪଌ͢
Δ͜ͱ͕Ͱ͖Δ৔߹͕͋Δɻ ‣ ֶज़ྖҬͰ͸#PSU[BOE#POFI ͕Α͘Ҿ͖߹͍ʹग़͞ΕΔ IUUQTEMBDNPSHEPJ ೖྗ ॲཧ ग़ྗ ͜͜ʹ͔͔Δ࣌ؒΛ؍ଌ͢Δ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ΦϥΫϧʹ஫໨͢Δ ‣ αΠυνϟωϧ͸͠͹͠͹ΦϥΫϧͱͯ͠ѻ͏͜ͱ͕Ͱ͖Δ ‣ ΦϥΫϧʜ໰͍Λ౤͛ΔͱɺͦΕʹ౴͑ͯ͘ΕΔ΋ͷ ‣ தͰ͸ͲΜͳ͜ͱ͕ߦͳΘΕΔ͔͕ɺ໰Λ౤͛Δଆʹ։ࣔ͞Ε͍ͯΔඞཁ͸ͳ͍ ‣
ಛʹ8FCʹ͓͚ΔαΠυνϟωϧ߈ܸͷྖҬͰ͸ɺड़ޠ1Λ౤͛Δͱɺൿີͷ৘ใE ʹରͯ͠1 E ͕ਅِ͔͔൑ఆ͢Δ໰୊ͷιϧόͷ͜ͱΛࢦ͕ͪ͠ ΫΤϦ ৘ใ ΦϥΫϧ ΫΤϦͷ݁Ռ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ "70SBDMF ‣ 8JOEPXT%FGFOEFS͕ߦ͏ɺϑΝΠϧͷ ෦෼తͳධՁͱͦΕʹجͮ͘ѱੑݕ஌Λ ΦϥΫϧԽͯ͠ར༻͢ΔαΠυνϟωϧ ߈ܸͷ͜ͱɻ ‣ ࢯ͸ଞͷΞϯν΢Πϧειϑτ΢ΣΞ
΍ɺͦͷଞҰൠͷ"VEJUPSzʹରͯ͠ ΋ɺಉछͷΦϥΫϧʢ"VEJUPS#BTFE 0SBDMFʣ͕ߏ੒Ͱ͖ΔՄೳੑʹ͍ͭͯ΋ ݴٴ͍ͯ͠Δɻ ‣ DG944"VEJUPSΛ༻͍ͨ944FBSDI IUUQTUXJUUFSDPNUOLTUBUVT T

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ #MJOE3FHFY*OKFDUJPO"UUBDL ‣ ҎԼͷ৚͕݅੒Γཱͭͱ͖ʹʜ ‣ ೚ҙʹ༩͑Δ͜ͱͷͰ͖Δਖ਼نදݱʹΑ Γɺ͋Δେ੾ͳ஋͕૸ࠪ͞ΕΔ ‣
ਖ਼نදݱΤϯδϯ͕3F%P4߈ܸ଱ੑͷ ͳ͍΋ͷͰ͋Δ ‣ ॲཧ࣌ؒΛαΠυνϟωϧͱͯ͠ɺͦͷ ஋ΛϦʔΫ͢Δ͜ͱ͕Ͱ͖Δͱ͍͏߈ܸ IUUQTEJBSZTIJGUKTJOGPCMJOESFHVMBSFYQSFTTJPOJOKFDUJPO

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FCϒϥ΢β಺ͷαΠυνϟωϧΛ༻͍ͨ߈ܸ ‣ 94-FBL ‣ 8FCϒϥ΢β಺ͷαΠυνϟωϧͷ͜ͱɻ ‣ ͜ΕΛ༻͍ͨ߈ܸ͸94-FBL"UUBDLͱݺ͹ΕΔɻ ‣
944FBSDI"UUBDL ‣ ৘ใ૸ࠪΛ͢ΔػೳͷڍಈΛ94-FBLʹΑΓಡΈ ग़͢͜ͱͰɺΦϥΫϧΛߏ੒͠ɺͦΕʹΑΓ৘ใͷ ෮ݩΛ໨ࢦ͢߈ܸͷ͜ͱɻ ‣ ຊߨٛͰ͸ৄ͘͠આ໌͠ͳ͍͕ɺࡢ೥ͷηΩϡ ϦςΟɾΩϟϯϓશࠃେձͰ͸͜ͷลΛऔΓ ѻͬͨͷͰɺͦͷࢿྉΛݟͯΈΔͱΑ͍ɻ IUUQTTQFBLFSEFDLDPNMNU@TXBMMPXBUUBDLTBOEEFGFOTFTJOXFCCSPXTFST

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ͳ͏ରࡦ͍ͯ͘͠΂͖ʁ ‣ 8FCͷྖҬʹ͓͍ͯ΋αΠυνϟωϧ߈ܸ͸ແࢹͰ͖ͳ͍ɻ ‣ αʔόαΠυͷαΠυνϟωϧΛ༻͍ͨ߈ܸ ‣ දݱྗͷߴ͍ΫΤϦݴޠΛड͚औΓɺͦΕͰ৘ใ಺Λ૸ࠪ͢Δͱ͖͸ɺΘ͔ͣͳڍ ಈ͕ࠩ໰୊ʹͳΔ৔߹͕͋ΔͷͰɺ஫ҙΛ෷͓͏ɻ
‣ ૸ࠪʹݶΒͣɺେ੾ͳσʔλͷॲཧͰ͸ɺ ࠷ྑcฏۉc࠷ѱ ܭࢉྔͷࠩΛҙࣝ͠Α͏ɻ ‣ 8FCϒϥ΢β಺ͷαΠυνϟωϧΛ༻͍ͨ߈ܸ ‣ ͦ΋ͦ΋େ੾ͳ৘ใ͕8FCϒϥ΢βʹಧ͔ͳ͍Α͏ʹɺ$PPLJFͷSameSite ଐ ੑΛݫ͠໨ʹӡ༻Ͱ͖ΔͱΑ͍ɻ ‣ X-Frame-Options ϔομ΍$41ͷframe-ancestors σΟϨΫςΟϒɺCross- Origin-Resource-Policy ϔομɺCross-Origin-Opener-Policy ϔο μɺrel=noopenerଐੑͳͲʹΑΓɺ͞Βʹ৘ใ࿙Εग़͢ܦ࿏Λ௵ͤΔɻ

͓ΘΓʹ 1PTUGBDF

ٞ࿦ͷൣғΛ໌֬ʹ͢ΔͨΊʹɺҎޙ͸ʮ8FCηΩϡϦςΟʯͱ͍͏ྖҬΛɺ ҎԼͷྖҬʹ෼͚ͯߟ͑Δɻ ‣ ΫϥΠΞϯταΠυ8FCγεςϜͷηΩϡϦςΟ ‣ αʔόαΠυ8FCγεςϜͷηΩϡϦςΟ

͜ͷηΩϡϦςΟΛҎԼͷ̏؍఺͔Βߟ͑Α͏ ‣ ηΩϡΞʹͭ͘Δ ‣ ηΩϡΞʹͭͳ͛Δ ‣ ηΩϡΞʹ͏͔͢͝

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ ͍·ͷʮ8FCηΩϡϦςΟʯͱ͸ αʔόαΠυ 8FCγεςϜ ΫϥΠΞϯταΠυ 8FCγεςϜ ;
‣ ͪ͜ΒΛֶͿͨΊͷૉࡐ΋ݱࡏ४උதʜ ‣ ϦϦʔεͰ͖ͨΒ5XJUUFS౳ͰҊ಺͠·͢ɻ ‣ $IFDLJUPVUIUUQTUXJUUFSDPNMNU@TXBMMPX

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ Ұ؏ੑΛอͪͳ͕Βͭͳ͛Δ ‣ ҎԼͷͭͷ߈ܸྫ͸ɺͲΕ΋ιϑτ΢ΣΞؒͷҰ؏ੑͷͳ͕͞ট͍ͨ໰୊Ͱ͋ Δͱଊ͑Δ͜ͱ͕Ͱ͖Δɻ ‣ )5513FRVFTU4NVHHMJOH ‣
$POUFOU-FOHUI5SBOTGFS&ODPEJOHϔομͷෆద੾ͳऔΓѻ͍ʹΑΓൃੜ͢ ΔɺதܧαʔόͱΞϓϦέʔγϣϯαʔόؒͷෆ੔߹Λ༻͍ͨ߈ܸ ‣ $BDIFʹؔ࿈ͨ͠߈ܸ ‣ 8FC$BDIF1PJTPOJOH 8FC$BDIF%FDFQUJPO $1%P4ͳͲ ‣ ϨεϙϯεϘσΟͷੜ੒ʹؔΘΔॲཧܥͷ࢓༷ࠩΛར༻ͨ͠߈ܸ ‣ 443 $43ͷෆద੾ͳࠞ༻΍&4**OKFDUJPO߈ܸͳͲ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ Ұ؏ੑΛอͪͳ͕Βͭͳ͛Δ ‣ 8FCΞϓϦέʔγϣϯͷߏஙʹඞཁͳίϯϙʔωϯτ͕૿͖͑ͯͨࠓɺͦΕΒ ΛҰ؏ੑΛอͪͳ͕Βͭͳ͛Δͱ͍͏ͷ͸ɺඇৗʹେ੾ͳ؍఺Ͱ͋Δɻ ‣ ྫ͑͹ɺҎԼͷΑ͏ͳ৔߹ʹ͸໰୊͕ൃੜͯ͠͠·͏ɻ ‣
࢓༷ͷؒʹҰ؏ੑ͕ͳ͍ͷʹɺͦΕͷࠩ෼ΛΫογϣϯͤͣʹͭͳ͛ͯ͠·ͬͨͱ͖ ‣ ࣮૷ͷؒʹҰ؏ੑ͕ͳ͍ͷʹɺͦΕʹؾ͕෇͔ͣʹͭͳ͛ͯ͠·ͬͨͱ͖ ‣ ֤ίϯϙʔωϯτΛઃܭ͢Δɾͭ͘Δଆͷਓʹ໰୊͕͋ΔΘ͚Ͱ͸͋Δͷ͕ͩʜ ‣ 8FCΞϓϦέʔγϣϯ։ൃऀͱͯ͠͸ɺҎԼͷ఺ʹཹҙ͠Α͏ɻ ‣ ࣗ෼ͷ࢖͓͏ͱ͍ͯ͠Δίϯϙʔωϯτ܈ʹɺ໰୊ʹͳΓͦ͏ͳʮࠩʯ͕ͳ͍͔ɻ ‣ ࣗ෼ͷ࢖༻͢Δίϯϙʔωϯτͷ࣮૷ʹط஌ͷ໰୊͕ͳ͍͔ ‣ ηΩϡϦςΟٕज़ऀͱͯ͠͸ɺͦ͏͍͏໰୊Λૣظʹൃݟͯ͠ɺੈͷத͔ΒηΩϡΞͰ ͳ͍΋ͷΛݮΒ͍͚ͯ͠ΔͱΑ͍

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ αΠυνϟωϧ߈ܸͷجૅ ‣ αΠυνϟωϧ ‣ ॲཧͷ݁Ռൃੜͨ͠ʮ෭࣍తͳӨڹͷ͋ΒΘΕʯ͕؍ଌͰ͖Δܦ࿏ͷ͜ͱɻ ‣ ʮ෭࣍తͳӨڹͷ͋ΒΘΕʯͷྫ
‣ ॲཧͷফඅిྗͷมԽ ‣ ॲཧͷ࣮ߦ࣌ؒͷಛੑ ‣ αΠυνϟωϧ߈ܸʜ͋Δॲཧʹର͢ΔαΠυνϟωϧΛ؍ଌ͢Δ͜ͱͰɺͦ ͷॲཧʹؔΘΔ৘ใΛϦʔΫ͢Δ߈ܸͷ͜ͱɻ ೖྗ ओͨΔग़ྗ ॲཧ ෭࣍తͳӨڹͷ͋ΒΘΕ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ αΠυνϟωϧ߈ܸͷجૅ ‣ 8FCͷྖҬʹ͓͍ͯ΋αΠυνϟωϧ߈ܸ͸ແࢹͰ͖ͳ͍ɻ ‣ αʔόαΠυͷαΠυνϟωϧΛ༻͍ͨ߈ܸ ‣ දݱྗͷߴ͍ΫΤϦݴޠΛड͚औΓɺͦΕͰ৘ใ಺Λ૸ࠪ͢Δͱ͖͸ɺΘ͔ͣͳڍ
ಈ͕ࠩ໰୊ʹͳΔ৔߹͕͋ΔͷͰɺ஫ҙΛ෷͓͏ɻ ‣ ૸ࠪʹݶΒͣɺେ੾ͳσʔλͷॲཧͰ͸ɺ ࠷ྑcฏۉc࠷ѱ ܭࢉྔͷࠩΛҙࣝ͠Α͏ɻ ‣ 8FCϒϥ΢β಺ͷαΠυνϟωϧΛ༻͍ͨ߈ܸ ‣ ͦ΋ͦ΋େ੾ͳ৘ใ͕8FCϒϥ΢βʹಧ͔ͳ͍Α͏ʹɺ$PPLJFͷSameSite ଐ ੑΛݫ͠໨ʹӡ༻Ͱ͖ΔͱΑ͍ɻ ‣ X-Frame-Options ϔομ΍$41ͷframe-ancestors σΟϨΫςΟϒɺCross- Origin-Resource-Policy ϔομɺCross-Origin-Opener-Policy ϔο μɺrel=noopenerଐੑͳͲʹΑΓɺ͞Βʹ৘ใ࿙Εग़͢ܦ࿏Λ௵ͤΔɻ

TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ऴΘΓʹ ‣ ηΩϡϦςΟ͸कΔ΂͖΋ͷ͋Γ͖ͷଘࡏͳͷͰʜ ‣ ·ͣ͸ɺͦͷकΔ΂͖΋ͷΛे෼ʹཧղ͢Δ͜ͱ͕େ੾ɻ ‣ ͦͯ͠ɺकΔ΂͖΋ͷ͕มԽ͍͚ͯ͠͹ηΩϡϦςΟΛߟ͑Δ্Ͱ࣋ͭ΂͖ࢹ఺΋มԽ ͍ͯ͘͜͠ͱΛ๨Εͣʹ͋Γ͍ͨɻ
‣ Ҿ͖ଓָ͖ٕ͘͠ज़ͱ޲͖߹͍͖ͬͯ·͠ΐ͏

マクロな視点から捉える Web セキュリティ / Web Security from the ...

マクロな視点から捉える Web セキュリティ / Web Security from the Macro Perspective

More Decks by Takashi Yoneuchi

Other Decks in Programming

Featured

Transcript