Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
認証・認可の仕組みを理解する上で知っておきたい基礎知識/auth-overview
Search
nishina
May 08, 2020
Programming
1
230
認証・認可の仕組みを理解する上で知っておきたい基礎知識/auth-overview
nishina
May 08, 2020
Tweet
Share
More Decks by nishina
See All by nishina
1週間で終わらせるはじめてのGo言語学習/beginner-study-go
nishina555
1
150
Postmanを利用したAPI開発/postman-tutorial
nishina555
0
94
テキスト校正ツールtextlintの 紹介と導入方法/textlint-overview
nishina555
0
92
REST APIとの比較でざっくり理解するGraphQL/graphql-introduction
nishina555
0
190
ウィンドウ操作に便利な ショートカットとアプリ紹介/mac-window-shortcut
nishina555
0
150
IPアドレス(IPv4)の仕組み/overview-of-ipaddress
nishina555
0
140
図で理解する自然言語処理/nlp_tutorial
nishina555
0
260
ToDoアプリで学ぶReact/Redux入門/vtecx2_lt2
nishina555
2
2.9k
DiveIntoOSSThroughHacktoberfest_SPMKT
nishina555
1
320
Other Decks in Programming
See All in Programming
11年かかって やっとVibe Codingに 時代が追いつきましたね
yimajo
0
220
コーディングエージェント概観(2025/07)
itsuki_t88
0
460
React 使いじゃなくても知っておきたい教養としての React
oukayuka
18
4.7k
MySQL9でベクトルカラム登場!PHP×AWSでのAI/類似検索はこう変わる
suguruooki
1
260
AI Ramen Fight
yusukebe
0
120
大規模FlutterプロジェクトのCI実行時間を約8割削減した話
teamlab
PRO
0
310
構文解析器入門
ydah
7
1.9k
TypeScriptでDXを上げろ! Hono編
yusukebe
4
890
AWS Summit Japan 2024と2025の比較/はじめてのKiro、今あなたは岐路に立つ
satoshi256kbyte
1
260
Git Sync を超える!OSS で実現する CDK Pull 型デプロイ / Deploying CDK with PipeCD in Pull-style
tkikuc
4
490
[Codecon - 2025] Como não odiar seus testes
camilacampos
0
100
Understanding Kotlin Multiplatform
l2hyunwoo
0
240
Featured
See All Featured
A Tale of Four Properties
chriscoyier
160
23k
Evolution of real-time – Irina Nazarova, EuRuKo, 2024
irinanazarova
8
860
KATA
mclloyd
31
14k
The Pragmatic Product Professional
lauravandoore
35
6.8k
Code Reviewing Like a Champion
maltzj
524
40k
Easily Structure & Communicate Ideas using Wireframe
afnizarnur
194
16k
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
eileencodes
26
2.9k
Build your cross-platform service in a week with App Engine
jlugia
231
18k
Site-Speed That Sticks
csswizardry
10
730
Performance Is Good for Brains [We Love Speed 2024]
tammyeverts
10
1k
Improving Core Web Vitals using Speculation Rules API
sergeychernyshev
18
1k
It's Worth the Effort
3n
185
28k
Transcript
ਔՊ ढ़ ೝূɾೝՄͷΈΛཧղ͢Δ্Ͱ ͓͖͍ͬͯͨجૅࣝ
࣍ • ࠓճ͢༰ • ηογϣϯʹؔ͢Δجૅࣝ • ೝূɾೝՄʹ͍ͭͯ • ೝূͷ۩ମతͳ࣮ख๏
• ·ͱΊ
࣍ • ࠓճ͢༰ • ηογϣϯʹؔ͢Δجૅࣝ • ೝূɾೝՄʹ͍ͭͯ • ೝূͷ۩ମతͳ࣮ख๏
• ·ͱΊ
• ೝূͱೝՄͷҧ͍ʹ͍ͭͯ • ηογϣϯೝূͱτʔΫϯೝূͷҧ͍ʹ͍ͭͯ • ೝূͷηΩϡϦςΟϦεΫXSSɾCSRFʹ͍ͭͯ ೝূɾೝՄʹؔ͢Δ֓ཁͱجૅࣝͷڞ༗ ϞϊϦγοΫͳΞϓϦΛׂ͢Δʹ͋ͨΓɺೝূɾೝՄͷ࣮ํ๏ ͷݕ౼ආ͚ͯ௨Ε·ͤΜɻ
Լ४උͱͯ͠ɺࠓճೝূɾೝՄͷجૅࣝʹ͍ͭͯ·ͱΊ·ͨ͠
࣍ • ࠓճ͢༰ • ηογϣϯʹؔ͢Δجૅࣝ • ೝূɾೝՄʹ͍ͭͯ • ೝূ࣮ख๏
• ·ͱΊ
• εςʔτϑϧ • ݱࡏͷঢ়ଶΛͭ • ྫ: FTP, TCP, BGP, OSPF,
EIGRP, SMTP, SSH • εςʔτϨε • ݱࡏͷঢ়ଶΛͨͳ͍ • ྫ: HTTP, UDP, IP, DNS εςʔτϑϧͱεςʔτϨεʹ͍ͭͯ σʔλ௨৴ʹεςʔτϑϧͱεςʔτϨεͷ2छྨ͕͋Δ
εςʔτϑϧͳΓͱΓ ͝จʁ ηοτͷυϦϯΫʁ ళͰঌ্͕͠Γ·͔͢ʁ ϋϯόʔΨʔηοτ͍ͩ͘͞ ίʔϥ͍ͩ͘͞ ͍
εςʔτϨεͳΓͱΓ ͝จʁ ηοτͷ߹ɺυϦϯΫจͯ͠Լ͍͞ จͷࡍళͰঌ্͕͠Δ͔͓͑Լ͍͞ ϋϯόʔΨʔηοτ͍ͩ͘͞ ϋϯόʔΨʔηοτͱίʔϥ͍ͩ͘͞ ϋϯόʔΨʔηοτͱίʔϥ͍ͩ͘͞ ళͰ৯·͢
• WebαΠτHTTP௨৴Λར༻͢ΔͷͰεςʔτϨε • ࣮ࡍʹECαΠτͷʮങ͍Χΰʯɺঢ়ଶʹԠͯ͡ αΠτͷڍಈΛม͍͑ͨ ηογϣϯͷඞཁੑ HTTP௨৴ͰεςʔτϑϧΛ࣮ݱ͢ΔͨΊͷׂ͕ηογϣϯ
• Cookie • WebStorage • SessionStorage • LocalStorage ηογϣϯใͷอଘઌ
ΫϥΠΞϯτ(ϒϥβ)ʹCookieͱWebStorageͷ2छྨ͕ଘࡏ
• αʔόʔଆͷηογϣϯΛཧ͢ΔͨΊͷͷ • 4KBͷσʔλαΠζ੍͕͋Δ • ΫϥΠΞϯτ͔ΒαʔόʔͷϦΫΤετ࣌ࣗಈૹ৴ • αʔόʔ͔ΒΫϥΠΞϯτͷϨεϙϯε࣌ Set-Cookieϔομʔʹηοτͯ͠ૹΒΕΔ
ηογϣϯใͷอଘઌ: Cookie
• ΫϥΠΞϯτଆͷηογϣϯΛཧ͢Δͷ • ΫϥΠΞϯτଆͰར༻Ͱ͖ΔσʔλϕʔεͷΑ͏ͳͷ • ϒϥβ͕։͍ͯΔ͚࣌ͩར༻ՄೳͳʮSessionStorageʯ • ӬଓతʹσʔλΛอଘͰ͖ΔʮLocalStorageʯ ηογϣϯใͷอଘઌ:
WebStorage
࣍ • ࠓճ͢༰ • ηογϣϯʹؔ͢Δجૅࣝ • ೝূɾೝՄʹ͍ͭͯ • ೝূͷ۩ମతͳ࣮ख๏
• ·ͱΊ
• ೝূʢAuthenticationʣ • ୭Ͱ͋Δ͔Λ֬ೝ͢Δ͜ͱ • ྫ: ύεϫʔυೝূɺࢦೝূͳͲ • ೝূʹࣦഊͨ͠ͱ͖ͷΤϥʔʮ401 Unauthorizedʯ
• ೝՄʢAuthorizationʣ • ૢ࡞ͷݖݶΛ༩͑Δ͜ͱ • ྫ: Ӿཡ੍ݶͷ͋ΔϖʔδͷΞΫηεͳͲ • ݖݶෆʹΑΔΤϥʔʮ403 Forbiddenʯ ೝূͱೝՄͷҧ͍
ೝূͷख๏ʹ͍ͭͯ ηογϣϯʔεͷೝূ ʢεςʔτϑϧʣ τʔΫϯϕʔεͷೝূ ʢεςʔτϨεʣ
ηογϣϯʔεͷೝূ 1. ΫϨσϯγϟϧΛPOST 2. ೝূޭޙɺηογϣϯใ ͕ฦͬͯ͘Δ 3. ηογϣϯใΛར༻ͯ͠ ೝՄ௨৴Λߦ͏
τʔΫϯϕʔεͷೝূʢ1/3ʣ 1. ΫϨσϯγϟϧΛPOST 2. ೝূޭޙɺτʔΫϯ͕ฦͬͯ ͘Δ 3. τʔΫϯΛར༻ͯ͠ೝՄ௨৴Λ ߦ͏
ɾํ๏1: Authorizationϔομʔʹ τʔΫϯΛηοτ ɾํ๏2: CookieʹτʔΫϯΛอଘ
• ࣝผࢠܕ • DBʹτʔΫϯͷใΛอଘ͓ͯ͘͠λΠϓͷτʔΫϯ • แܕ • ΞΫηετʔΫϯʹඥ͘ใΛΞΫηετʔΫϯࣗମͷதʹຒ ΊࠐΉͷɻ •
JWTแܕ τʔΫϯϕʔεͷೝূʢ2/3ʣ τʔΫϯͷछྨʹ͍ͭͯ \ lTDPQFzlYYYz lDMJFOU@JEzlYYYz lFYQzlYYYz lJBUzlYYYz lTVCzlYYYz lJTTzlYYYz lKUJzlYYYz ^ แܕ ࣝผࢠܕ
• OAuth2.0ʹ͍ͭͯ • τʔΫϯͷܗࣜɺτʔΫϯͷཁٻͱͦͷԠͳͲɺ τʔΫϯͷ༷Λඪ४Խͨ͠ͷ • ʮೝՄʯΛඪ४Խͨ͠ͷͰ͋Γʮೝূʯ෦ είʔϓ֎ • OAuth2.0Ͱඪ४Խ͞Ε͍ͯΔϑϩʔ
• ೝՄίʔυϑϩʔ • ΠϯϓϦγοτϑϩʔ • ϦιʔεΦʔφʔɾύεϫʔυɾΫϨσϯγϟϧζϑϩʔ • ΫϥΠΞϯτɾΫϨσϯγϟϧζϑϩʔ • ϦϑϨογϡτʔΫϯϑϩʔ τʔΫϯϕʔεͷೝূʢ3/3ʣ
• XSS • ѱҙͷ͋ΔJavaScript͕ΫϥΠΞϯτଆͰ࣮ߦ͞Εɺ ػີใ͕ൈ͔ΕΔͳͲͷඃ͕ൃੜ͢Δ੬ऑੑ • ΫϥΠΞϯτଆͰൃੜ͢Δ੬ऑੑ • CSRF •
ѱҙͷ͋ΔϦΫΤετΛαʔόʔड͚͚ɺ ҙਤ͠ͳ͍ॲཧ͕ߦΘΕͯ͠·͏੬ऑੑ • αʔόʔଆͰൃੜ͢Δ੬ऑੑ ೝূɾೝՄʹ͓͚ΔηΩϡϦςΟϦεΫ
࣍ • ࠓճ͢༰ • ηογϣϯʹؔ͢Δجૅࣝ • ೝূɾೝՄʹ͍ͭͯ • ೝূͷ۩ମతͳ࣮ख๏
• ·ͱΊ
• ηογϣϯϕʔε • τʔΫϯϕʔε • CookieʹอଘɺϦΫΤετ࣌ʹCookieΛࣗಈૹ৴ • CookieʹอଘɺAuthorizationϔομʔʹ༩ͯ͠ϦΫΤετ • LocalStorageʹอଘɺAuthorizationϔομʔʹ༩ͯ͠
ϦΫΤετ ೝূɾೝՄͷख๏·ͱΊ ηογϣϯϕʔε1ͭɺτʔΫϯϕʔε3ͭͷ߹ܭ4छྨΛհ ࢀߟIUUQTRJJUBDPN)JSPNJJUFNTFBGGE
• XSSରࡦ • Cookieʹhttp:onlyΛ͚ͭΔ͜ͱͰJavaScriptͰΞΫηε Ͱ͖ͳ͍Α͏ʹ͢Δ • CSRFରࡦ • CSRFτʔΫϯ •
ύεϫʔυΛ࠶ೖྗ͢Δ༷ʹ͢Δ ηογϣϯϕʔε Cookieࣗಈૹ৴͞ΕΔͷͰɺѱҙͷ͋ΔϦΫΤετ͔ผ ͢ΔͨΊʹCSRFରࡦʹ͍ͭͯߟ͑Δඞཁ͕͋Δ
• XSSରࡦ • Cookieʹhttp:onlyΛ͚ͭΔ͜ͱͰJavaScriptͰΞΫηε Ͱ͖ͳ͍Α͏ʹ͢Δ • CSRFରࡦ • CSRFτʔΫϯ •
ύεϫʔυΛ࠶ೖྗ͢Δ༷ʹ͢Δ τʔΫϯϕʔε: Cookieʹอଘɾૹ৴ ηογϣϯϕʔεͷ࣌ͱಉ͡
• XSSରࡦ • ϑϨʔϜϫʔΫͷػೳΛར༻ͯ͠ϥΠϒϥϦʹ੬ऑੑ͕ ͳ͍͔νΣοΫ • CSRFରࡦ • CookieͷτʔΫϯݕূͰར༻͠ͳ͍ͷͰߟྀෆཁ
τʔΫϯϕʔε: Cookieʹอଘɾϔομʔૹ৴ ϔομʔʹηοτ͢ΔτʔΫϯΛCookie͔ΒऔΓग़ͨ͢Ίʹ http:falseʹ͠ͳ͍ͱ͍͚ͳ͍ͷͰXSS੬ऑੑ͕ൃੜ͢Δ
• XSSରࡦ • ϑϨʔϜϫʔΫͷػೳΛར༻ͯ͠ϥΠϒϥϦʹ੬ऑੑ͕ ͳ͍͔νΣοΫ • CSRFରࡦ • LocalStorageͷσʔλϦΫΤετ࣌ʹࣗಈͰૹΒΕΔ͜ ͱͳ͍ͷͰߟྀෆཁ
τʔΫϯϕʔε: LocalStorageʹอଘɾϔομʔૹ৴ LocalStorageJavaScriptͰΞΫηεͰ͖ΔͷͰXSSͷϦεΫ ͋Γ
࣍ • ࠓճ͢༰ • ηογϣϯʹؔ͢Δجૅࣝ • ೝূɾೝՄʹ͍ͭͯ • ೝূͷ۩ମతͳ࣮ख๏
• ·ͱΊ
• ೝূ୭Ͱ͋Δ͔Λ֬ೝ͢Δ͜ͱɺೝՄૢ࡞ͷݖݶΛ༩͑ Δ͜ͱ • ೝূํ๏ʹηογϣϯํࣜͱτʔΫϯํࣜͷ2͕ͭ͋Δ • ೝূͷΈΛ࣮͢Δ߹XSSͱCSRFͷ੬ऑੑΛҙࣝ ͢Δ ·ͱΊ