Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Speaker Deck
PRO
Sign in
Sign up for free
認証・認可の仕組みを理解する上で知っておきたい基礎知識/auth-overview
Toshiharu Nishina
May 08, 2020
Programming
1
85
認証・認可の仕組みを理解する上で知っておきたい基礎知識/auth-overview
Toshiharu Nishina
May 08, 2020
Tweet
Share
More Decks by Toshiharu Nishina
See All by Toshiharu Nishina
1週間で終わらせるはじめてのGo言語学習/beginner-study-go
nishina555
1
24
Postmanを利用したAPI開発/postman-tutorial
nishina555
0
20
テキスト校正ツールtextlintの 紹介と導入方法/textlint-overview
nishina555
0
28
REST APIとの比較でざっくり理解するGraphQL/graphql-introduction
nishina555
0
130
ウィンドウ操作に便利な ショートカットとアプリ紹介/mac-window-shortcut
nishina555
0
92
IPアドレス(IPv4)の仕組み/overview-of-ipaddress
nishina555
0
70
図で理解する自然言語処理/nlp_tutorial
nishina555
0
160
ToDoアプリで学ぶReact/Redux入門/vtecx2_lt2
nishina555
2
2.3k
DiveIntoOSSThroughHacktoberfest_SPMKT
nishina555
1
260
Other Decks in Programming
See All in Programming
Enzyme から React Native Testing Library に移行した経緯 / 2022-07-20
tamago3keran
1
160
SwiftUI+TCAに挑戦!NewsPicks iOSアプリのリアーキテクチャ/re-architecture-newspicks-ios-app-with-swiftui-and-tca
takehilo
0
350
ストア評価「2.4」だったCOCOARアプリを1年で「4.4」になんとかした方法@Cloud CIRCUS Meetup #2
1901drama
0
180
JetpackCompose 導入半年で感じた 改善点
spbaya0141
0
140
kintone × LINE Bot で餃子検定Botを作った話
naberina
0
240
Rに管理されてみる
kazutan
0
250
プロダクトのタイプ別 GraphQL クライアントの選び方
shozawa
0
8.1k
10歳の minne から、これから長く続くプロダクトを作るすべての人へ
tsumichan
9
3.5k
How to start contributing to Kubernetes Projects
ydfu
0
120
SGGとは
inoue2002
0
430
料理の注文メニューの3D化への挑戦
hideg
0
270
Getting Started With Data Structures
adoranwodo
1
250
Featured
See All Featured
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
marktimemedia
15
970
The Pragmatic Product Professional
lauravandoore
19
3.1k
What the flash - Photography Introduction
edds
62
10k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
jcasabona
12
940
Principles of Awesome APIs and How to Build Them.
keavy
113
15k
How to name files
jennybc
40
63k
The Invisible Side of Design
smashingmag
290
48k
Put a Button on it: Removing Barriers to Going Fast.
kastner
56
2.3k
Side Projects
sachag
450
37k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
39
13k
Building Adaptive Systems
keathley
25
1.1k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
29
4.4k
Transcript
ਔՊ ढ़ ೝূɾೝՄͷΈΛཧղ͢Δ্Ͱ ͓͖͍ͬͯͨجૅࣝ
࣍ • ࠓճ͢༰ • ηογϣϯʹؔ͢Δجૅࣝ • ೝূɾೝՄʹ͍ͭͯ • ೝূͷ۩ମతͳ࣮ख๏
• ·ͱΊ
࣍ • ࠓճ͢༰ • ηογϣϯʹؔ͢Δجૅࣝ • ೝূɾೝՄʹ͍ͭͯ • ೝূͷ۩ମతͳ࣮ख๏
• ·ͱΊ
• ೝূͱೝՄͷҧ͍ʹ͍ͭͯ • ηογϣϯೝূͱτʔΫϯೝূͷҧ͍ʹ͍ͭͯ • ೝূͷηΩϡϦςΟϦεΫXSSɾCSRFʹ͍ͭͯ ೝূɾೝՄʹؔ͢Δ֓ཁͱجૅࣝͷڞ༗ ϞϊϦγοΫͳΞϓϦΛׂ͢Δʹ͋ͨΓɺೝূɾೝՄͷ࣮ํ๏ ͷݕ౼ආ͚ͯ௨Ε·ͤΜɻ
Լ४උͱͯ͠ɺࠓճೝূɾೝՄͷجૅࣝʹ͍ͭͯ·ͱΊ·ͨ͠
࣍ • ࠓճ͢༰ • ηογϣϯʹؔ͢Δجૅࣝ • ೝূɾೝՄʹ͍ͭͯ • ೝূ࣮ख๏
• ·ͱΊ
• εςʔτϑϧ • ݱࡏͷঢ়ଶΛͭ • ྫ: FTP, TCP, BGP, OSPF,
EIGRP, SMTP, SSH • εςʔτϨε • ݱࡏͷঢ়ଶΛͨͳ͍ • ྫ: HTTP, UDP, IP, DNS εςʔτϑϧͱεςʔτϨεʹ͍ͭͯ σʔλ௨৴ʹεςʔτϑϧͱεςʔτϨεͷ2छྨ͕͋Δ
εςʔτϑϧͳΓͱΓ ͝จʁ ηοτͷυϦϯΫʁ ళͰঌ্͕͠Γ·͔͢ʁ ϋϯόʔΨʔηοτ͍ͩ͘͞ ίʔϥ͍ͩ͘͞ ͍
εςʔτϨεͳΓͱΓ ͝จʁ ηοτͷ߹ɺυϦϯΫจͯ͠Լ͍͞ จͷࡍళͰঌ্͕͠Δ͔͓͑Լ͍͞ ϋϯόʔΨʔηοτ͍ͩ͘͞ ϋϯόʔΨʔηοτͱίʔϥ͍ͩ͘͞ ϋϯόʔΨʔηοτͱίʔϥ͍ͩ͘͞ ళͰ৯·͢
• WebαΠτHTTP௨৴Λར༻͢ΔͷͰεςʔτϨε • ࣮ࡍʹECαΠτͷʮങ͍Χΰʯɺঢ়ଶʹԠͯ͡ αΠτͷڍಈΛม͍͑ͨ ηογϣϯͷඞཁੑ HTTP௨৴ͰεςʔτϑϧΛ࣮ݱ͢ΔͨΊͷׂ͕ηογϣϯ
• Cookie • WebStorage • SessionStorage • LocalStorage ηογϣϯใͷอଘઌ
ΫϥΠΞϯτ(ϒϥβ)ʹCookieͱWebStorageͷ2छྨ͕ଘࡏ
• αʔόʔଆͷηογϣϯΛཧ͢ΔͨΊͷͷ • 4KBͷσʔλαΠζ੍͕͋Δ • ΫϥΠΞϯτ͔ΒαʔόʔͷϦΫΤετ࣌ࣗಈૹ৴ • αʔόʔ͔ΒΫϥΠΞϯτͷϨεϙϯε࣌ Set-Cookieϔομʔʹηοτͯ͠ૹΒΕΔ
ηογϣϯใͷอଘઌ: Cookie
• ΫϥΠΞϯτଆͷηογϣϯΛཧ͢Δͷ • ΫϥΠΞϯτଆͰར༻Ͱ͖ΔσʔλϕʔεͷΑ͏ͳͷ • ϒϥβ͕։͍ͯΔ͚࣌ͩར༻ՄೳͳʮSessionStorageʯ • ӬଓతʹσʔλΛอଘͰ͖ΔʮLocalStorageʯ ηογϣϯใͷอଘઌ:
WebStorage
࣍ • ࠓճ͢༰ • ηογϣϯʹؔ͢Δجૅࣝ • ೝূɾೝՄʹ͍ͭͯ • ೝূͷ۩ମతͳ࣮ख๏
• ·ͱΊ
• ೝূʢAuthenticationʣ • ୭Ͱ͋Δ͔Λ֬ೝ͢Δ͜ͱ • ྫ: ύεϫʔυೝূɺࢦೝূͳͲ • ೝূʹࣦഊͨ͠ͱ͖ͷΤϥʔʮ401 Unauthorizedʯ
• ೝՄʢAuthorizationʣ • ૢ࡞ͷݖݶΛ༩͑Δ͜ͱ • ྫ: Ӿཡ੍ݶͷ͋ΔϖʔδͷΞΫηεͳͲ • ݖݶෆʹΑΔΤϥʔʮ403 Forbiddenʯ ೝূͱೝՄͷҧ͍
ೝূͷख๏ʹ͍ͭͯ ηογϣϯʔεͷೝূ ʢεςʔτϑϧʣ τʔΫϯϕʔεͷೝূ ʢεςʔτϨεʣ
ηογϣϯʔεͷೝূ 1. ΫϨσϯγϟϧΛPOST 2. ೝূޭޙɺηογϣϯใ ͕ฦͬͯ͘Δ 3. ηογϣϯใΛར༻ͯ͠ ೝՄ௨৴Λߦ͏
τʔΫϯϕʔεͷೝূʢ1/3ʣ 1. ΫϨσϯγϟϧΛPOST 2. ೝূޭޙɺτʔΫϯ͕ฦͬͯ ͘Δ 3. τʔΫϯΛར༻ͯ͠ೝՄ௨৴Λ ߦ͏
ɾํ๏1: Authorizationϔομʔʹ τʔΫϯΛηοτ ɾํ๏2: CookieʹτʔΫϯΛอଘ
• ࣝผࢠܕ • DBʹτʔΫϯͷใΛอଘ͓ͯ͘͠λΠϓͷτʔΫϯ • แܕ • ΞΫηετʔΫϯʹඥ͘ใΛΞΫηετʔΫϯࣗମͷதʹຒ ΊࠐΉͷɻ •
JWTแܕ τʔΫϯϕʔεͷೝূʢ2/3ʣ τʔΫϯͷछྨʹ͍ͭͯ \ lTDPQFzlYYYz lDMJFOU@JEzlYYYz lFYQzlYYYz lJBUzlYYYz lTVCzlYYYz lJTTzlYYYz lKUJzlYYYz ^ แܕ ࣝผࢠܕ
• OAuth2.0ʹ͍ͭͯ • τʔΫϯͷܗࣜɺτʔΫϯͷཁٻͱͦͷԠͳͲɺ τʔΫϯͷ༷Λඪ४Խͨ͠ͷ • ʮೝՄʯΛඪ४Խͨ͠ͷͰ͋Γʮೝূʯ෦ είʔϓ֎ • OAuth2.0Ͱඪ४Խ͞Ε͍ͯΔϑϩʔ
• ೝՄίʔυϑϩʔ • ΠϯϓϦγοτϑϩʔ • ϦιʔεΦʔφʔɾύεϫʔυɾΫϨσϯγϟϧζϑϩʔ • ΫϥΠΞϯτɾΫϨσϯγϟϧζϑϩʔ • ϦϑϨογϡτʔΫϯϑϩʔ τʔΫϯϕʔεͷೝূʢ3/3ʣ
• XSS • ѱҙͷ͋ΔJavaScript͕ΫϥΠΞϯτଆͰ࣮ߦ͞Εɺ ػີใ͕ൈ͔ΕΔͳͲͷඃ͕ൃੜ͢Δ੬ऑੑ • ΫϥΠΞϯτଆͰൃੜ͢Δ੬ऑੑ • CSRF •
ѱҙͷ͋ΔϦΫΤετΛαʔόʔड͚͚ɺ ҙਤ͠ͳ͍ॲཧ͕ߦΘΕͯ͠·͏੬ऑੑ • αʔόʔଆͰൃੜ͢Δ੬ऑੑ ೝূɾೝՄʹ͓͚ΔηΩϡϦςΟϦεΫ
࣍ • ࠓճ͢༰ • ηογϣϯʹؔ͢Δجૅࣝ • ೝূɾೝՄʹ͍ͭͯ • ೝূͷ۩ମతͳ࣮ख๏
• ·ͱΊ
• ηογϣϯϕʔε • τʔΫϯϕʔε • CookieʹอଘɺϦΫΤετ࣌ʹCookieΛࣗಈૹ৴ • CookieʹอଘɺAuthorizationϔομʔʹ༩ͯ͠ϦΫΤετ • LocalStorageʹอଘɺAuthorizationϔομʔʹ༩ͯ͠
ϦΫΤετ ೝূɾೝՄͷख๏·ͱΊ ηογϣϯϕʔε1ͭɺτʔΫϯϕʔε3ͭͷ߹ܭ4छྨΛհ ࢀߟIUUQTRJJUBDPN)JSPNJJUFNTFBGGE
• XSSରࡦ • Cookieʹhttp:onlyΛ͚ͭΔ͜ͱͰJavaScriptͰΞΫηε Ͱ͖ͳ͍Α͏ʹ͢Δ • CSRFରࡦ • CSRFτʔΫϯ •
ύεϫʔυΛ࠶ೖྗ͢Δ༷ʹ͢Δ ηογϣϯϕʔε Cookieࣗಈૹ৴͞ΕΔͷͰɺѱҙͷ͋ΔϦΫΤετ͔ผ ͢ΔͨΊʹCSRFରࡦʹ͍ͭͯߟ͑Δඞཁ͕͋Δ
• XSSରࡦ • Cookieʹhttp:onlyΛ͚ͭΔ͜ͱͰJavaScriptͰΞΫηε Ͱ͖ͳ͍Α͏ʹ͢Δ • CSRFରࡦ • CSRFτʔΫϯ •
ύεϫʔυΛ࠶ೖྗ͢Δ༷ʹ͢Δ τʔΫϯϕʔε: Cookieʹอଘɾૹ৴ ηογϣϯϕʔεͷ࣌ͱಉ͡
• XSSରࡦ • ϑϨʔϜϫʔΫͷػೳΛར༻ͯ͠ϥΠϒϥϦʹ੬ऑੑ͕ ͳ͍͔νΣοΫ • CSRFରࡦ • CookieͷτʔΫϯݕূͰར༻͠ͳ͍ͷͰߟྀෆཁ
τʔΫϯϕʔε: Cookieʹอଘɾϔομʔૹ৴ ϔομʔʹηοτ͢ΔτʔΫϯΛCookie͔ΒऔΓग़ͨ͢Ίʹ http:falseʹ͠ͳ͍ͱ͍͚ͳ͍ͷͰXSS੬ऑੑ͕ൃੜ͢Δ
• XSSରࡦ • ϑϨʔϜϫʔΫͷػೳΛར༻ͯ͠ϥΠϒϥϦʹ੬ऑੑ͕ ͳ͍͔νΣοΫ • CSRFରࡦ • LocalStorageͷσʔλϦΫΤετ࣌ʹࣗಈͰૹΒΕΔ͜ ͱͳ͍ͷͰߟྀෆཁ
τʔΫϯϕʔε: LocalStorageʹอଘɾϔομʔૹ৴ LocalStorageJavaScriptͰΞΫηεͰ͖ΔͷͰXSSͷϦεΫ ͋Γ
࣍ • ࠓճ͢༰ • ηογϣϯʹؔ͢Δجૅࣝ • ೝূɾೝՄʹ͍ͭͯ • ೝূͷ۩ମతͳ࣮ख๏
• ·ͱΊ
• ೝূ୭Ͱ͋Δ͔Λ֬ೝ͢Δ͜ͱɺೝՄૢ࡞ͷݖݶΛ༩͑ Δ͜ͱ • ೝূํ๏ʹηογϣϯํࣜͱτʔΫϯํࣜͷ2͕ͭ͋Δ • ೝূͷΈΛ࣮͢Δ߹XSSͱCSRFͷ੬ऑੑΛҙࣝ ͢Δ ·ͱΊ