iOSアプリのセキュリティ基礎

Slide 1

Slide 1 text

iOSΞϓϦͷηΩϡϦςΟجૅ iOSDC Japan 2021 saten @saten_work 58*55&3 58&&5 3&58&&5BOEUIF5XJUUFS#JSEMPHPBSFUSBEFNBSLTPG5XJUUFS*ODPSJUTBGGJMJBUFT

Slide 2

Slide 2 text

Slide 3

Slide 3 text

Copyright © Kakaku.com Inc. All Rights Reserved. ࣗݾ঺հ saten גࣜձࣾΧΧΫίϜ ৯΂ϩάॴଐ ɹɹ@saten_work ܦྺ 2011ʙ iPhoneΞϓϦ։ൃͷ࢓ࣄ࢝ΊΔ 2015ʙ גࣜձࣾΧΧΫίϜೖࣾ ৯΂ϩάࢀը 58*55&3 58&&5 3&58&&5BOEUIF5XJUUFS#JSEMPHPBSFUSBEFNBSLTPG5XJUUFS*ODPSJUTBGGJMJBUFT

Slide 4

Slide 4 text

Copyright © Kakaku.com Inc. All Rights Reserved. ࣗݾ঺հ saten גࣜձࣾΧΧΫίϜ ৯΂ϩάॴଐ ɹɹ@saten_work ܦྺ 2011ʙ iPhoneΞϓϦ։ൃͷ࢓ࣄ࢝ΊΔ 2015ʙ גࣜձࣾΧΧΫίϜೖࣾ ৯΂ϩάࢀը झຯ ࢠڙͱ༡Ϳ Ωϟϯϓ(ॳ৺ऀ) 58*55&3 58&&5 3&58&&5BOEUIF5XJUUFS#JSEMPHPBSFUSBEFNBSLTPG5XJUUFS*ODPSJUTBGGJMJBUFT

Slide 5

Slide 5 text

No content

Slide 6

Slide 6 text

Slide 7

Slide 7 text

ηΩϡϦςΟɾγεςϜ͸ৗউΛٛ຿͚ͮΒΕɺ ߈ܸऀ͸Ұ౓উ͚ͭͩͰྑ͍ͱ͍͏֨ݴ͸తΛࣹͯΔɻ μϥεϋοΧʔڠձ૑ઃऀ %VTUJO%ZLFT

Slide 8

Slide 8 text

http/https௨৴͢Δ্ͰؾΛ͚ͭͨํ͕ྑ͍͜ͱ

Slide 9

Slide 9 text

Slide 10

Slide 10 text

Slide 11

Slide 11 text

Slide 12

Slide 12 text

Slide 13

Slide 13 text

Slide 14

Slide 14 text

Slide 15

Slide 15 text

Slide 16

Slide 16 text

Slide 17

Slide 17 text

Slide 18

Slide 18 text

Slide 19

Slide 19 text

Slide 20

Slide 20 text

Slide 21

Slide 21 text

Slide 22

Slide 22 text

Slide 23

Slide 23 text

Slide 24

Slide 24 text

Copyright © Kakaku.com Inc. All Rights Reserved. iOSͷΦϨΦϨূ໌ॻͷΠϯετʔϧɾ৴པखॱ 1. ΦϨΦϨূ໌ॻ(derϑΝΠϧ)ΛiOSσόΠεʹ SafariͳͲͰμ΢ϯϩʔυ͠·͢  2. ઃఆΞϓϦˠҰൠˠϓϩϑΝΠϧˠμ΢ϯϩʔυ  ࡁΈϓϩϑΝΠϧˠର৅Λબ୒ˠΠϯετʔϧ  Ͱϧʔτূ໌ॻΛΠϯετʔϧ͠·͢  3. ઃఆΞϓϦˠҰൠˠ৘ใˠূ໌ॻ৴པઃఆ  ͰӈଆͷΑ͏ʹΠϯετʔϧͨ͠ϧʔτূ໌ॻͷ ৴པঢ়ଶΛONʹͯ͠৴པঢ়ଶʹ͠·͢

Slide 25

Slide 25 text

Slide 26

Slide 26 text

Slide 27

Slide 27 text

Copyright © Kakaku.com Inc. All Rights Reserved. SSLͱTLSͷҧ͍ 1990೥୅தࠒʙ NetscapeࣾͰSSL։ൃ 1996೥5݄ʙ SSLΛNetscape͔ࣾΒIETF΁Ҡ؅͢ΔͨΊʹɺTLSϫʔΩϯάάϧʔϓ͕݁੒ ηΩϡϦςΟઐ໳ՈΛަ͑ͨୈࡾऀػؔͰ։ൃ͢ΔͨΊͷાஔ 1999೥1݄ʙ TLS ͕ϦϦʔε SSL 3.0ͱͷҧ͍͸Θ͔ͣͰ͕͢ɺ྆όʔδϣϯͷޓ׵ੑແ͠ ݱࡏ ଟ͘࢖ΘΕ͍ͯΔͷ͸SSLͰͳ͘TLS

Slide 28

Slide 28 text

Slide 29

Slide 29 text

Copyright © Kakaku.com Inc. All Rights Reserved. App Transport Security(ATS)ʹ͍ͭͯ • iOSͰ͸ΑΓߴ͍ηΩϡϦςΟڧ౓ͷߴ͍࢓༷ΛͰ͖Δ͚ͩ࢖༻ͯ͠΋ Β͏ͨΊɺApp Transport Securty(ATS)͕͋Δ  • ATSʹΑΓiOS9 ͔Β͸σϑΥϧτͰTLS1.2Ҏ্Ͱͳ͍ͱ௨৴Ͱ͖ͳ͘ ͳ͍ͬͯΔ  (CFNetworkͳͲͷ௿ϨϕϧͷωοτϫʔΫΠϯλʔϑΣʔεআ͘)  • ATS͸Info.plistͷઃఆͰશମ΍ಛఆυϝΠϯΛhttpɾTLS1.2ະຬڐ༰ͳ ͲՄೳ

Slide 30

Slide 30 text

Slide 31

Slide 31 text

Copyright © Kakaku.com Inc. All Rights Reserved. ATS(Info.plist)ʹ͍ͭͯ ໊લ Ωʔ λΠϓ આ໌ App Transport Security Settings NSAppTransportSecurity Dictionary ATSͷઃఆͷϧʔτ ɹAllow Arbitrary Loads NSAllowsArbitraryLoads Boolean ͢΂ͯͷωοτϫʔΫ઀ଓͰ ATSͷ੍ݶΛແޮʹ͢Δ͔Ͳ͏͔ ɹAllows Arbitrary Loads for Media NSAllowsArbitraryLoadsForMedia Boolean AVFoundationϑϨʔϜϫʔΫͷ͢΂ͯͷωοτϫʔΫ઀ଓͰ ATSͷ੍ݶΛແޮʹ͢Δ͔Ͳ͏͔ ɹAllow Arbitrary Loads in Web Content NSAllowsArbitraryLoadsInWebContent Boolean WebViewͷ͢΂ͯͷωοτϫʔΫ઀ଓͰ ATSͷ੍ݶΛແޮʹ͢Δ͔Ͳ͏͔ ɹException Domains NSExceptionDomains Dictionary ྫ֎υϝΠϯ ɹɹ(υϝΠϯ໊) (υϝΠϯ໊) Dictionary ྫ֎υϝΠϯͷઃఆ ɹɹɹNSIncludesSubdomains NSIncludesSubdomains Boolean αϒυϝΠϯΛؚΊΔ͔ ɹɹɹNSExceptionAllowsInsecureHTTPLoads NSExceptionAllowsInsecureHTTPLoads Boolean http઀ଓΛڐ༰͢Δ͔ ɹɹɹNSExceptionMinimumTLSVersion NSExceptionMinimumTLSVersion String ࠷খTLSόʔδϣϯ ɹɹɹNSExceptionRequiresForwardSecrecy NSExceptionRequiresForwardSecrecy Boolean σϑΥϧτͰڐ༰͍ͯ͠Δ ҉߸εΠʔτ (҉߸ΞϧΰϦζϜͷ૊Έ߹Θͤ)ͷΈʹ   ੍ݶ͢Δ͔ ※ ୅දతͳ΋ͷͷΈهࡌ

Slide 32

Slide 32 text

Slide 33

Slide 33 text

URLεΩʔϜͷ੬ऑੑ

Slide 34

Slide 34 text

Slide 35

Slide 35 text

Slide 36

Slide 36 text

Slide 37

Slide 37 text

Slide 38

Slide 38 text

Slide 39

Slide 39 text

Slide 40

Slide 40 text

Slide 41

Slide 41 text

Copyright © Kakaku.com Inc. All Rights Reserved. iOSͷγεςϜͷྖҬ URLεΩʔϜΛୣ͍औΔ - ରࡦᶃ Universal LinksΛ࢖༻ ΞϓϦA fuga.com ͱΞϓϦA ͕ඥ෇͘ apple-app-site-association fuga.com αʔόʔ ΞϓϦA Πϯετʔϧ࣌ʹ μ΢ϯϩʔυ͞ΕΔ Provisioning Profile Apple fuga.comͱΞϓϦAͷ ։ൃऀͰͳ͍ͱඥ෇͚Εͳ͍

Slide 42

Slide 42 text

Copyright © Kakaku.com Inc. All Rights Reserved. iOSͷγεςϜͷྖҬ URLεΩʔϜΛୣ͍औΔ - ରࡦᶃ Universal LinksΛ࢖༻ ΞϓϦA https://fuga.com/ʙ σʔλ fuga.com ͱΞϓϦA ͕ඥ෇͘ apple-app-site-association fuga.com αʔόʔ ΞϓϦA Πϯετʔϧ࣌ʹ μ΢ϯϩʔυ͞ΕΔ Provisioning Profile Apple fuga.comͱΞϓϦAͷ ։ൃऀͰͳ͍ͱඥ෇͚Εͳ͍

Slide 43

Slide 43 text

Copyright © Kakaku.com Inc. All Rights Reserved. URLεΩʔϜΛୣ͍औΔ - ରࡦᶃ Universal LinksΛ࢖༻ ΞϓϦA https://fuga.com/ʙ https://fuga.com/ʙʹ౰ͨΔॲཧΛ࣮ߦ σʔλ ϒϥ΢β ΞϓϦ https://fuga.com/ʙʹΞΫηε fuga.com ͱΞϓϦA ͕ඥ෇͘ apple-app-site-association ΞϓϦA΍ ֘౰ͷϦϯΫʹ ϒϥ΢βͰ ΞΫηε͢Δ fuga.com αʔόʔ ΞϓϦA Πϯετʔϧ࣌ʹ μ΢ϯϩʔυ͞ΕΔ Provisioning Profile Apple fuga.comͱΞϓϦAͷ ։ൃऀͰͳ͍ͱඥ෇͚Εͳ͍ iOSͷγεςϜͷྖҬ

Slide 44

Slide 44 text

Slide 45

Slide 45 text

Copyright © Kakaku.com Inc. All Rights Reserved. URLεΩʔϜΛୣ͍औΔ - ରࡦᶃ Universal LinksΛ࢖༻ ΞϓϦA σʔλ ΞϓϦB ߈ܸऀ ಉ͡υϝΠϯͷUniversal Linksͷ ΞϓϦΛୈࡾऀ͸࡞Δ͜ͱ͕Ͱ͖ͳ͍ɻ υϝΠϯʹΑͬͯUniversal LinksͷΞΫηεઌ͸ อূ͞Ε͍ͯΔ https://fuga.com/ʙ https://fuga.com/ʙʹ౰ͨΔॲཧΛ࣮ߦ Provisioning Profile https://fuga.com/ʙʹ౰ͨΔॲཧΛ࣮ߦ ❌

Slide 46

Slide 46 text

Slide 47

Slide 47 text

Copyright © Kakaku.com Inc. All Rights Reserved. URLεΩʔϜΛୣ͍औΔ - ରࡦᶄ SFSafariViewController΍ASWebAuthenticationSessionΛ࢖༻ ΞϓϦA hoge://ʙΛड͚औΔ࣮૷ ΞϓϦB hoge://ʙΛड͚औΔ࣮૷ ߈ܸऀ SFSafariViewController ຢ͸ ASWebAuthenticationSession Ͱ։͘ ΞϓϦ಺Ͱ֎෦ϒϥ΢β

Slide 48

Slide 48 text

Copyright © Kakaku.com Inc. All Rights Reserved. URLεΩʔϜΛୣ͍औΔ - ରࡦᶄ SFSafariViewController΍ASWebAuthenticationSessionΛ࢖༻ ΞϓϦA hoge://ʙΛड͚औΔ࣮૷ ΞϓϦB hoge://ʙΛड͚औΔ࣮૷ ߈ܸऀ hoge://ʙ SFSafariViewController ຢ͸ ASWebAuthenticationSession Ͱ։͘ ΞϓϦ಺Ͱ֎෦ϒϥ΢β

Slide 49

Slide 49 text

Copyright © Kakaku.com Inc. All Rights Reserved. URLεΩʔϜΛୣ͍औΔ - ରࡦᶄ SFSafariViewController΍ASWebAuthenticationSessionΛ࢖༻ ΞϓϦA hoge://ʙΛड͚औΔ࣮૷ ΞϓϦB hoge://ʙΛड͚औΔ࣮૷ ߈ܸऀ hoge://ʙ ։͍ͨΞϓϦ͕ ༏ઌͯ͠URLεΩʔϜΛड͚औΔ ❌ SFSafariViewController ຢ͸ ASWebAuthenticationSession Ͱ։͘ ΞϓϦ಺Ͱ֎෦ϒϥ΢β

Slide 50

Slide 50 text

Copyright © Kakaku.com Inc. All Rights Reserved. URLεΩʔϜΛୣ͍औΔ - ରࡦͷ·ͱΊ • Universal Links ͰυϝΠϯʹΑͬͯอূ͞Ε͍ͯΔঢ়ଶͰ৘ใΛ  ΞϓϦʹ౉͢  • ֎෦ϒϥ΢βೝূͳͲͷ৔߹͸SFSafariViewController΍ ASWebAuthenticationSessionΛ࢖༻͢Δ  (্هͰ։͍͍ͯΔΞϓϦ͸URLεΩʔϜ͸༏ઌͯ͠ड͚औΔ)  • URLεΩʔϜͰ͸ηΩϡϦςΟ্࿙ӮʹͳΔΑ͏ͳ৘ใΛ౉͞ͳ͍

Slide 51

Slide 51 text

Slide 52

Slide 52 text

Slide 53

Slide 53 text

Slide 54

Slide 54 text

Copyright © Kakaku.com Inc. All Rights Reserved. URLεΩʔϜʹෆਖ਼ͳσʔλΛૹΔ - ରࡦᶃ Ϣʔβʔʹ֬ೝΛઃ͚Δ ΞϓϦA hoge://ʙΛड͚औΔ࣮૷ ෆਖ਼ͳσʔλ ϒϥ΢β ϝʔϧ ϝοηʔδ ΞϓϦ౳ hoge://ʙ ߈ܸऀ ϝʔϧ΍SMSɺϑΟογϯάαΠτͰ ෆਖ਼ͳURLεΩʔϜͷϦϯΫʹ༠ಋ ߋ৽ॲཧΛ࣮ߦ͢Δલʹ Ϣʔβʔʹ֬ೝΛઃ͚Δ ❌

Slide 55

Slide 55 text

Slide 56

Slide 56 text

Slide 57

Slide 57 text

Copyright © Kakaku.com Inc. All Rights Reserved. URLεΩʔϜʹෆਖ਼ͳσʔλΛૹΔ - ରࡦᶄ ϥϯμϜͳจࣈྻΛ෇༩ͯ͠νΣοΫ ΞϓϦA hoge://ʙΛड͚औΔ࣮૷ ΞϓϦB URLεΩʔϜͰ ࣗ෼ͷΞϓϦ→֎෦→ ࣗ෼ͷΞϓϦ ͷྲྀΕͰɺstate΍nonceຢ͸೚ ҙͷύϥϝʔλʔ΋෇༩Մೳͳ৔߹ ϥϯμϜͳจࣈྻ ֎෦ʹૹΔલʹϥϯμϜͳ จࣈྻੜ੒ɾอ࣋

Slide 58

Slide 58 text

Copyright © Kakaku.com Inc. All Rights Reserved. URLεΩʔϜʹෆਖ਼ͳσʔλΛૹΔ - ରࡦᶄ ϥϯμϜͳจࣈྻΛ෇༩ͯ͠νΣοΫ ΞϓϦA hoge://ʙΛड͚औΔ࣮૷ ΞϓϦB hoge://ʙ URLεΩʔϜͰ ࣗ෼ͷΞϓϦ→֎෦→ ࣗ෼ͷΞϓϦ ͷྲྀΕͰɺstate΍nonceຢ͸೚ ҙͷύϥϝʔλʔ΋෇༩Մೳͳ৔߹ σʔλ+ϥϯμϜͳจࣈྻ ϥϯμϜͳจࣈྻ ֎෦ʹૹΔલʹϥϯμϜͳ จࣈྻੜ੒ɾอ࣋

Slide 59

Slide 59 text

Slide 60

Slide 60 text

Copyright © Kakaku.com Inc. All Rights Reserved. URLεΩʔϜʹෆਖ਼ͳσʔλΛૹΔ - ରࡦᶄ ϥϯμϜͳจࣈྻΛ෇༩ͯ͠νΣοΫ ΞϓϦA hoge://ʙΛड͚औΔ࣮૷ hoge://ʙ URLεΩʔϜͰ ࣗ෼ͷΞϓϦ→֎෦→ ࣗ෼ͷΞϓϦ ͷྲྀΕͰɺstate΍nonceຢ͸೚ ҙͷύϥϝʔλʔ΋෇༩Մೳͳ৔߹ ෆਖ਼ͳσʔλ ֎෦͔Βฦ͖ͬͯͨΒ ໭͖ͬͯͨϥϯμϜͳจࣈྻͱ ΞϓϦ಺ʹอ͍࣋ͯͨ͠ ϥϯμϜͳจࣈྻͷҰகνΣοΫ ߈ܸऀ

Slide 61

Slide 61 text

Slide 62

Slide 62 text

Copyright © Kakaku.com Inc. All Rights Reserved. URLεΩʔϜʹෆਖ਼ͳσʔλΛૹΔ - ରࡦ • URLεΩʔϜΛड͚औͬͯ΋௚઀σʔλΛߋ৽͠ͳ͍ɺϢʔβʔʹ֬ೝΛ ઃ͚Δ  • URLεΩʔϜͰ ࣗ෼ͷΞϓϦˠ֎෦ˠࣗ෼ͷΞϓϦ ͷྲྀΕͰɺstate΍ nonceຢ͸೚ҙͷύϥϝʔλʔ΋෇༩ՄೳͰ͋Ε͹ɺ  ϥϯμϜͳจࣈྻΛੜ੒ɾอ࣋ɾ෇༩͠ɺҰகͨ͠৔߹ͷΈ  URLεΩʔϜΛ࣮ߦ͢Δ  • ෆਖ਼ͳૢ࡞Λड͚ͯ΋໰୊ແ͍URLεΩʔϜ͔ΒͷΞΫγϣϯ಺༰ʹ͢Δ

Slide 63

Slide 63 text

ॏཁ৘ใΛϩʔΧϧͷ  Ͳ͜ʹอଘ͢Ε͹ྑ͍ͷʁ

Slide 64

Slide 64 text

Copyright © Kakaku.com Inc. All Rights Reserved. ୅දతͳอଘํ๏ อଘํ๏ આ໌ ҉߸Խ όοΫΞοϓ ෮ݩʹ ύεϫʔυ ΞϓϦ ࡟আͰ ফڈ อଘ࢓ํ Keychain σόΠεͷΩʔνΣʔϯʹอଘ Ϣʔβʔͷ ηΩϡϦςΟ ίʔυͰ ҉߸Խ ̋ ❌ key-value UserDefaults ϢʔβʔͷσϑΥϧτσʔλϕʔε ʹอଘ ❌ ❌ ̋ key-value ϑΝΠϧอଘ ΞϓϦຖͷαϯυϘοΫεͷσΟϨΫτϦ ʹอଘ ❌ ❌ ̋ ϑΝΠϧ

Slide 65

Slide 65 text

Copyright © Kakaku.com Inc. All Rights Reserved. Keychainͷ࢓૊Έ • ϢʔβʔͷηΩϡϦςΟίʔυͰ΋҉߸Խ͞Ε͍ͯΔͷͰɺϢʔβʔ Ҏ֎ΞΫηεͰ͖ͳ҆͘શ • iCloudΩʔνΣʔϯ΍macOSʹόοΫΞοϓͰ͖Δɻୠ͠෮ݩ͢Δࡍ͸ ύεϫʔυ͕ඞཁ • ΞϓϦͰ͸ͳ͘σόΠεʹอଘ͞ΕΔͷͰɺΞϓϦΛ࡟আͯ͠΋อଘ ͨ͠σʔλ͸ফ͑ͳ͍ • ಉ͡Team IDͷଞͷΞϓϦ͔ΒAccess GroupͰΞΫηε͢Δ͜ͱ΋Ͱ͖ Δ

Slide 66

Slide 66 text

Slide 67

Slide 67 text

Slide 68

Slide 68 text

Slide 69

Slide 69 text

Slide 70

Slide 70 text

Slide 71

Slide 71 text

Copyright © Kakaku.com Inc. All Rights Reserved. όοΫΞοϓͷ࢓૊Έ όοΫΞοϓ ର৅ͷ ϩʔΧϧσʔλ ΞϓϦ iCloud΍ macOS Keychainͷσʔλ KeychainҎ֎ͷσʔλ ୺຤ͷόοΫΞοϓ (҉߸Խ༗Γ) ҉߸Խ༗ΓͩͱKeychainͷσʔλ΋ όοΫΞοϓର৅ʹͰ͖Δ (iCloudͷ৔߹͸҉߸Խ༗ΓͰ͔͠όοΫΞοϓͰ͖ͳ͍)

Slide 72

Slide 72 text

Slide 73

Slide 73 text

Slide 74

Slide 74 text

Copyright © Kakaku.com Inc. All Rights Reserved. όοΫΞοϓ΋ૂΘΕ͍ͯΔ ΞϓϦ ߈ܸऀ macOS KeychainҎ֎ͷσʔλ όοΫΞοϓ ର৅ͷ ϩʔΧϧσʔλ Ϣʔβʔ͕҉߸Խઃఆ͍ͯ͠ͳ͍ όοΫΞοϓ͸   ύεϫʔυແ͠Ͱ෮ݩͰ͖Δ ෆਖ਼ͳόοΫΞοϓ πʔϧ͔Βऔಘͨ͠Γɺ ෆਖ਼ʹऔಘͨ͠όοΫΞοϓ͕ μʔΫ΢Σϒͱ͔ͰചΒΕ͍ͯΔ͔΋

Slide 75

Slide 75 text

Copyright © Kakaku.com Inc. All Rights Reserved. όοΫΞοϓ΋ૂΘΕ͍ͯΔ όοΫΞοϓ ର৅ͷ ϩʔΧϧσʔλ ΞϓϦ ߈ܸऀ macOS KeychainҎ֎ͷσʔλ ΞϓϦ͕ϩάΠϯঢ়ଶͰ෮ݩ͞Εͯ͠·͏ ൿີͷ৘ใ͕෮ݩ͞Εͯ͠·͏ ͳͲ ෆਖ਼ͳόοΫΞοϓ πʔϧ͔Βऔಘͨ͠Γɺ ෆਖ਼ʹऔಘͨ͠όοΫΞοϓ͕ μʔΫ΢Σϒͱ͔ͰചΒΕ͍ͯΔ͔΋ Ϣʔβʔ͕҉߸Խઃఆ͍ͯ͠ͳ͍ όοΫΞοϓ͸   ύεϫʔυແ͠Ͱ෮ݩͰ͖Δ

Slide 76

Slide 76 text

Slide 77

Slide 77 text

Slide 78

Slide 78 text

Copyright © Kakaku.com Inc. All Rights Reserved. όοΫΞοϓ΋ૂΘΕ͍ͯΔ ΞϓϦ ߈ܸऀ iCloud΍ macOS Keychainͷσʔλ ❌ ϢʔβʔͷύεϫʔυͰ҉߸Խ͞Ε͍ͯΔ ͨΊ߈ܸऀʹ͸෮߸ԽͰ͖ͳ͍     όοΫΞοϓ ର৅ͷ   Keychainͷ ϩʔΧϧσʔλ Ϣʔβʔͷύεϫʔυ͕ແ͍ͱ ҉߸Խ͍ͯ͠Δ όοΫΞοϓ͔Β෮ݩͰ͖ͳ͍ ୺຤ͷόοΫΞοϓ͔Βͷ෮ݩ΋ Ϣʔβʔͷύεϫʔυ͕ແ͍ͱͰ͖ͳ͍ ❌

Slide 79

Slide 79 text

Slide 80

Slide 80 text

Slide 81

Slide 81 text

Slide 82

Slide 82 text

Slide 83

Slide 83 text

Slide 84

Slide 84 text

Slide 85

Slide 85 text

Slide 86

Slide 86 text

Copyright © Kakaku.com Inc. All Rights Reserved. ϋʔυίʔσΟϯάͷةݥੑ ΞϓϦͷ ࣮૷಺༰ ΞϓϦ ߈ܸऀ ϦόʔεΤϯδχΞϦϯά ࣮૷͞Ε͍ͯΔ಺༰ΛಡΈऔΔ ʮ“yaEeQk64FaQRfjeIEjAMjeiEajER”ͱ͍͏ΩʔͰ ҉߸Խɾ෮߸Խ͍ͯ͠Δͷ͔ʯ౳ ιʔείʔυͰ ҉߸Խͷ伴Λ࣮૷ let key = “yaEeQk64FaQRfjeIEjAMjeiEajER”

Slide 87

Slide 87 text

Copyright © Kakaku.com Inc. All Rights Reserved. ʮॏཁ৘ใΛϩʔΧϧͷͲ͜ʹอଘ͢Ε͹ྑ͍ͷʁʯͷ·ͱΊ • ηΩϡϦςΟ্कΔ΂͖ϩʔΧϧσʔλͷ৘ใ͸Keychainʹอଘ • UserDefaultsɺฏจͷϑΝΠϧอଘɺϋʔυίʔσΟϯά͸҆શͰ͸ͳ ͍ͷͰηΩϡϦςΟ্ݒ೦ͷ͋Δ৘ใ͸อଘ͠ͳ͍  • RealmͷDBϑΝΠϧͷΑ͏ͳϥΠϒϥϦʹΑͬͯࣗಈతʹอଘ͞ΕΔ  ৘ใΛηΩϡϦςΟ্कΔʹ͸ɺϥΠϒϥϦࣗ਎ͷ҉߸ԽػೳΛ࢖༻ɻ  ҉߸Խػೳʹ࢖༻͢Δ伴͸ɺσόΠεຖʹҟͳΔ伴Λੜ੒͠ɺ  Keychainʹอଘͯ͠伴ΛकΔ͜ͱͰɺϥΠϒϥϦͰ҉߸Խ͞ΕΔσʔλ ΋कΕΔ

Slide 88

Slide 88 text

ೝূͷ࢓૊Έʹ͍ͭͯ

Slide 89

Slide 89 text

Copyright © Kakaku.com Inc. All Rights Reserved. ୅දతͳೝূͷ࢓૊Έʹ͍ͭͯ ೝূํ๏ આ໌ ଞͷ αʔϏεͷ ೝূΛར༻ ౎౓ೝՄαʔόʔΛ հͤͣͱ΋ଞͷ αʔϏεͷΞΧ΢ϯτ ৘ใऔಘ ID tokenͷݕূͰ ηΩϡϦςΟڧ౓Λ ΑΓߴΊΕΔ ID/ύεϫʔυ ID/ύεϫʔυΛࣗ෼ͷαʔϏεͷαʔόʔ ʹૹͬͯೝূ ❌ - - OAuth ଞͷαʔϏεΛར༻ͨ͠ೝূͷ࢓૊Έɻ ଞͷαʔϏεͷೝূΛ࢖༻͠ɺ ࣗ෼ͷαʔϏεͷೝূͨ͠Γɺ ೝূͨ͠ଞͷαʔϏεʹ΋ೝূঢ়ଶͰ ΞΫηεͰ͖Δ ̋ ❌ ❌ OpenID Connect OAuth2.0ͷ֦ுɻID tokenΛݕূ͢Δ͜ͱͰɺ ೝՄαʔόʔհͣ͞ͱ΋ΞΧ΢ϯτ৘ใΛ औಘͨ͠ΓɺηΩϡϦςΟͷڧ౓Λ ΑΓߴΊͨΓͰ͖Δ ̋ ̋ ̋

Slide 90

Slide 90 text

Slide 91

Slide 91 text

Copyright © Kakaku.com Inc. All Rights Reserved. ID/ύεϫʔυͷྫ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ ID/ύεϫʔυ ࣗ෼ͷαʔϏεͷaccess tokenͰ ࣗ෼ͷαʔϏεͷΞΧ΢ϯτʹؔ͢Δ৘ใͷ औಘ΍ߋ৽Λߦ͍·͢

Slide 92

Slide 92 text

Copyright © Kakaku.com Inc. All Rights Reserved. OAuthͱ͸ • ΞΫηεΛҕ೚͢ΔΦʔϓϯελϯμʔυ   • Ұൠతʹ͸ɺࣗ෼ͷαʔϏεͰͳ͍ଞͷαʔϏεΛར༻ͨ͠ೝূͷ࢓૊ ΈͳͲʹར༻͞Ε͍ͯΔ   ྫ:FacebookͳͲͷϓϩόΠμʔ͕ΞΫηεΛҕ೚͍ͯ͠Δ͜ͱͰɺαʔυύʔςΟͷΞϓϦ͕FacebookೝূͰ͖Δ   • OAuth 2.0͸1.0ͱ͸ޓ׵ੑ͸ແ͍ɻ2.0Ͱ͸ΑΓγϯϓϧͳํ๏Λఏڙ

Slide 93

Slide 93 text

Copyright © Kakaku.com Inc. All Rights Reserved. OAuth 2.0ͷγʔέϯεྫ - ೝՄίʔυϑϩʔͷ৔߹ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ ଞͷαʔϏεͷ ೝՄαʔόʔ ଞͷαʔϏεͷ Ϧιʔεαʔόʔ code code ଞͷαʔϏεͷ access token ଞͷαʔϏεͷ access token ଞͷαʔϏεͷ ΞΧ΢ϯτ৘ใ ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ ϩάΠϯ ϩάΠϯ੒ޭ࣌ʹ codeΛ ϦμΠϨΫτͰ ౉͢

Slide 94

Slide 94 text

Slide 95

Slide 95 text

Slide 96

Slide 96 text

Copyright © Kakaku.com Inc. All Rights Reserved. CSRF(ΫϩεαΠτϦΫΤετϑΥʔδΣϦ)ͱ͍͏߈ܸ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ ଞͷαʔϏεͷ ೝՄαʔόʔ ଞͷαʔϏεͷ Ϧιʔεαʔόʔ ߈ܸऀͷ code code code ଞͷαʔϏεͷ access token ଞͷαʔϏεͷ access token ଞͷαʔϏεͷ ΞΧ΢ϯτ৘ใ ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ ߈ܸऀ

Slide 97

Slide 97 text

Slide 98

Slide 98 text

Copyright © Kakaku.com Inc. All Rights Reserved. CSRF(ΫϩεαΠτϦΫΤετϑΥʔδΣϦ)ʹର͢ΔstateύϥϝʔλʔͰͷରԠ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ ଞͷαʔϏεͷ ೝՄαʔόʔ ଞͷαʔϏεͷ Ϧιʔεαʔόʔ code code ଞͷαʔϏεͷ access token ଞͷαʔϏεͷ access token ଞͷαʔϏεͷ ΞΧ΢ϯτ৘ใ ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ ϩάΠϯ+ state ϩάΠϯ੒ޭ࣌ʹ code+stateΛ ϦμΠϨΫτͰ ౉͢ stateνΣοΫ ϥϯμϜͳ จࣈྻͰstate ੜ੒ɾอ࣋

Slide 99

Slide 99 text

Slide 100

Slide 100 text

Copyright © Kakaku.com Inc. All Rights Reserved. CSRF(ΫϩεαΠτϦΫΤετϑΥʔδΣϦ)ʹର͢ΔstateύϥϝʔλʔͰͷରԠ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ ଞͷαʔϏεͷ ೝՄαʔόʔ ଞͷαʔϏεͷ Ϧιʔεαʔόʔ code code ଞͷαʔϏεͷ access token ଞͷαʔϏεͷ access token ଞͷαʔϏεͷ ΞΧ΢ϯτ৘ใ ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ stateνΣοΫ ߈ܸऀ ߈ܸऀͷ code ❌ ΞϓϦͰอ͍࣋ͯ͠Δstateͱ ϩάΠϯ࣌ʹύϥϝʔλʔͱͯ͠ ౉ͬͯ͘Δstate͕Ұக͢Δ͔νΣοΫ

Slide 101

Slide 101 text

Copyright © Kakaku.com Inc. All Rights Reserved. CSRF(ΫϩεαΠτϦΫΤετϑΥʔδΣϦ)ʹର͢ΔstateύϥϝʔλʔͰͷରԠ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ ଞͷαʔϏεͷ ೝՄαʔόʔ ଞͷαʔϏεͷ Ϧιʔεαʔόʔ code code ଞͷαʔϏεͷ access token ଞͷαʔϏεͷ access token ଞͷαʔϏεͷ ΞΧ΢ϯτ৘ใ ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ stateνΣοΫ ߈ܸऀ ߈ܸऀͷ code state͕ແ͍ຢ͸state͕ෆҰகͷ ৔߹͸ଓ͖ͷॲཧΛ࣮ߦ͠ͳ͍ ❌

Slide 102

Slide 102 text

Copyright © Kakaku.com Inc. All Rights Reserved. CSRF(ΫϩεαΠτϦΫΤετϑΥʔδΣϦ)ʹର͢ΔstateύϥϝʔλʔͰͷରԠ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ ଞͷαʔϏεͷ ೝՄαʔόʔ ଞͷαʔϏεͷ Ϧιʔεαʔόʔ stateνΣοΫ ߈ܸऀ ߈ܸऀͷ code state͕ແ͍ຢ͸state͕ෆҰகͷ ৔߹͸ଓ͖ͷॲཧΛ࣮ߦ͠ͳ͍ ❌

Slide 103

Slide 103 text

Copyright © Kakaku.com Inc. All Rights Reserved. OpenID Connectͱ͸ • OAuth 2.0 ͷ֦ு࢓༷  • ΞΧ΢ϯτ৘ใΛؚΉσδλϧॺ໊෇͖ͷτʔΫϯͰ͋ΔID tokenΛ  ࢖༻Ͱ͖Δ  • ID tokenΛݕূ͢Δ͜ͱͰɺଞͷαʔϏε͔Βaccess tokenͰ৘ใऔಘ ͠ͳͯ͘΋ID token಺͔ΒΞΧ΢ϯτ৘ใ͕औಘͰ͖Δ

Slide 104

Slide 104 text

Copyright © Kakaku.com Inc. All Rights Reserved. ID tokenͱ͸ • OpenID ConnectͰ͍͏ΞΧ΢ϯτʹؔ͢Δ৘ใΛؚΉJWT(δϣοτ)  • JWT͸JSONܗࣜͰදݱ͞Εͨଐੑ৘ใ(claim)Λσδλϧॺ໊ͯ͠  վ͟Μ๷ࢭɺ҉߸ԽͰ͖ΔτʔΫϯͷ࢓༷  • ID token͔ΒΞΧ΢ϯτ৘ใΛऔಘͰ͖Δ͕ɺσδλϧॺ໊Ͱվ͟ΜΛ ๷ࢭ͍ͯ͠Δ

Slide 105

Slide 105 text

Slide 106

Slide 106 text

Slide 107

Slide 107 text

Slide 108

Slide 108 text

Slide 109

Slide 109 text

Slide 110

Slide 110 text

Slide 111

Slide 111 text

Slide 112

Slide 112 text

Slide 113

Slide 113 text

Slide 114

Slide 114 text

Slide 115

Slide 115 text

Slide 116

Slide 116 text

Slide 117

Slide 117 text

Slide 118

Slide 118 text

Slide 119

Slide 119 text

Copyright © Kakaku.com Inc. All Rights Reserved. σδλϧॺ໊ͷݕূํ๏ ࢲ͸ଠ࿠ ϋογϡԽ C3Er4geAGKQ5bKgrirUZRgQhZg ެ։伴Ͱ෮߸Խ (୭Ͱ΋෮߸ԽͰ͖Δ) Yptd6dH2jB398bG3fwf2EpkDePs ʹ C3Er4geAGKQ5bKgrirUZRgQhZg ର৅ͷσʔλͷϋογϡ஋ͱ ɹσδλϧॺ໊Λެ։伴Ͱ෮߸Խͨ͠ ϋογϡ஋͕Ұக͢Ε͹վ͟Μ͞Ε͍ͯͳ͍ σδλϧॺ໊

Slide 120

Slide 120 text

Copyright © Kakaku.com Inc. All Rights Reserved. σδλϧॺ໊ͷݕূͰͲͷΑ͏ʹվ͟ΜΛݕ஌͢Δͷ͔ ެ։伴Ͱ෮߸Խ (୭Ͱ΋෮߸ԽͰ͖Δ) Yptd6dH2jB398bG3fwf2EpkDePs ʹ C3Er4geAGKQ5bKgrirUZRgQhZg σδλϧॺ໊ ࢲ͸࣍࿠ ϋογϡԽ ahk7EXjKkRrEiupuGNzpkL993FU ߈ܸऀ

Slide 121

Slide 121 text

Copyright © Kakaku.com Inc. All Rights Reserved. σδλϧॺ໊ͷݕূͰͲͷΑ͏ʹվ͟ΜΛݕ஌͢Δͷ͔ ެ։伴Ͱ෮߸Խ (୭Ͱ΋෮߸ԽͰ͖Δ) Yptd6dH2jB398bG3fwf2EpkDePs ʹ C3Er4geAGKQ5bKgrirUZRgQhZg ର৅ͷσʔλͷϋογϡ஋ͱ ɹσδλϧॺ໊Λެ։伴Ͱ෮߸Խͨ͠ ϋογϡ஋͕Ұக͠ͳ͚Ε͹վ͟Μ͞Ε͍ͯΔ σδλϧॺ໊ ࢲ͸࣍࿠ ϋογϡԽ ahk7EXjKkRrEiupuGNzpkL993FU ߈ܸऀ ❌

Slide 122

Slide 122 text

Slide 123

Slide 123 text

Copyright © Kakaku.com Inc. All Rights Reserved. ID tokenͷclaims(ؚ·ΕΔ৘ใ)ʹ͍ͭͯ Ωʔ(claim໊) આ໌ iss ൃߦऀ (issuer) Λࣝผ͢ΔͨΊͷࣝผࢠ sub ϢʔβʔͷҰҙࣝผࢠ aud ID tokenͷൃߦΛґཔͨ͠ΫϥΠΞϯτΞϓϦέʔγϣϯͷΫϥΠΞϯτ ID exp ༗ޮظݶ iat ൃߦ͞Εͨ೔࣌ nonce ϦϓϨΠΞλοΫΛ๷͙໨తͷύϥϝʔλʔ name ϢʔβʔͷϑϧωʔϜ email ϢʔβʔͷϝʔϧΞυϨε phone_number Ϣʔβʔͷి࿩൪߸ at_hash access tokenͱڞʹฦ٫͞ΕΔ৔߹෇༩͞ΕΔɻaccess tokenͷݕূʹ࢖༻ access tokenͷϋογϡΛऔΓɺ݁Ռͱͯ͠ಘΒΕͨࠨ൒෼ͷϏοτ܈Λbase64urlͰΤϯίʔυͨ͠΋ͷ c_hash codeͱڞʹฦ٫͞ΕΔ৔߹෇༩͞ΕΔɻcodeͷݕূʹ࢖༻ codeͷϋογϡΛऔΓɺ݁Ռͱͯ͠ಘΒΕͨࠨ൒෼ͷϏοτ܈Λbase64urlͰΤϯίʔυͨ͠΋ͷ ※ ୅දతͳ΋ͷͷΈهࡌ

Slide 124

Slide 124 text

Copyright © Kakaku.com Inc. All Rights Reserved. OpenID Connectͷγʔέϯεྫ - response_type = id_tokenͷΈ৔߹ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ (Relying Party) OpenID Provider ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ ϩάΠϯ +state ϩάΠϯ੒ޭ࣌ʹ ID token+stateΛ ϦμΠϨΫτͰ ౉͢ stateνΣοΫ ϥϯμϜͳ จࣈྻͰstate ੜ੒ɾอ࣋ ID token ɹɹɹൿີ伴Ͱ ɹɹID tokenʹॺ໊ ID tokenͷclaimsΛݕূ (༗ޮظݶͳͲΛ ݕূ)

Slide 125

Slide 125 text

Copyright © Kakaku.com Inc. All Rights Reserved. ID tokenվ͟ΜʹΑΔ߈ܸ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ (Relying Party) OpenID Provider ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ ID tokenͷclaimsΛݕূ (༗ޮظݶͳͲΛ ݕূ) ߈ܸऀ վ͟Μͨ͠ ID token

Slide 126

Slide 126 text

Slide 127

Slide 127 text

Copyright © Kakaku.com Inc. All Rights Reserved. ID tokenͷॺ໊ݕূʹΑΔվ͟Μ๷ࢭ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ (Relying Party) OpenID Provider ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ ϩάΠϯ +state ϩάΠϯ੒ޭ࣌ʹ ID token+stateΛ ϦμΠϨΫτͰ ౉͢ stateνΣοΫ ϥϯμϜͳ จࣈྻͰstate ੜ੒ɾอ࣋ ID token ɹɹɹൿີ伴Ͱ ɹɹID tokenʹॺ໊ ID tokenͷclaimsΛݕূ (༗ޮظݶͳͲΛ ݕূ) ɹɹɹެ։伴Ͱ ɹɹID tokenͷ ɹɹॺ໊Λݕূ

Slide 128

Slide 128 text

Slide 129

Slide 129 text

Copyright © Kakaku.com Inc. All Rights Reserved. ID tokenͷॺ໊ݕূʹΑΔվ͟Μ๷ࢭ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ (Relying Party) OpenID Provider ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ ɹɹɹެ։伴Ͱ ɹɹID tokenͷ ɹɹॺ໊Λݕূ ID tokenͷclaimsΛݕূ (༗ޮظݶͳͲΛ ݕূ) ߈ܸऀ վ͟Μͨ͠ ID token ެ։伴Ͱॺ໊Λݕূͯ͠ վ͟Μ͍ͯ͠ͳ͍͜ͱΛνΣοΫ ❌

Slide 130

Slide 130 text

Copyright © Kakaku.com Inc. All Rights Reserved. ID tokenͷॺ໊ݕূʹΑΔվ͟Μ๷ࢭ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ (Relying Party) OpenID Provider ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ ɹɹɹެ։伴Ͱ ɹɹID tokenͷ ɹɹॺ໊Λݕূ ID tokenͷclaimsΛݕূ (༗ޮظݶͳͲΛ ݕূ) ߈ܸऀ վ͟Μͨ͠ ID token ❌ վ͟Μ͞ΕͨID tokenͷ৔߹͸ ଓ͖ͷॲཧΛ͠ͳ͍

Slide 131

Slide 131 text

Copyright © Kakaku.com Inc. All Rights Reserved. ID tokenͷॺ໊ݕূʹΑΔվ͟Μ๷ࢭ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ (Relying Party) OpenID Provider ɹɹɹެ։伴Ͱ ɹɹID tokenͷ ɹɹॺ໊Λݕূ ߈ܸऀ վ͟Μͨ͠ ID token ❌ վ͟Μ͞ΕͨID tokenͷ৔߹͸ ଓ͖ͷॲཧΛ͠ͳ͍

Slide 132

Slide 132 text

Copyright © Kakaku.com Inc. All Rights Reserved. OpenID Connectͷγʔέϯεྫ - response_type = id_tokenͷ৔߹ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ (Relying Party) OpenID Provider ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ ϩάΠϯ +state ϩάΠϯ੒ޭ࣌ʹ ID token+stateΛ ϦμΠϨΫτͰ ౉͢ stateνΣοΫ ϥϯμϜͳ จࣈྻͰstate ੜ੒ɾอ࣋ ID token ɹɹɹެ։伴Ͱ ɹɹID tokenͷ ɹɹॺ໊Λݕূ ɹɹɹൿີ伴Ͱ ɹɹID tokenʹॺ໊ ID tokenͷclaimsΛݕূ (༗ޮظݶͳͲΛ ݕূ)

Slide 133

Slide 133 text

Copyright © Kakaku.com Inc. All Rights Reserved. ϦϓϨΠΞλοΫͱ͍͏߈ܸ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ (Relying Party) OpenID Provider ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ ϩάΠϯ +state ϩάΠϯ੒ޭ࣌ʹ ID token+stateΛ ϦμΠϨΫτͰ ౉͢ stateνΣοΫ ϥϯμϜͳ จࣈྻͰstate ੜ੒ɾอ࣋ ID token ɹɹɹެ։伴Ͱ ɹɹID tokenͷ ɹɹॺ໊Λݕূ ɹɹɹൿີ伴Ͱ ɹɹID tokenʹॺ໊ ID tokenͷclaimsΛݕূ (༗ޮظݶͳͲΛ ݕূ) ߈ܸऀ ߈ܸऀ͕ID tokenΛ ؚΜͩϦΫΤετ๣ड (҉߸Խ͞Ε͍ͯΔͷͰ ID token͸౪Ίͳ͍)

Slide 134

Slide 134 text

Slide 135

Slide 135 text

Copyright © Kakaku.com Inc. All Rights Reserved. ϦϓϨΠΞλοΫͱ͍͏߈ܸ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ (Relying Party) OpenID Provider ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ ɹɹɹެ։伴Ͱ ɹɹID tokenͷ ɹɹॺ໊Λݕূ ID tokenͷclaimsΛݕূ (༗ޮظݶͳͲΛ ݕূ) ߈ܸऀ ϦΫΤετΛ ܁Γฦ͚ͨͩ͠ͰϢʔβʔͷ ΞΧ΢ϯτͰϩάΠϯͰ͖ͯ͠·͏ ID tokenΛؚΜͩ ಉ͡ϦΫΤετΛ࠶ૹ৴͢Δ

Slide 136

Slide 136 text

Copyright © Kakaku.com Inc. All Rights Reserved. ϦϓϨΠΞλοΫͷʹର͢ΔnonceύϥϝʔλʔͰͷରԠ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ (Relying Party) OpenID Provider ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ nonce ੜ੒ґཔ nonce+ session token ϥϯμϜͳ จࣈྻͰnonce ੜ੒ɾอ࣋ ϩάΠϯ +state +nonce ϩάΠϯ੒ޭ࣌ʹ ID token+stateΛ ϦμΠϨΫτͰ ౉͢ stateνΣοΫ ϥϯμϜͳ จࣈྻͰstate ੜ੒ɾอ࣋ ID token+ session token ɹɹɹެ։伴Ͱ ɹɹID tokenͷ ɹɹॺ໊Λݕূ ɹɹɹൿີ伴Ͱ ɹɹID tokenʹॺ໊ ID tokenͷclaimsΛݕূ (༗ޮظݶ΍ nonceνΣοΫ΋ߦ͏)

Slide 137

Slide 137 text

Slide 138

Slide 138 text

Copyright © Kakaku.com Inc. All Rights Reserved. ϦϓϨΠΞλοΫͷʹର͢ΔnonceύϥϝʔλʔͰͷରԠ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ (Relying Party) OpenID Provider ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ ɹɹɹެ։伴Ͱ ɹɹID tokenͷ ɹɹॺ໊Λݕূ ID tokenͷclaimsΛݕূ (༗ޮظݶ΍ nonceνΣοΫ΋ߦ͏) ߈ܸऀ ID tokenΛؚΜͩ ಉ͡ϦΫΤετΛ࠶ૹ৴͢Δ sessionͰอ͍࣋ͯ͠Δnonceͱ ID token಺ͷnonce͕Ұக͢Δ͔νΣοΫ νΣοΫޙ͸session಺ͷnonceഁغ ❌

Slide 139

Slide 139 text

Copyright © Kakaku.com Inc. All Rights Reserved. ϦϓϨΠΞλοΫͷʹର͢ΔnonceύϥϝʔλʔͰͷରԠ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ (Relying Party) OpenID Provider ࣗ෼ͷαʔϏεͷ access token (ࣗ෼ͷαʔϏεͷ access tokenͱڞʹ) APIݺͼग़͠ ɹɹɹެ։伴Ͱ ɹɹID tokenͷ ɹɹॺ໊Λݕূ ID tokenͷclaimsΛݕূ (༗ޮظݶ΍ nonceνΣοΫ΋ߦ͏) ߈ܸऀ ❌ sessionʹnonce͕ແ͍ຢ͸ session಺ͷnonceͱID token಺ͷnonce͕ෆҰகͷ ৔߹͸ଓ͖ͷॲཧΛ࣮ߦ͠ͳ͍ ID tokenΛؚΜͩ ಉ͡ϦΫΤετΛ࠶ૹ৴͢Δ

Slide 140

Slide 140 text

Copyright © Kakaku.com Inc. All Rights Reserved. ϦϓϨΠΞλοΫͷʹର͢ΔnonceύϥϝʔλʔͰͷରԠ ࣗ෼ͷαʔϏεͷ ΞϓϦ ࣗ෼ͷαʔϏεͷ αʔόʔ (Relying Party) OpenID Provider ɹɹɹެ։伴Ͱ ɹɹID tokenͷ ɹɹॺ໊Λݕূ ID tokenͷclaimsΛݕূ (༗ޮظݶ΍ nonceνΣοΫ΋ߦ͏) ߈ܸऀ ❌ ID tokenΛؚΜͩ ಉ͡ϦΫΤετΛ࠶ૹ৴͢Δ sessionʹnonce͕ແ͍ຢ͸ session಺ͷnonceͱID token಺ͷnonce͕ෆҰகͷ ৔߹͸ଓ͖ͷॲཧΛ࣮ߦ͠ͳ͍

Slide 141

Slide 141 text

Copyright © Kakaku.com Inc. All Rights Reserved. ʮೝূͷ࢓૊Έʹ͍ͭͯʯͷ·ͱΊ • OAuth΍OpenID ConnectΛར༻͢Δ৔߹͸ಠࣗͷ࣮૷Ͱ͸ͳ͘  Ͱ͖Δ͚ͩඪ४ͷ࢓༷ʹଇ࣮ͬͨ૷ʹ͢Δ  • ݕূ͠ͳͯ͘΋ΞΧ΢ϯτ৘ใ͸औಘͰ͖Δ͕ɺstate΍nonceɺ  σδλϧॺ໊ݕূͳͲͷOAuth΍OpenID ConnectʹଇͬͨݕূΛ  ͪΌΜͱ΍Βͳ͍ͱ੬ऑੑʹͳΔ 

Slide 142

Slide 142 text

·ͱΊ

Slide 143

Slide 143 text

ηΩϡϦςΟɾγεςϜ͸ৗউΛٛ຿͚ͮΒΕɺ ߈ܸऀ͸Ұ౓উ͚ͭͩͰྑ͍ͱ͍͏֨ݴ͸తΛࣹͯΔɻ μϥεϋοΧʔڠձ૑ઃऀ %VTUJO%ZLFT

Slide 144

Slide 144 text

Copyright © Kakaku.com Inc. All Rights Reserved. ࠷ޙʹ We are hiring! WebɺΞϓϦɺϑϩϯτΤϯυΤϯ δχΞͳͲ༷ʑͳ৬छͰΤϯδχΞ ืूதͰ͢ʂ ΧδϡΞϧ໘ஊ׻ܴͰ͢ʂ J1IPOFɺ"QQMFɺJ$MPVEɺNBD04ɺ,FZDIBJO͸ɺ"QQMF*ODͷ঎ඪͰ͢ɻ /FUTDBQF͸ɼΤʔΦʔΤϧɹΠϯίʔϙϨʔςουͷొ࿥঎ඪͰ͢ɻ 0QFO*%͸ɺ0QFO*%'PVOEBUJPOͷొ࿥঎ඪͰ͢ɻ 'BDFCPPL͸ɺ'BDFCPPL *ODͷొ࿥঎ඪͰ͢ɻ *04͸ɺ$JTDPͷొ࿥঎ඪͰ͢ɻ 3FBMN͸ɺ5JHIUEC *ODͷొ࿥঎ඪͰ͢ɻ