Slide 29
Slide 29 text
AllowEncodedSlashes
とセキュリティ
安全度 Off > NoDecode > On
https://httpd.apache.org/docs/2.4/en/mod/core.html#allowencode
dslashes
今回はNoDecode
を設定
念のため、短縮URL
以外では%2F
を弾くように.htaccess
を設定した
If encoded slashes are needed in path info, use of NoDecode is
strongly recommended as a security measure. Allowing slashes
to be decoded could potentially allow unsafe paths.
“
“
29