Tweet
Tweet

Slide 1

Slide 1 text

ɹ@shin1x1 2016/02/27 TwilioJP-UG大阪＆AWScean合同勉強会 5XJMJPͱ8FCΞϓϦ
 ࿈ܞʹ͓͚ΔηΩϡϦςΟ

Slide 2

Slide 2 text

https://github.com/shin1x1/twilio-api-security-demo

Slide 3

Slide 3 text

5XJMJPͱ8FCΞϓϦͷ࿈ܞ

Slide 4

Slide 4 text

αϯϓϧΞϓϦέʔγϣϯ D .BTBTIJ4IJOCBSB!TIJOY wձһ޲͚ϙΠϯτ؅ཧγεςϜ wి࿩Λ͔͚ΔͱݱࡏͷϙΠϯτ͕ฉ͚Δ wి࿩൪߸Ͱೝূ

Slide 5

Slide 5 text

D .BTBTIJ4IJOCBSB!TIJOY ి࿩Λ͔͚Δ 図 図 - twilio 図 図 - twilio Twilio Webαʔό ձһ YYYYYYYY

Slide 6

Slide 6 text

D .BTBTIJ4IJOCBSB!TIJOY ి࿩൪߸͕ૹΒΕΔ 図 図 - twilio 図 図 - twilio )551ϦΫΤετ
 'SPNYYYYYYYY ʢൃ৴ݩి࿩൪߸ʣ

Slide 7

Slide 7 text

D .BTBTIJ4IJOCBSB!TIJOY ձһೝূ 図 図 - twilio 図 図 - twilio YYYYYYͰ%#Λࢀরͯ͠ ձһΛಛఆ͢Δ

Slide 8

Slide 8 text

D .BTBTIJ4IJOCBSB!TIJOY ৘ใΛ9.-Ͱฦ͢ 図 図 - twilio 図 図 - twilio 5XJ.-ʢ9.-ʣΛฦ͢

Slide 9

Slide 9 text

D .BTBTIJ4IJOCBSB!TIJOY ৘ใΛ5XJ.-Ͱฦ͢ 図 図 - twilio 図 図 - twilio 5XJ.-ʢ9.-ʣΛฦ͢ YNMWFSTJPOFODPEJOH65' 3FTQPOTF 4BZWPJDFXPNBOMBOHVBHFKB+1
 ླ໦͞ΜͷϙΠϯτ͸ϙΠϯτͰ͢ɻ 4BZ 3FTQPOTF

Slide 10

Slide 10 text

D .BTBTIJ4IJOCBSB!TIJOY Ի੠Λྲྀ͢ 図 図 - twilio 図 図 - twilio Ի੠࠶ੜ

Slide 11

Slide 11 text

D .BTBTIJ4IJOCBSB!TIJOY σϞ

Slide 12

Slide 12 text

D .BTBTIJ4IJOCBSB!TIJOY ى͜Γ͏Δ໰୊

Slide 13

Slide 13 text

D .BTBTIJ4IJOCBSB!TIJOY )551ͷੈք 図 図 - twilio 図 図 - twilio Twilio Webαʔό ձһ

Slide 14

Slide 14 text

D .BTBTIJ4IJOCBSB!TIJOY ِ૷ϦΫΤετ 図 図 - twilio 図 図 - twilio ి࿩൪߸Λ 1045

Slide 15

Slide 15 text

D .BTBTIJ4IJOCBSB!TIJOY ِ૷ϦΫΤετ 図 図 - twilio 図 図 - twilio 5XJ.-Λ औಘ

Slide 16

Slide 16 text

D .BTBTIJ4IJOCBSB!TIJOY ِ૷ϦΫΤετ 図 図 - twilio 図 図 - twilio Twilio Webαʔό ձһ DVSME'SPN#
 IUUQTFYBNQMFDPNBQJDBMMJOH YNMWFSTJPOFODPEJOH65' 3FTQPOTF 4BZWPJDFXPNBOMBOHVBHFKB+1
 ాத͞ΜͷϙΠϯτ͸ϙΠϯτͰ͢ɻ 4BZ 3FTQPOTF

Slide 17

Slide 17 text

D .BTBTIJ4IJOCBSB!TIJOY 5XJMJPΛِͬͨϦΫΤετ wِ૷ͨ͠ϦΫΤετΛ8FCΞϓϦʹૹ৴ w৘ใऔಘɺૢ࡞ͳͲͷෆਖ਼ར༻ͷՄೳੑ

Slide 18

Slide 18 text

D .BTBTIJ4IJOCBSB!TIJOY ରࡦ

Slide 19

Slide 19 text

ِ૷ϦΫΤετରࡦ D .BTBTIJ4IJOCBSB!TIJOY ௨৴ܦ࿏ͷ҉߸Խ ௨৴ݩΛ੍ݶ ϦΫΤετΛݕূ

Slide 20

Slide 20 text

D .BTBTIJ4IJOCBSB!TIJOY ௨৴ܦ࿏ͷ҉߸Խ w)5514Λར༻͢Δ wࣗݾॺ໊ͷূ໌ॻ͸/( w5-4Λར༻ʢ44-W͸ɺഇࢭ༧ఆʣ

Slide 21

Slide 21 text

D .BTBTIJ4IJOCBSB!TIJOY 8FCΞϓϦέʔγϣϯͷΤϯυϙΠϯτ IUUQTʹ͢Δ

Slide 22

Slide 22 text

D .BTBTIJ4IJOCBSB!TIJOY ௨৴ݩΛ੍ݶ w)551#BTJDೝূ%JHFTUೝূ wϢʔβɺύεϫʔυΛ63-ʹؚΊΔ wIUUQTVTFSQBTT!FYBNQMFDPN

Slide 23

Slide 23 text

D .BTBTIJ4IJOCBSB!TIJOY *1ΞυϨεʹΑΔ੍ݶ͸ʁ https://www.twilio.com/help/faq/twilio-basics/which-ip-addresses-will-twilios-requests-come- from w5XJMJPͷૹ৴ݩ*1ΞυϨε͸ඇެ։ w୅ΘΓʹϦΫΤετͷݕূΛߦ͏ wͲ͏ͯ͠΋ඞཁͳΒ૬ஊ

Slide 24

Slide 24 text

D .BTBTIJ4IJOCBSB!TIJOY ϦΫΤετͷݕূ ɾ5XJMJP͔ΒͷϦΫΤετͰ͋Δ͜ͱΛ֬ೝ wଥ౰Ͱ͋Ε͹ॲཧΛ࣮ߦ wͦ͏Ͱͳ͚Ε͹ॲཧΛதஅʢΤϥʔʣ

Slide 25

Slide 25 text

D .BTBTIJ4IJOCBSB!TIJOY )."$4)"ॺ໊ʹΑΔݕূ ɾ95XJMJP4JHOBUVSFϔομ wॴఆͷΞϧΰϦζϜͰॺ໊Λࢉग़ w্هɺ̎ͭΛൺֱͯ͠߹க͢Ε͹PL

Slide 26

Slide 26 text

95XJMJP4JHOBUVSFϔομ 95XJMJP4JHOBUVSFTOEGBQB2N11;6MO-L)X

Slide 27

Slide 27 text

ॺ໊ࢉग़ ɾ63-IUUQTFYBNQMFDPNDBMMJOH ɾ1045ύϥϝʔλʢΩʔͰιʔτʣ
 ,FZWBMVF ,FZWBMVF 'SPN IUUQTFYBNQMFDPNDBMMJOH
 'SPN,FZWBMVF,FZWBMVF

Slide 28

Slide 28 text

ॺ໊ࢉग़ ɾ"VUI5PLFOΛΩʔʹͯ͠ɺ)."$4)"ॺ໊ ɾCBTFͰΤϯίʔυ TOEGBQB2N11;6MO-L)X IUUQTFYBNQMFDPNDBMMJOH
 ,FZWBMVF,FZWBMVF'SPN

Slide 29

Slide 29 text

ॺ໊͕Ұக͢Δ͔ ੜ੒ͨ͠ॺ໊TOEGBQB2N11;6MO-L)X 95XJMJP4JHOBUVSFTOEGBQB2N11;6MO-L)X ߹க͢ΔͷͰɺ5XJMJP͔ΒͷϦΫΤετͱΈͳ͢

Slide 30

Slide 30 text

UXJMJPTELʹΑΔݕূ $validator = new Services_Twilio_RequestValidator($authToken);
 
 // ϔομ͔Βॺ໊औಘ $signature = $request->header('X-Twilio-Signature');
 
 // URL औಘ Request::setTrustedProxies([$request->getClientIp()]);
 $url = $request->getUri();
 
 // POST ύϥϝʔλऔಘ $postParameters = $request->input();
 
 // ॺ໊ݕূ if (!$validator->validate($signature, $url, $postParameters)) {
 // OK
 } else {
 // NG
 }

Slide 31

Slide 31 text

·ͱΊ D .BTBTIJ4IJOCBSB!TIJOY w5XJMJPͱ8FCΞϓϦέʔγϣϯ͸
 )551 4 Ͱ࿈ܞ wِ૷ϦΫΤετ͕ૹ৴͞ΕΔ͜ͱΛҙࣝ w5XJMJPެࣜυΩϡϝϯτΛࢀߟʹ https://jp.twilio.com/docs/api/security