Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
0802徳丸.pdf
Search
Sponsored
·
Your Podcast. Everywhere. Effortlessly.
Share. Educate. Inspire. Entertain. You do you. We'll handle the rest.
→
tanakata
August 02, 2017
0
50
0802徳丸.pdf
tanakata
August 02, 2017
Tweet
Share
More Decks by tanakata
See All by tanakata
20171201
tanakata
0
37
20171110
tanakata
0
47
1013
tanakata
0
50
徳丸0922
tanakata
0
75
0901
tanakata
0
42
2017/08/25
tanakata
0
46
徳丸20170721.pdf
tanakata
0
39
Featured
See All Featured
Paper Plane
katiecoart
PRO
0
46k
Getting science done with accelerated Python computing platforms
jacobtomlinson
2
110
Evolving SEO for Evolving Search Engines
ryanjones
0
120
The State of eCommerce SEO: How to Win in Today's Products SERPs - #SEOweek
aleyda
2
9.5k
SEO for Brand Visibility & Recognition
aleyda
0
4.2k
Why Our Code Smells
bkeepers
PRO
340
58k
Lightning Talk: Beautiful Slides for Beginners
inesmontani
PRO
1
440
YesSQL, Process and Tooling at Scale
rocio
174
15k
Reflections from 52 weeks, 52 projects
jeffersonlam
356
21k
Rails Girls Zürich Keynote
gr2m
96
14k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
PRO
196
71k
The Director’s Chair: Orchestrating AI for Truly Effective Learning
tmiket
1
96
Transcript
2017/08/02 ಙؙຊྠಡձ ηογϣϯϋΠδϟοΫ
͜Ε·ͰͷྲྀΕ ΫϩεαΠτεΫϦϓςΟϯά(ాɾߥʣ SQLΠϯδΣΫγϣϯʢখʣ CSRFʢຢʣ
͜Ε·ͰͷྲྀΕ ΫϩεαΠτεΫϦϓςΟϯά(ాɾߥʣ SQLΠϯδΣΫγϣϯʢখʣ CSRFʢຢʣ NEW!→ηογϣϯϋΠδϟοΫʢాʣ
ηογϣϯͷ͓͞Β͍
ηογϣϯͱ ϩάΠϯ͔ͯ͠ΒϩάΞτ͢Δ·ͰͷΑ͏ͳҰ࿈ͷखଓ͖ͷ͜ͱɻ ηογϣϯཧΛߦ͏͜ͱͰɺ௨ৗεςʔτϨεͳHTTPʹ͓͍ͯɺϩάΠϯ ใΦϯϥΠϯγϣοϐϯάγεςϜͷΧʔτͳͲͷใΛอଘͯ͠ɺඞཁ ͳ࣌ʹऔΓग़͢͜ͱ͕Ͱ͖Δɻ
ηογϣϯϋΠδϟοΫͱ ౪ɾਪଌͳͲͷํ๏ͰηογϣϯIDΛಛఆ͠ ΞΧϯτΛͬऔΔ߈ܸ
ηογϣϯϋΠδϟοΫͷྨ ֮͑Α͏ ਪଌɹ౪ɹڧ੍
ηογϣϯϋΠδϟοΫͷྨ ֮͑Α͏ ਪଌɹ౪ɹڧ੍
ਪଌՄೳͳηογϣϯID ʢཁ͢ΔʹɺצͰͯΕͦ͏ͳจࣈྻʣ
ਪଌՄೳͳηογϣϯID ਪଌՄೳͳηογϣϯʹର͢Δ߈ܸख๏ 1.ରΞϓϦέʔγϣϯ͔ΒηογϣϯID ΛूΊΔ 2.ηογϣϯIDͷنଇੑͷԾઆΛཱͯΔ 3.ਪଌͨ͠ηογϣϯIDͰରΞϓϦέʔγϣϯΛ߈ܸ ରࡦˠWEBΞϓϦέʔγϣϯ։ൃπʔϧͷηογϣϯػߏΛ͏
ηογϣϯϋΠδϟοΫͷྨ ֮͑Α͏ ਪଌɹ౪ɹڧ੍
౪ՄೳͳηογϣϯID URLʹηογϣϯIDؚ͕·Ε͍ͯΔ߹ ηογϣϯ ID ͕ URL ʹؚ·Ε ͍ͯΔͱɺͲͷϖʔδ͔Β ભҠ͖͔ͯͨ͠ϒϥβ͕ ૹ৴ͯ͘͠Δ
REFERER ʹΑͬ ͯηογϣϯ ID ͕࿙Ӯ͢Δ ͜ͱ͕͋Γ·͢ɻηογϣ ϯ ID COOKIE ʹ֨ೲ͠ɺ COOKIE ʹ֨ೲͰ͖ͳ͍߹ʹ URL ʹηογϣϯ ID ؚ͕· Εͳ͍Α͏ʹઃఆ͓͖ͯ͠ ·͢ɻ
ηογϣϯϋΠδϟοΫͷྨ ֮͑Α͏ ਪଌɹ౪ɹڧ੍
ηογϣϯIDͷݻఆԽ ηογϣϯIDͷݻఆԽ߈ܸɺਖ਼نͷαΠτ͔ΒѱҙΛ࣋ͬͨϢʔβ͕ηογϣϯID Λऔಘ͠ɺͦͷηογϣϯIDΛଞͷϢʔβʹڧ੍͢Δɻ ڧ੍͞ΕͨηογϣϯIDͰϢʔβ͕ϩάΠϯΛߦͬͨ߹ɺͦͷηογϣϯIDΛݩʑ ͍ͬͯΔѱҙΛ࣋ͬͨϢʔβϩάΠϯͨ͠ϢʔβʹΓΘͬͯૢ࡞Λߦ͏͜ͱ ͕Ͱ͖Δɻ
ηογϣϯIDͷݻఆԽ ରࡦˠϩάΠϯޙʹηογϣϯΛ৽نʹ࡞ΔʢηογϣϯIDͷ࠶ൃߦʣ ରࡦ̎ˠϩάΠϯޙʹηογϣϯIDͱผʹೝՄ͞Εͨ͜ͱΛূ໌͢ΔใΛՃ͢Δɻ
·ͱΊ
·ͱΊ ɾηογϣϯཧػߏΛࣗ࡞͠ͳ͍ʢਪଌରࡦʣ →WEBΞϓϦέʔγϣϯ։ൃπʔϧΛ͏ ɾURLʹηογϣϯIDΛຒΊࠐ·ͳ͍ʢ౪ରࡦʣ →ΫοΩʔͰηογϣϯIDΛཧ͢Δ ɾೝূޭ࣌ʹηογϣϯIDΛมߋ͢Δ(ڧ੍ରࡦʣ
͝੩ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠