Upgrade to Pro — share decks privately, control downloads, hide ads and more …

0802徳丸.pdf

Avatar for tanakata tanakata
August 02, 2017
0
50

 0802徳丸.pdf

Avatar for tanakata

tanakata

August 02, 2017
Tweet

More Decks by tanakata

See All by tanakata
20171201
Avatar for tanakata tanakata
0
37
20171110
Avatar for tanakata tanakata
0
47
1013
Avatar for tanakata tanakata
0
50
徳丸0922
Avatar for tanakata tanakata
0
75
0901
Avatar for tanakata tanakata
0
42
2017/08/25
Avatar for tanakata tanakata
0
46
徳丸20170721.pdf
Avatar for tanakata tanakata
0
39

Featured

See All Featured
How to train your dragon (web standard)
Avatar for Monica Dinculescu notwaldorf
97
6.5k
RailsConf 2023
Avatar for Aaron Patterson tenderlove
30
1.3k
The browser strikes back
Avatar for Jono Alderson jonoalderson
0
360
Navigating Algorithm Shifts & AI Overviews - #SMXNext
Avatar for Aleyda Solis aleyda
0
1.1k
For a Future-Friendly Web
Avatar for Brad Frost brad_frost
182
10k
GraphQLの誤解/rethinking-graphql
Avatar for sonatard sonatard
74
11k
The B2B funnel & how to create a winning content strategy
Avatar for Katarina Dahlin katarinadahlin
PRO
0
270
Utilizing Notion as your number one productivity tool
Avatar for Mfonobong Umondia mfonobong
3
220
Public Speaking Without Barfing On Your Shoes - THAT 2023
Avatar for David Neal reverentgeek
1
300
Unsuck your backbone
Avatar for Amy Palamountain ammeep
671
58k
Building Adaptive Systems
Avatar for Chris Keathley keathley
44
2.9k
The Art of Delivering Value - GDevCon NA Keynote
Avatar for David Neal reverentgeek
16
1.8k

Transcript

  1. 2017/08/02 ಙؙຊྠಡձ ηογϣϯϋΠδϟοΫ

  2. ͜Ε·ͰͷྲྀΕ ΫϩεαΠτεΫϦϓςΟϯά(ాɾߥʣ SQLΠϯδΣΫγϣϯʢখʣ CSRFʢຢʣ

  3. ͜Ε·ͰͷྲྀΕ ΫϩεαΠτεΫϦϓςΟϯά(ాɾߥʣ SQLΠϯδΣΫγϣϯʢখʣ CSRFʢຢʣ NEW!→ηογϣϯϋΠδϟοΫʢాʣ

  4. ηογϣϯͷ͓͞Β͍

  5. ηογϣϯͱ͸ ϩάΠϯ͔ͯ͠ΒϩάΞ΢τ͢Δ·ͰͷΑ͏ͳҰ࿈ͷखଓ͖ͷ͜ͱɻ ηογϣϯ؅ཧΛߦ͏͜ͱͰɺ௨ৗεςʔτϨεͳHTTPʹ͓͍ͯɺϩάΠϯ৘ ใ΍ΦϯϥΠϯγϣοϐϯάγεςϜͷΧʔτͳͲͷ৘ใΛอଘͯ͠ɺඞཁ ͳ࣌ʹऔΓग़͢͜ͱ͕Ͱ͖Δɻ

  6. ηογϣϯϋΠδϟοΫͱ͸ ౪೉ɾਪଌͳͲͷํ๏ͰηογϣϯIDΛಛఆ͠ ΞΧ΢ϯτΛ৐ͬऔΔ߈ܸ

  7. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  8. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  9. ਪଌՄೳͳηογϣϯID ʢཁ͢ΔʹɺצͰ౰ͯΕͦ͏ͳจࣈྻʣ

  10. ਪଌՄೳͳηογϣϯID ਪଌՄೳͳηογϣϯʹର͢Δ߈ܸख๏ 1.ର৅ΞϓϦέʔγϣϯ͔ΒηογϣϯID ΛूΊΔ 2.ηογϣϯIDͷنଇੑͷԾઆΛཱͯΔ 3.ਪଌͨ͠ηογϣϯIDͰର৅ΞϓϦέʔγϣϯΛ߈ܸ ରࡦˠWEBΞϓϦέʔγϣϯ։ൃπʔϧͷηογϣϯػߏΛ࢖͏

  11. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  12. ౪೉ՄೳͳηογϣϯID URLʹηογϣϯIDؚ͕·Ε͍ͯΔ৔߹ ηογϣϯ ID ͕ URL ʹؚ·Ε ͍ͯΔͱɺͲͷϖʔδ͔Β ભҠ͖͔ͯͨ͠ϒϥ΢β͕ ૹ৴ͯ͘͠Δ

    REFERER ʹΑͬ ͯηογϣϯ ID ͕࿙Ӯ͢Δ ͜ͱ͕͋Γ·͢ɻηογϣ ϯ ID ͸ COOKIE ʹ֨ೲ͠ɺ COOKIE ʹ֨ೲͰ͖ͳ͍৔߹ʹ ΋ URL ʹηογϣϯ ID ؚ͕· Εͳ͍Α͏ʹઃఆ͓͖ͯ͠ ·͢ɻ

  13. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  14. ηογϣϯIDͷݻఆԽ ηογϣϯIDͷݻఆԽ߈ܸ͸ɺਖ਼نͷαΠτ͔ΒѱҙΛ࣋ͬͨϢʔβ͕ηογϣϯID Λऔಘ͠ɺͦͷηογϣϯIDΛଞͷϢʔβʹڧ੍͢Δɻ ڧ੍͞ΕͨηογϣϯIDͰϢʔβ͕ϩάΠϯΛߦͬͨ৔߹ɺͦͷηογϣϯIDΛݩʑ ஌͍ͬͯΔѱҙΛ࣋ͬͨϢʔβ͸ϩάΠϯͨ͠Ϣʔβʹ੒Γ୅Θͬͯૢ࡞Λߦ͏͜ͱ ͕Ͱ͖Δɻ

  15. ηογϣϯIDͷݻఆԽ ରࡦˠϩάΠϯޙʹηογϣϯΛ৽نʹ࡞ΔʢηογϣϯIDͷ࠶ൃߦʣ ରࡦ̎ˠϩάΠϯޙʹηογϣϯIDͱ͸ผʹೝՄ͞Εͨ͜ͱΛূ໌͢Δ৘ใΛ෇Ճ͢Δɻ

  16. ·ͱΊ

  17. ·ͱΊ ɾηογϣϯ؅ཧػߏΛࣗ࡞͠ͳ͍ʢਪଌରࡦʣ →WEBΞϓϦέʔγϣϯ։ൃπʔϧΛ࢖͏ ɾURLʹηογϣϯIDΛຒΊࠐ·ͳ͍ʢ౪೉ରࡦʣ →ΫοΩʔͰηογϣϯIDΛ؅ཧ͢Δ ɾೝূ੒ޭ࣌ʹηογϣϯIDΛมߋ͢Δ(ڧ੍ରࡦʣ

  18. ͝੩ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠