Upgrade to Pro — share decks privately, control downloads, hide ads and more …

0802徳丸.pdf

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest. →
Avatar for tanakata tanakata
August 02, 2017
0
50

 0802徳丸.pdf

Avatar for tanakata

tanakata

August 02, 2017
Tweet

More Decks by tanakata

See All by tanakata
20171201
Avatar for tanakata tanakata
0
37
20171110
Avatar for tanakata tanakata
0
47
1013
Avatar for tanakata tanakata
0
50
徳丸0922
Avatar for tanakata tanakata
0
75
0901
Avatar for tanakata tanakata
0
42
2017/08/25
Avatar for tanakata tanakata
0
46
徳丸20170721.pdf
Avatar for tanakata tanakata
0
39

Featured

See All Featured
Paper Plane
Avatar for Katie Cordina Lindsey katiecoart
PRO
0
46k
Getting science done with accelerated Python computing platforms
Avatar for Jacob Tomlinson jacobtomlinson
2
110
Evolving SEO for Evolving Search Engines
Avatar for Ryan Jones ryanjones
0
120
The State of eCommerce SEO: How to Win in Today's Products SERPs - #SEOweek
Avatar for Aleyda Solis aleyda
2
9.5k
SEO for Brand Visibility & Recognition
Avatar for Aleyda Solis aleyda
0
4.2k
Why Our Code Smells
Avatar for Brandon Keepers bkeepers
PRO
340
58k
Lightning Talk: Beautiful Slides for Beginners
Avatar for Ines Montani inesmontani
PRO
1
440
YesSQL, Process and Tooling at Scale
Avatar for Rocio Delgado rocio
174
15k
Reflections from 52 weeks, 52 projects
Avatar for Jefferson Lam jeffersonlam
356
21k
Rails Girls Zürich Keynote
Avatar for Gregor Martynus gr2m
96
14k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
Avatar for soudai sone soudai
PRO
196
71k
The Director’s Chair: Orchestrating AI for Truly Effective Learning
Avatar for Mike Taylor tmiket
1
96

Transcript

  1. 2017/08/02 ಙؙຊྠಡձ ηογϣϯϋΠδϟοΫ

  2. ͜Ε·ͰͷྲྀΕ ΫϩεαΠτεΫϦϓςΟϯά(ాɾߥʣ SQLΠϯδΣΫγϣϯʢখʣ CSRFʢຢʣ

  3. ͜Ε·ͰͷྲྀΕ ΫϩεαΠτεΫϦϓςΟϯά(ాɾߥʣ SQLΠϯδΣΫγϣϯʢখʣ CSRFʢຢʣ NEW!→ηογϣϯϋΠδϟοΫʢాʣ

  4. ηογϣϯͷ͓͞Β͍

  5. ηογϣϯͱ͸ ϩάΠϯ͔ͯ͠ΒϩάΞ΢τ͢Δ·ͰͷΑ͏ͳҰ࿈ͷखଓ͖ͷ͜ͱɻ ηογϣϯ؅ཧΛߦ͏͜ͱͰɺ௨ৗεςʔτϨεͳHTTPʹ͓͍ͯɺϩάΠϯ৘ ใ΍ΦϯϥΠϯγϣοϐϯάγεςϜͷΧʔτͳͲͷ৘ใΛอଘͯ͠ɺඞཁ ͳ࣌ʹऔΓग़͢͜ͱ͕Ͱ͖Δɻ

  6. ηογϣϯϋΠδϟοΫͱ͸ ౪೉ɾਪଌͳͲͷํ๏ͰηογϣϯIDΛಛఆ͠ ΞΧ΢ϯτΛ৐ͬऔΔ߈ܸ

  7. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  8. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  9. ਪଌՄೳͳηογϣϯID ʢཁ͢ΔʹɺצͰ౰ͯΕͦ͏ͳจࣈྻʣ

  10. ਪଌՄೳͳηογϣϯID ਪଌՄೳͳηογϣϯʹର͢Δ߈ܸख๏ 1.ର৅ΞϓϦέʔγϣϯ͔ΒηογϣϯID ΛूΊΔ 2.ηογϣϯIDͷنଇੑͷԾઆΛཱͯΔ 3.ਪଌͨ͠ηογϣϯIDͰର৅ΞϓϦέʔγϣϯΛ߈ܸ ରࡦˠWEBΞϓϦέʔγϣϯ։ൃπʔϧͷηογϣϯػߏΛ࢖͏

  11. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  12. ౪೉ՄೳͳηογϣϯID URLʹηογϣϯIDؚ͕·Ε͍ͯΔ৔߹ ηογϣϯ ID ͕ URL ʹؚ·Ε ͍ͯΔͱɺͲͷϖʔδ͔Β ભҠ͖͔ͯͨ͠ϒϥ΢β͕ ૹ৴ͯ͘͠Δ

    REFERER ʹΑͬ ͯηογϣϯ ID ͕࿙Ӯ͢Δ ͜ͱ͕͋Γ·͢ɻηογϣ ϯ ID ͸ COOKIE ʹ֨ೲ͠ɺ COOKIE ʹ֨ೲͰ͖ͳ͍৔߹ʹ ΋ URL ʹηογϣϯ ID ؚ͕· Εͳ͍Α͏ʹઃఆ͓͖ͯ͠ ·͢ɻ

  13. ηογϣϯϋΠδϟοΫͷ෼ྨ ֮͑Α͏ ਪଌɹ౪೉ɹڧ੍

  14. ηογϣϯIDͷݻఆԽ ηογϣϯIDͷݻఆԽ߈ܸ͸ɺਖ਼نͷαΠτ͔ΒѱҙΛ࣋ͬͨϢʔβ͕ηογϣϯID Λऔಘ͠ɺͦͷηογϣϯIDΛଞͷϢʔβʹڧ੍͢Δɻ ڧ੍͞ΕͨηογϣϯIDͰϢʔβ͕ϩάΠϯΛߦͬͨ৔߹ɺͦͷηογϣϯIDΛݩʑ ஌͍ͬͯΔѱҙΛ࣋ͬͨϢʔβ͸ϩάΠϯͨ͠Ϣʔβʹ੒Γ୅Θͬͯૢ࡞Λߦ͏͜ͱ ͕Ͱ͖Δɻ

  15. ηογϣϯIDͷݻఆԽ ରࡦˠϩάΠϯޙʹηογϣϯΛ৽نʹ࡞ΔʢηογϣϯIDͷ࠶ൃߦʣ ରࡦ̎ˠϩάΠϯޙʹηογϣϯIDͱ͸ผʹೝՄ͞Εͨ͜ͱΛূ໌͢Δ৘ใΛ෇Ճ͢Δɻ

  16. ·ͱΊ

  17. ·ͱΊ ɾηογϣϯ؅ཧػߏΛࣗ࡞͠ͳ͍ʢਪଌରࡦʣ →WEBΞϓϦέʔγϣϯ։ൃπʔϧΛ࢖͏ ɾURLʹηογϣϯIDΛຒΊࠐ·ͳ͍ʢ౪೉ରࡦʣ →ΫοΩʔͰηογϣϯIDΛ؅ཧ͢Δ ɾೝূ੒ޭ࣌ʹηογϣϯIDΛมߋ͢Δ(ڧ੍ରࡦʣ

  18. ͝੩ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠