[B! csrf] kmachuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kmachu id:kmachu

csrfã«é–¢ã™ã‚‹kmachuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (7)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Amazonã®ã™ã”ã„ã‚¢ã‚¯ã‚»ã‚¹è§£æžã‚µãƒ¼ãƒ“ã‚¹ - ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼
ã“ã‚“ã«ã¡ã¯ï¼ Amazonã»ã—ã„ç‰©ãƒªã‚¹ãƒˆã€ã™ã”ã„è©±é¡Œã«ãªã£ã¦ã¾ã™ãï¼ ãªã‚“ã§ã‚‚ã€ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã§æ¤œç´¢ã™ã‚Œã°Amazonã«ç™»éŒ²ã—ã¦ã‚ã‚‹æœ¬åãŒã§ã¦ãã‚‹ (ã‚±ãƒ¼ã‚¹ã‚‚ã‚ã‚‹) ã¨ã‹â€¦ã€‚ ã§ã€ã•ã£ããã¼ãã‚‚è©¦ã—ã¦ã¿ãŸã‚ˆï¼ ã»ã—ã„ç‰©ãƒªã‚¹ãƒˆã‚µãƒ¼ãƒï¼ ã“ã‚Œã£ã¦ã€ã„ã¾è©±é¡Œã«ãªã£ã¦ã„ã‚‹ã®ã¯ã€èª°ã‹ã®ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’æ‰‹ãŒã‹ã‚Šã«ã—ã¦ ã‚¦ã‚£ãƒƒã‚·ãƒ¥ãƒªã‚¹ãƒˆã‚„æœ¬åã€ä¸‹æ‰‹ã™ã‚‹ã¨ä½æ‰€ã¾ã§çŸ¥ã‚‰ã‚Œã¦ã—ã¾ã†ã£ã¦ã¨ã“ã‚ã ã‚ˆãã€‚ ãã‚Œã ã‘ã§ã‚‚é¢ç™½ã„ã‚“ã ã‘ã©ã€ ã‚ã¾ã‚Šæ³¨ç›®ã•ã‚Œã¦ã„ãªã„æ©Ÿèƒ½ã¨ã—ã¦ã€ã“ã‚“ãªã‚‚ã®ãŒã‚ã£ãŸã‚ˆã€‚ å‹ã ã¡ã«ã»ã—ã„ç‰©ãƒªã‚¹ãƒˆã«ã¤ã„ã¦çŸ¥ã‚‰ã›ã‚‹ ã“ã‚Œã€‚ è‡ªåˆ†ã®ã»ã—ã„ç‰©ãƒªã‚¹ãƒˆã‚’èª°ã‹ã«ãƒ¡ãƒ¼ãƒ«é€ä¿¡ã§ãã¡ã‚ƒã†æ©Ÿèƒ½ã‚‰ã—ã„ãï¼ ã˜ã‚ƒã‚è©¦ã—ã«ãƒ¡ãƒ¼ãƒ«é€ä¿¡æ™‚ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’ç¢ºèªã—ã¦ã¿ã‚‹ã¨â€¦ http://www.amazon.co.jp/gp/registry/send-nudge.html?ie=UTF8&type=wishlist&__mk_j
kmachu 2008/03/12
ãƒªãƒ³ã‚¯ã‚’è¸ã‚€ã ã‘ã§æœ¬åã‚’ä»»æ„ã®ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã«é€ã‚‹ã“ã¨ãŒã§ãã‚‹ã€‚CSRFã§ã™ãªã€‚

csrf

amazon

security
ãƒªãƒ³ã‚¯
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - CSRFå¯¾ç–ã«ã€Œãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒˆãƒ¼ã‚¯ãƒ³ã€æ–¹å¼ã‚’æŽ¨å¥¨ã—ãªã„ç†ç”±
æ°´è‰²ã®å››è§’ã¯ç”»é¢ã‚’è¡¨ã—ã€ç™½æŠœãå®Ÿç·šæž ã®å››è§’ã¯ãƒœã‚¿ãƒ³ã‚’è¡¨ã™ã€‚ ã“ã‚Œã‚’ã€Webã‚¢ãƒ—ãƒªã¨ã„ã†å®Ÿè£…æ‰‹æ³•ã‚’é¸æŠžã™ã‚‹å ´åˆã«ç‰¹åŒ–ã™ã‚‹ã¨ã€å›³2ã®ã‚ˆã†ãªé·ç§»å›³ãŒæã‘ã‚‹ã€‚ å®Ÿç·šçŸ¢å°ã¯ãƒ–ãƒ©ã‚¦ã‚¶ãŒé€ä¿¡ã™ã‚‹HTTPã®requestï¼ˆãƒ˜ãƒƒãƒ€ãŠã‚ˆã³ã€POSTã®å ´åˆã¯ãƒœãƒ‡ã‚£ã‚’å«ã‚€ï¼‰ã‚’è¡¨ã—ã€é»„è‰²ã®ä¸¸ãŒã‚µãƒ¼ãƒå´ã§ã®1ã‚¢ã‚¯ã‚»ã‚¹ã®å‡¦ç†ã‚’è¡¨ã—ã€ç‚¹ç·šãŒãã®å‡¦ç†çµæžœã‚’è¿”ã™HTTPã®responseï¼ˆãƒ˜ãƒƒãƒ€ãŠã‚ˆã³ã€HTMLï¼‰ã‚’è¡¨ã™ã€‚responseã®ä¸Šã®æ–‡ã¯HTMLã®å†…å®¹ã‚’èª¬æ˜Žã™ã‚‹ã‚‚ã®ã§ã‚ã‚‹ã€‚é»„è‰²ã®ä¸¸ã®ä¸ã®æ–‡ã¯å‡¦ç†å†…å®¹ã®èª¬æ˜Žã§ã‚ã‚Šã€ã“ã“ã‹ã‚‰è¤‡æ•°ã®responseçŸ¢å°ãŒå‡ºã¦ã„ã‚‹å ´åˆã€å‡¦ç†ã®çµæžœã«ã‚ˆã£ã¦é·ç§»å…ˆã®ç”»é¢ãŒç•°ãªã‚‹å ´åˆã§ã‚ã‚‹ã“ã¨ã‚’è¡¨ã—ã€ç ´ç·šã®ç™½æŠœãå››è§’ãŒãã®åˆ†å²ã®æ¡ä»¶ã‚’æ¦‚èª¬ã—ã¦ã„ã‚‹ã€‚ ã“ã®å›³ã§ä¾‹ã«ç”¨ã„ã¦ã„ã‚‹ã®ã¯ã€ECã‚µã‚¤ãƒˆã‚„blogã‚µãƒ¼ãƒ“ã‚¹ãªã©ã«è¦‹ã‚‰ã‚Œã‚‹å…¸åž‹çš„ãªã€Œç™»éŒ²å€‹äººæƒ…å ±å¤‰æ›´ã€ã®æ©Ÿèƒ½ã§ã‚ã‚‹ã€‚ã€Œãƒ¡ã‚¤ãƒ³ãƒ¡ãƒ‹ãƒ¥ãƒ¼ã€ç”»é¢ã®ã€Œç™»éŒ²æƒ…å ±å¤‰æ›´
kmachu 2007/09/12
ã€Œç·¨é›†é–‹å§‹ã®æœ€åˆã®æ®µéšŽã§ã€æ©Ÿèƒ½ã«å›ºæœ‰ã®ä½•ã‚‰ã‹ã®è˜åˆ¥ã‚³ãƒ¼ãƒ‰ã‚’ç¢ºå®šã•ã›ã¦ä½¿ã†æ–¹æ³•ãŒä½¿ã‚ã‚Œã¦ã„ã‚‹ã®ã§ã¯ãªã„ã‹ã€â†RESTå¿—å‘ã¨ã®é–¢é€£ãŒèˆˆå‘³æ·±ã„ã€‚

security

csrf

rest
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚¹ã‚¿ãƒ¼ã®èªè¨¼å¼·åŒ–ã«ã¤ã„ã¦ - ã¯ã¦ãªã‚¹ã‚¿ãƒ¼æ—¥è¨˜
å…ˆã»ã©ã€ã¯ã¦ãªã‚¹ã‚¿ãƒ¼ã®ä»•çµ„ã¿ã‚’å¤‰æ›´ã—ã€æ£å¸¸ãªã¯ã¦ãªã‚¹ã‚¿ãƒ¼ã®ã‚³ãƒ¼ãƒ‰ä»¥å¤–ã§â˜†ãŒä»˜ã‘ã«ãããªã‚Šã¾ã—ãŸã€‚ ã“ã‚Œã¾ã§ã®ä»•æ§˜ã§ã¯ã€ç”»åƒï¼ˆimgï¼‰ã‚¿ã‚°ãªã©ã«â˜†ã‚’è¿½åŠ ã™ã‚‹ãŸã‚ã®URLã‚’ä»•è¾¼ã¾ã›ã‚‹ã ã‘ã§ã€ãã®ãƒšãƒ¼ã‚¸ã«ã‚¢ã‚¯ã‚»ã‚¹ã—ãŸã ã‘ã§â˜†ã‚’ã¤ã‘ãŸã“ã¨ã«ãªã£ã¦ã—ã¾ã†ãªã©ã®å•é¡ŒãŒç™ºç”Ÿã—ã¦ã„ã¾ã—ãŸãŒã€ä»Šå›žã®å¤‰æ›´ã«ã‚ˆã‚Šã€ã‚»ãƒƒã‚·ãƒ§ãƒ³ã”ã¨ã«æš—å·åŒ–ã•ã‚ŒãŸæ–‡å—åˆ—ã‚’è¿½åŠ ã§ã‚„ã‚Šã¨ã‚Šã™ã‚‹ã‚ˆã†ã«ãªã‚Šã€æ„å›³ã—ãªã„â˜†ãŒã¤ãã«ãã„ä»•çµ„ã¿ã«ãªã‚Šã¾ã—ãŸã€‚ ãªãŠã€æ—¢å˜ã®ã¯ã¦ãªã‚¹ã‚¿ãƒ¼ã‚’è¨ç½®ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼æ§˜ã¯ã€ç‰¹ã«è¨å®šã®å¤‰æ›´ãªã©ã¯å¿…è¦ã”ã–ã„ã¾ã›ã‚“ã€‚ æ–°ã—ã„ä»•æ§˜ã§ã‚‚ã€JavaScriptãŒå®Ÿè¡Œå¯èƒ½ãªç’°å¢ƒã§æ„å›³çš„ã«ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’ä»•è¾¼ã‚€ã“ã¨ã§æ„å›³ã—ãªã„â˜†ãŒä»˜ãå‹•ä½œã‚’å®Ÿè¡Œã•ã›ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã™ãŒã€ã¯ã¦ãªãƒ€ã‚¤ã‚¢ãƒªãƒ¼ã‚„ã‚°ãƒ«ãƒ¼ãƒ—ãªã©ã®JavaScriptã‚’è‡ªç”±ã«æ›¸ãã“ã¨ãŒã§ããªã„ç’°å¢ƒã§ã¯ã“ã®ã‚ˆã†ãªã“ã¨ã¯ã§ããªããªã£ã¦ã„ã¾ã™ã€‚ ã¯ã¦ãªã‚¹ã‚¿ãƒ¼ã§ã¯ã€å¤–éƒ¨ã®ãƒ–ãƒã‚°ã‚µã‚¤ãƒˆãªã©æ§˜ã€…
kmachu 2007/08/14
å¾ŒåŠã®GET/POSTã®è©±ãŒåˆ†ã‹ã‚Šã«ãã„â€¦ã€‚CSRFã¨GET/POSTã¯é–¢ä¿‚ãªã„ã‚“ã˜ã‚ƒãªã‹ã£ãŸï¼Ÿ

security

csrf
ãƒªãƒ³ã‚¯
ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã®HTMLèªã¿å–ã‚Š(IEã®ãƒã‚°ã€€CSSXSSï¼‰ã¨CSRF
Last Updated on: 2014å¹´12æœˆ5æ—¥è¿½è¨˜ï¼šã“ã®ãƒ–ãƒã‚°ã‚’è¨˜è¼‰ã™ã‚‹ç†ç”±ã¨ãªã£ãŸURLã‚’è¨˜è¼‰ã•ã‚ŒãŸæ–¹ãŒå†…å®¹ã‚’å‰Šé™¤ã•ã‚ŒãŸã‚ˆã†ã§ã™ã€‚ã€Œé–“é•ã£ã¦ã„ã‚‹ã€ã¨è¨€ã‚ã‚Œã‚‹ã®ã¯å¿ƒå¤–ã§ã‚ã‚‹ã€ã¨æ€ã£ãŸã“ã¨ã¯ç¢ºã‹ã§ã™ãŒãƒšãƒ¼ã‚¸ã®å†…å®¹ãŒå‰Šé™¤ã•ã‚Œã‚‹ã®ã¯ç§ã®æœ¬æ„ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚æ›¸ã‹ã‚Œã¦ã„ãŸæƒ…å ±ã¯ã¨ã¦ã‚‚å½¹ã«ç«‹ã¤æƒ…å ±ã ã¨æ€ã„ã¾ã™ã€‚éžå¸¸ã«æ®‹å¿µãªã®ã§å†åº¦æŽ²è¼‰ã•ã‚Œã‚‹ã“ã¨ã‚’æœ›ã¿ã¾ã™ã€‚ï¼ˆæœ¬å½“ â€”â€“ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã§ã¯ã‚ˆãã‚ã‚‹ã“ã¨ã§ã™ãŒã€æ¡ä»¶ã®è¦‹è½ã¨ã—ã«ã‚ˆã‚Šã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã‚’è¡Œã£ã¦ã„ã¦ã‚‚è„†å¼±æ€§ãŒç™ºç”Ÿã™ã‚‹ã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚ã€ŒWebã‚¢ãƒ—ãƒªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–å…¥é–€ã€ã«æ›¸ã‹ã‚Œã¦ã„ã‚‹CSRFå¯¾ç–ã«ã‚‚ã€Œã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³ã®HTMLèªã¿å–ã‚Š(IEã®ãƒã‚°ï¼‰ã€ã®å•é¡ŒãŒä¿®æ£ã•ã‚Œã¦ã„ãªã„ç‚ºã€æ›¸ç±ã«è¨˜è¼‰ã—ãŸå¯¾ç–ã‚’è¡Œã£ã¦ã‚‚ãƒã‚°ã‚’æŒã¤IEã«å¯¾ã—ã¦ã¯CSRFã«è„†å¼±ã«ãªã‚Šã¾ã™ã€‚ ã—ã‹ã—ã€ã“ã®ãƒã‚°ã®å½±éŸ¿ã‚’æŒã£ã¦ã€ŒWebã‚¢ãƒ—ãƒªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–å…¥é–€ã€ã®CSRFå¯¾ç–ã‚’ã€Œé–“
kmachu 2007/04/29
security

csrf
ãƒªãƒ³ã‚¯
ãªãœCSSXSSã«æŠœæœ¬çš„ã«å¯¾ç–ã‚’ã¨ã‚‹ã“ã¨ãŒé›£ã—ã„ã‹ - ã„ã—ãªãŠ! (2006-03-31)
_ ãªãœCSSXSSã«æŠœæœ¬çš„ã«å¯¾ç–ã‚’ã¨ã‚‹ã“ã¨ãŒé›£ã—ã„ã‹ CSSXSSã®èª¬æ˜Žã«ã¤ã„ã¦ã€ãã®è„…å¨ã‚’éŽå‰°ã«è¡¨ç¾ã—ã¦ã„ã‚‹éƒ¨åˆ†ãŒã‚ã‚Šã¾ã—ãŸã€‚ãã®éƒ¨åˆ†ã«ã¤ã„ã¦åŠ ç†è¨‚æ£ã—ã¦ã„ã¾ã™ã€‚ @ 2006/4/3 tociyukiã•ã‚“ã«ã‚ˆã‚‹ã€Œ[web]MSIE ã® CSSXSS è„†å¼±æ€§ã¨ã¯ä½•ã‹ã€ãŠã‚ˆã³ã€Œ[web]é–‹ç™ºè€…ã‚µã‚¤ãƒ‰ã§ã® CSSXSS è„†å¼±æ€§å¯¾ç–ã€ã«ã¯ã€ã‚ˆã‚Šæ£ç¢ºãªCSSXSSè„†å¼±æ€§ã®å†…å®¹ãŠã‚ˆã³ãã‚Œã«å¯¾ã™ã‚‹ã‚µãƒ¼ãƒãƒ¼ã‚µã‚¤ãƒ‰é–‹ç™ºè€…ã§å¯èƒ½ãªå¯¾ç–ã«ã¤ã„ã¦ç´¹ä»‹ã•ã‚Œã¦ã„ã¾ã™ã®ã§ã€æ˜¯éžãã¡ã‚‰ã‚‚ã”è¦§ãã ã•ã„ã€‚ @ 2006/4/4 ä»Šã¾ã§ã‚‚ä½•åº¦ã‹ã“ã®è¾ºã®è©±ã¯ã‚ã¾ã‚Šå…·ä½“çš„ã§ã¯ãªãæ›¸ã„ã¦ããŸã‘ã©ã€ãã‚ãã‚CSSXSSã‚’æ‚ªç”¨ã—ãŸã„äººã«ã¯ååˆ†æƒ…å ±ãŒè¡Œãæ¸¡ã£ãŸã ã‚ã†ã—ã€å…·ä½“çš„ãªè©±ã‚’æ›¸ã„ã¦ã‚‚ã“ã‚Œä»¥ä¸Šå±é™ºãŒå¢—ã™ã¨ã„ã†ã“ã¨ã¯ãªã„ã ã‚ã†ã‹ã‚‰ã€ã¡ã‚‡ã£ã¨å…·ä½“çš„ã«æ›¸ã„ã¦ã¿ã‚‹ã€‚ ã¡ãªã¿ã«ç§è‡ªèº«ã¯ã€CSSXSSã®æ”»æ’ƒã‚³ãƒ¼ãƒ‰ãªã©ã‚’å®Ÿéš›ã«è©¦ã—ãŸã‚Šã¨ã„ã£ãŸ
kmachu 2007/04/29
POSTã§ç”Ÿæˆã•ã‚ŒãŸç”»é¢ã¯CSSXSSã§æ¼æ´©ã—ãªã„â†’hiddenã«ç§˜å¯†æƒ…å ±ã‚’åŸ‹ã‚è¾¼ã‚€å ´åˆã¯POSTã®ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã«ã™ã‚Œã°ã„ã„ã€ã£ã¦ã“ã¨ã‹ãªã€‚

security

csrf

cssxss
ãƒªãƒ³ã‚¯
ãŠã•ã‹ãªãƒ©ãƒœ - CSRFå¯¾ç–æ³•ã¨åŠ¹æžœ
è‡ªåˆ†ã§ã‚‚ã†ä¸€åº¦æ•´ç†ã™ã‚‹ãŸã‚ã«ã€ä»–ã®ã‚µã‚¤ãƒˆã«å€£ã£ã¦ç¾åœ¨æŒ™ã’ã‚‰ã‚Œã¦ã„ã‚‹CSRFå¯¾ç–æ³•ã¨ãã®åŠ¹æžœã‚’åˆ—æŒ™ã—ã¦ã¿ã‚‹ã€‚ã–ã£ã¨æ›¸ã„ãŸã®ã§å¤šåˆ†ãƒ„ãƒƒã‚³ãƒŸã©ã“ã‚æº€è¼‰ã ã¨æ€ã†ãŒã¨ã‚Šã‚ãˆãšå…¬é–‹ã€‚ç¾åœ¨æ€ã„ã¤ãæœ€å–„è§£ã¯ä¸€ç•ªä¸‹ã«æ›¸ã„ãŸã€‚ã‚ã¨ã¯é †ä¸åŒã€‚ POSTã‚’ç”¨ã„ã‚‹ æŽ¨å¥¨: ã¨ã‚Šã‚ãˆãš åŠ¹æžœ: ã‚ã‚Š å›žé¿æ³•: ã‚ã‚Š(Javascriptã«ã‚ˆã‚‹è‡ªå‹•Submitãªã©) å®Ÿè£…: ç°¡æ˜“ å‰¯ä½œç”¨: ãªã— ç¢ºã‹ã«POSTã§ã®CSRFã‚’ç ´ã‚‹æ‰‹æ³•ã¯å˜åœ¨ã™ã‚‹ãŒã€ã ã‹ã‚‰ã¨ã„ã£ã¦ã“ã®å¯¾ç–ã«å…¨ãåŠ¹æžœãŒãªã„ã‚ã‘ã§ã¯ãªã„ã€‚å®Œäº†ç”»é¢ã¸ã®ç›´æŽ¥ãƒªãƒ³ã‚¯ã§ã®CSRFã®ç™ºç”Ÿã¯æŠ‘åˆ¶ã§ãã‚‹ã€‚å®Ÿè£…ãŒç°¡å˜ãªä¸Šã€å‰¯ä½œç”¨ãŒç‰¹ã«ãªã„ã®ã§å®Ÿè£…ã—ã¦ãŠã„ã¦åˆ¥ã«æã¯ãªã„ã€‚ ãƒªãƒ•ã‚¡ãƒ©(Referer: ãƒ˜ãƒƒãƒ€)ã‚’ãƒã‚§ãƒƒã‚¯ã™ã‚‹ æŽ¨å¥¨: ã‚±ãƒ¼ã‚¹ãƒã‚¤ã‚±ãƒ¼ã‚¹ åŠ¹æžœ: å¤§ å›žé¿æ³•: ç‰¹ã«ãªã— å®Ÿè£…: ã‚„ã‚„é›£(ã‚³ãƒ¼ãƒ‰ã«æ±Žç”¨æ€§ã‚’æŒãŸã›ã‚‹ã®ãŒé›£ã—ã„) å‰¯ä½œç”¨: ãƒ–ãƒ©ã‚¦ã‚¶
kmachu 2007/04/29
ã€Œã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³è„†å¼±æ€§ã‚„ãƒ–ãƒ©ã‚¦ã‚¶ã®ã‚ãƒ£ãƒƒã‚·ãƒ¥ãªã©ã‹ã‚‰ã‚»ãƒƒã‚·ãƒ§ãƒ³IDãŒæ¼ã‚Œã¦ã—ã¾ã†ã¨ã„ã†å•é¡ŒãŒã‚ã‚‹ã€â†ã‚¯ãƒã‚¹ãƒ‰ãƒ¡ã‚¤ãƒ³è„†å¼±æ€§ã®å ´åˆã¯ã‚»ãƒƒã‚·ãƒ§ãƒ³CookieãŒæ¼ã‚Œã‚‹ã®ã§ã“ã‚Œä»¥å‰ã®å•é¡Œã€‚ã‚ã¨ã¯ã‚ãƒ£ãƒƒã‚·ãƒ¥ã‹â€¦ã€‚

csrf

security
ãƒªãƒ³ã‚¯
é–‹ç™ºè€…ã®ãŸã‚ã®æ£ã—ã„CSRFå¯¾ç–
è‘—è€…: é‡‘åºŠ <anvil@jumperz.net> http://www.jumperz.net/ â– ã¯ã˜ã‚ã« ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºè€…ã®ç«‹å ´ã‹ã‚‰è¦‹ãŸCSRFå¯¾ç–ã«ã¤ã„ã¦ã€ã•ã¾ã–ã¾ãªæƒ…å ±ãŒå…¥ã‚Šä¹±ã‚Œã¦ã„ã‚‹ã€‚ç†è€…ãŒ2006å¹´3æœˆã®æ™‚ç‚¹ã«ãŠã„ã¦å›½å†…ã®ã‚¦ã‚§ãƒ–ã‚µ ã‚¤ãƒˆã‚„ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿æ›¸ç±ãƒ»é›‘èªŒãªã©ã§CSRFå¯¾ç–ã«ã¤ã„ã¦æ›¸ã‹ã‚Œã¦ã„ã‚‹è¨˜äº‹ã‚’èª¿ã¹ãŸçµæžœã€ãŠã©ã‚ãã¹ãã“ã¨ã«ã€ãã®ã»ã¨ã‚“ã©ãŒèª¤ã‚Šã‚’å«ã‚“ã§ã„ãŸã‚Šã€ç¾å®Ÿçš„ ã«ã¯ä½¿ç”¨ã§ããªã„æ–¹æ³•ã‚’ç´¹ä»‹ã—ãŸã‚Šã—ã¦ã„ãŸã€‚ãã“ã§æœ¬ç¨¿ã§ã¯ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºè€…ã«ã¨ã£ã¦ã®æœ¬å½“ã«æ£ã—ã„CSRFå¯¾ç–ã«ã¤ã„ã¦ã¾ã¨ã‚ã‚‹ã“ã¨ã¨ã™ ã‚‹ã€‚ã¾ãŸã€æŽ¡ç”¨ã™ã¹ãã§ãªã„CSRFå¯¾ç–ã¨ãã®ç†ç”±ã‚‚åˆã‚ã›ã¦ç´¹ä»‹ã™ã‚‹ã€‚ â– ã‚ã‚‰ã‚†ã‚‹æ©Ÿèƒ½ãŒã‚¿ãƒ¼ã‚²ãƒƒãƒˆã¨ãªã‚Šã†ã‚‹ ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®æŒã¤å…¨ã¦ã®æ©Ÿèƒ½ãŒCSRFæ”»æ’ƒã®å¯¾è±¡ã¨ãªã‚Šã†ã‚‹ã€‚ã¾ãšã“ã®ã“ã¨ã‚’èªè˜ã—ã¦ãŠãå¿…è¦ãŒã‚ã‚‹ã€‚ Amaz
kmachu 2007/04/29
ã€ŒæŽ¡ç”¨ã™ã¹ãã§ãªã„å¯¾ç–ãã®1: ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã‚’ãƒˆãƒ¼ã‚¯ãƒ³ã¨ã—ã¦ä½¿ã†ã€ã€Œãƒˆãƒ¼ã‚¯ãƒ³ã®æ¼æ´©ãŒå³ã‚»ãƒƒã‚·ãƒ§ãƒ³IDã®æ¼ã‚Œã«ç¹‹ãŒã£ã¦ã—ã¾ã†ã€â†å®Ÿéš›ã®ã¨ã“ã‚ã€ãƒˆãƒ¼ã‚¯ãƒ³ãŒæ¼ã‚Œã‚‹å±é™ºæ€§ã¯ã©ã‚Œãã‚‰ã„ãªã®ã‹ï¼Ÿ

security

csrf
ãƒªãƒ³ã‚¯
1