CINXE.COM

<!DOCTYPE html> <html lang="ja" data-page-scope="EntrySearch" data-stable-request-url="https://b.hatena.ne.jp/q/CSRF" data-device-type="PC" data-sentry-environment="production" data-sentry-sample-rate="0.1" data-entry-search-query="CSRF" data-page-subtype="entrysearch" data-page-type="entrysearch" > <head>  <script> (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-5TDHQX'); </script>  <meta charset="UTF-8"> <title>CSRFの人気記事 42件 - はてなブックマーク</title> <script src="https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/js/v4/bookmark.js" async></script> <link type="text/css" rel="stylesheet" href="https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/css/v4/pikaday.css" /> <link type="text/css" rel="stylesheet" href="https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/css/v4/triangle.css" /> <link type="text/css" rel="stylesheet" href="https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/css/v4/bookmark.css" /> <link type="text/css" rel="stylesheet" href="https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/css/v4/bookmark.star.css" /> <link rel="canonical" href="https://b.hatena.ne.jp/q/CSRF" /> <link rel="next" href="/q/CSRF?sort=popular&date_range=5y&safe=on&page=2&target=tag&users=3"> <link rel="shortcut icon" type="image/x-icon" href="/favicon.ico" /> <meta name="viewport" content="width=device-width"> <link rel="search" type="application/opensearchdescription+xml" title="はてなブックマーク検索" href="/opensearch.xml" /> <link rel="apple-touch-icon-precomposed" href="https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/images/v4/public/apple-touch-icon-precomposed.png" /> <link rel="mask-icon" href="https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/images/v4/public/safari-pinned-tab-icon.svg" color="#00A4DE" /> <meta name="msapplication-navbutton-color" content="#2C6EBD" /> <meta name="msapplication-task" content="name=はてなブックマーク; action-uri=/; icon-uri=https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/images/v4/public/icons/bookmark.ico" /> <meta name="msapplication-task" content="name=マイブックマーク; action-uri=/my; icon-uri=https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/images/v4/public/icons/my-bookmark.ico" /> <meta name="msapplication-task" content="name=お気に入りのブックマーク; action-uri=/my/favorite; icon-uri=https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/images/v4/public/icons/favorite-bookmark.ico" /> <meta name="msapplication-task" content="name=人気エントリー; action-uri=/hotentry; icon-uri=https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/images/v4/public/icons/hotentry.ico" /> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="referrer" content="origin"> <link rel="alternate" type="application/rss+xml" href="/q/CSRF?target=tag&users=3&date_range=5y&safe=on&mode=rss&sort=popular" /> <script> function isMobile() { const html = document.documentElement; const deviceType = html.dataset.deviceType || ''; if (deviceType.length > 0) { return deviceType === 'MOBILE'; } else { const maxMobileWidth = 480; const windowWidth = window.innerWidth; return maxMobileWidth >= windowWidth; } } </script> </head> <body class="page-centerarticle page-entrysearch fixed-header">  <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-5TDHQX" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>  <div class="link-app-banner js-dynamic-link-app-banner is-hidden"> <button class="link-app-banner-btn-close js-dynamic-link-app-banner-close-button"><span>close</span></button> <a class="link-app-banner-btn" href="https://hatenabookmark.page.link/app"> <div class="link-app-banner-btn-detail"> <div class="link-app-banner-icon"><img src="/images/v4/public/app/ic-ios.svg" alt="はてなブックマークアプリ"></div> <p class="link-app-banner-text">サクサク読めて、<br class="link-app-banner-text-newline">アプリ限定の機能も多数！</p> </div> <div class="link-app-banner-btn-open">アプリで開く</div> </a> </div> <header id="global-header" data-portal-static-origin="//cdn.www.st-hatena.com"> <div id="header" class="global-header-inner js-global-header-inner"> <h2 id="gh-logo"><a href="/" data-gtm-label="gh-blogo"><span>はてなブックマーク</span></a></h2> <div class="is-guest js-guest is-hidden"> <input id="gh-search-icon-check" type="checkbox" checked="checked" /> <label class="gh-search-icon" for="gh-search-icon-check" aria-label="検索を閉じる"><span>閉じる</span></label> <form class="gh-searchbox" method="get" action="/search_dwim" role="search"> <input value="" name="q" type="search" class="gh-inputtext" placeholder="キーワード・URLを検索" size="40" /> <input value="" type="submit" class="gh-search-button" /> </form> <ul class="gh-service-menu"> <li><a href="/guide" data-gtm-label="gh-guest-guide">はてなブックマークって？</a></li> <li><a href="/guide/tools" data-gtm-label="gh-guest-tools">アプリ・拡張の紹介</a></li> <li><a href="https://www.hatena.ne.jp/register?location=https%3A%2F%2Fb.hatena.ne.jp%2F%3Fregistered_from%3Dglobal-header&via=201037" class="gh-guest-register" data-gtm-label="gh-guest-register">ユーザー登録</a></li> <li><a href="https://www.hatena.ne.jp/login?location=https%3A%2F%2Fb.hatena.ne.jp%2Fq%2FCSRF" rel="nofollow" class="gh-guest-login" data-gtm-label="gh-guest-login">ログイン</a></li> <li class="gh-hatena-logo"><a href="http://www.hatena.ne.jp/"><img src="https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/images/v4/public/logo/logo-global-white.svg" alt="Hatena" width="74px" height="13px"/></a></li> </ul> </div> <noscript> <ul class="gh-service-menu"> <li><a href="https://www.hatena.ne.jp/logout?location=https%3A%2F%2Fb.hatena.ne.jp%2F">ログアウト</a></li> </ul> </noscript> <script type="text/x-template" id="template-menu-hatena-user"> <form class="gh-searchbox" method="get" action="/search_dwim" role="search"> <input value="" name="q" type="search" class="gh-inputtext" placeholder="キーワード・URLを検索" size="40" /> <input value="" type="submit" class="gh-search-button" /> </form> <ul class="gh-service-menu"> <li><a class="hotentry" data-gtm-label="gh-mypage" href="{{hotentry_url}}"><img src="{{user_image_url}}" class="header-profile-icon" width="16" height="16" alt="{{username}}" /></a><a class="hotentry" data-gtm-label="gh-mypage" href="{{hotentry_url}}">マイページ</a></li> <li><a class="bookmark" data-gtm-label="gh-bookmark" href="{{bookmark_url}}">ブックマーク</a></li> <li><a class="unread_bookmark" data-gtm-label="gh-ril" href="{{bookmark_stock_url}}">あとで読む</a></li> <li><a class="add" data-gtm-label="gh-add" href="{{add_bookmark_url}}">追加</a></li> <li><a class="tools" data-gtm-label="gh-tools" href="/guide/tools">ツール</a></li> <li><a class="config" data-gtm-label="gh-config" href="/-/my/config/profile">設定</a></li> <li><a class="feedback" data-gtm-label="gh-feedback" href="/-/feedback/hatena_bookmark" target="_blank">フィードバック</a></li> <li id="header-username" class="gh-dropdown-services" data-gtm-label="gh-services" title="利用中のサービス" data-name="{{username}}"> <span class="header-dropdown gh-dropdown" tabindex="0"> <img src="https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/images/v4/public/common/usermenu-wh.svg" alt="利用中のサービス" width="24" height="24" /> </span> <dl class="header-window" id="username-window"></dl> </li> <li id="header-notify" data-gtm-label="gh-notify" class="gh-dropdown-notify" title="あなたへのお知らせ"> <span class="header-dropdown gh-dropdown" tabindex="0"> <img src="https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/images/v4/public/common/notify-wh.svg" alt="あなたへのお知らせ" width="25" height="25" /> <span class="notify-count"></span> </span> <div id="notify-window" class="header-window header-notify"></div> </li> <li class="gh-hatena-logo"><a href="http://www.hatena.ne.jp/"><img src="https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/images/v4/public/logo/logo-global-white.svg" alt="Hatena" width="74px" height="13px"/></a></li> </ul> </script> </div> </header> <div id="info-header"><div id="info-header-message"></div><span></span></div> <div class="global-notification is-hidden js-global-notification"></div> <div id="container"> <div class="entrysearch-searchbox"> <form class="entrysearch-searchbox-body js-entrysearch-form" method="get"> <input value="CSRF" type="text" class="entrysearch-searchbox-textInput js-entrysearch-form-text-input" size="40" aria-label="検索キーワードを入力"> <input value="tag" name="target" type="hidden"> <input value="popular" name="sort" type="hidden"> <input value="3" name="users" type="hidden"> <input value="on" name="safe" type="hidden"> <input value="検索" type="submit" class="entrysearch-searchbox-btn js-entrysearch-form-button" aria-label="検索"> </form> </div> <div class="centerarticle-wrapper"> <div class="left-container"> <div class="centerarticle-sidebar-menu"> <h3 class="centerarticle-aside-title">検索対象</h3> <ul class="centerarticle-sub-navi"> <li><a href="/q/CSRF?date_range=5y&safe=on&users=3&target=all&sort=popular" >すべて</a></li> <li><a href="/q/CSRF?date_range=5y&safe=on&target=tag&users=3&sort=popular" class="is-current">タグ</a></li> <li><a href="/q/CSRF?sort=popular&target=title&users=3&date_range=5y&safe=on" >タイトル</a></li> <li><a href="/q/CSRF?sort=popular&users=3&target=text&date_range=5y&safe=on" >本文</a></li> </ul> </div> <div class="centerarticle-sidebar-menu"> <h3 class="centerarticle-aside-title">並び順</h3> <ul class="centerarticle-sub-navi"> <li><a href="/q/CSRF?sort=recent&safe=on&date_range=5y&users=3&target=tag" >新着</a></li> <li><a href="/q/CSRF?sort=popular&users=3&target=tag&date_range=5y&safe=on" class="is-current">人気</a></li> </ul> </div> <div class="centerarticle-sidebar-menu"> <h3 class="centerarticle-aside-title">ブックマーク数</h3> <ul class="centerarticle-sub-navi"> <li><a href="/q/CSRF?date_range=5y&safe=on&users=1&target=tag&sort=popular" >1 user</a></li> <li><a href="/q/CSRF?target=tag&users=3&safe=on&date_range=5y&sort=popular" class="is-current">3 users</a></li> <li><a href="/q/CSRF?target=tag&users=50&date_range=5y&safe=on&sort=popular" >50 users</a></li> <li><a href="/q/CSRF?date_range=5y&safe=on&users=100&target=tag&sort=popular" >100 users</a></li> <li><a href="/q/CSRF?sort=popular&target=tag&users=500&date_range=5y&safe=on" >500 users</a></li> </ul> </div> <div class="centerarticle-sidebar-menu js-safe-search-div is-hidden" title="セーフサーチはログイン時にのみoffにできます"> <h3 class="centerarticle-aside-title">セーフサーチ</h3> <ul class="centerarticle-sub-navi"> <li><a href="/q/CSRF?target=tag&users=3&date_range=5y&safe=on&sort=popular" class="is-current">オン</a></li> <li><a href="/q/CSRF?users=3&target=tag&date_range=5y&safe=off&sort=popular" >オフ</a></li> </ul> </div> <div class="centerarticle-sidebar-menu js-entrysearch-date"> <h3 class="centerarticle-aside-title">期間指定</h3> <ul class="centerarticle-sub-navi"> <li><a href="/q/CSRF?sort=popular&date_range=all&safe=on&users=3&target=tag" >すべて</a></li> <li><a href="/q/CSRF?sort=popular&date_range=w&safe=on&users=3&target=tag" >1週間</a></li> <li><a href="/q/CSRF?date_range=m&safe=on&users=3&target=tag&sort=popular" >1ヶ月</a></li> <li><a href="/q/CSRF?safe=on&date_range=y&target=tag&users=3&sort=popular" >1年</a></li> </ul> <form method="get" class="js-entrysearch-datepicker-form"> <input value="CSRF" class="js-entrysearch-form-text-input" type="hidden"> <input value="tag" name="target" type="hidden"> <input value="popular" name="sort" type="hidden"> <input value="3" name="users" type="hidden"> <input value="on" name="safe" type="hidden"> <ul class="centerarticle-sub-navi"> <li><input class="js-entrysearch-datepicker-start entrysearch-searchbox-dateInput" value="" type="text" name="date_begin"> から</li> <li><input class="js-entrysearch-datepicker-end entrysearch-searchbox-dateInput" value="" type="text" name="date_end"> まで</li> <li><input value="検索" type="submit" class="entrysearch-searchbox-btn js-entrysearch-form-button"><li> </ul> </form> </div> </div> <div class="entrysearch-bar"> <p class="entrysearch-bar-results">1 - 40 件 / 42件</p> <div class="entrysearch-bar-inner"> <button class="entrysearch-filter-btn js-entrysearch-filter-btn">絞り込み</button> <a class="entrysearch-sort-btn" href="/q/CSRF?safe=on&date_range=5y&users=3&target=tag&sort=popular">新着順</a> <a class="entrysearch-sort-btn is-current" href="/q/CSRF?safe=on&date_range=5y&target=tag&users=3&sort=recent">人気順</a> </div> </div> <div class="entrysearch-filter js-entrysearch-filter is-hidden"> <div class="entrysearch-filter-header"> <h2 class="entrysearch-filter-title">絞り込み</h2> <button class="entrysearch-filter-close js-entrysearch-filter-close"></button> </div> <ul class="entrysearch-filter-list"> <li class="entrysearch-filter-item js-entrysearch-target-dropdown"> <h3 class="entrysearch-filter-item-head">検索対象</h3> <div class="entrysearch-filter-item-value-wrapper"> <select class="entrysearch-filter-item-value js-entrysearch-filter-target"> <option value="all" >すべて</option> <option value="tag" selected>タグ</option> <option value="title" >タイトル</option> <option value="text" >本文</option> </select> </div> </li> <li class="entrysearch-filter-item"> <h3 class="entrysearch-filter-item-head">ブックマーク数</h3> <div class="entrysearch-filter-item-value-wrapper"> <select class="entrysearch-filter-item-value js-entrysearch-filter-users"> <option value="1" >1 user</option> <option value="3" selected>3 users</option> <option value="50" >50 users</option> <option value="100" >100 users</option> <option value="500" >500 users</option> </select> </div> </li> <li class="entrysearch-filter-item"> <h3 class="entrysearch-filter-item-head">期間</h3> <div class="entrysearch-filter-item-value-wrapper"> <select class="entrysearch-filter-item-value js-entrysearch-filter-daterange"> <option value="all">すべて</option> <option value="w" >1週間</option> <option value="m" >1ヶ月</option> <option value="y" >1年</option> </select> </div> </li> <li class="entrysearch-filter-item js-safe-search-div is-hidden"> <h3 class="entrysearch-filter-item-head">セーフサーチ</h3> <div class="entrysearch-filter-checkbox"> <input type="checkbox" name="safesearch" id="safesearch" class="js-entryseach-safesearch" checked> <label class="entrysearch-filter-checkbox-label" for="safesearch"></label> </div> </li> </ul> <div class="entrysearch-filter-footer"> <button class="entrysearch-filter-search-btn styleguide-btn-primary js-entrysearch-filter-search-btn">検索する</button> <button class="entrysearch-filter-clear-btn styleguide-btn-text js-entrysearch-filter-clear-btn">条件をクリアする</button> </div> </div> <div class="search-container"> <h2 class="entrysearch-title"> <span class="entrysearch-word">CSRFの検索結果</span><span class="entrysearch-result">1 - 40 件 / 42件</span> </h2> <div class="entrysearch-summary-text"> <span>CSRF</span>に関するエントリは<span>42</span>件あります。 <span>security</span>、 <span>セキュリティ</span>、 <span>web</span> などが関連タグです。人気エントリには <span>『SPAのログイン認証のベストプラクティスがわからなかったのでわりと網羅的に研究してみた〜JWT or Session どっち？〜 - Qiita』</span>などがあります。 </div> <div class="entrysearch-related-entries" data-gtm-inview-label="entry-search-recommend-header"> <h3 class="entrysearch-related-title">CSRFの関連エントリー</h3> <ul class="entrysearch-related-list"> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://blog.tokumaru.org/2022/01/impact-conditions-for-no-CSRF-protection-sites.html" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/666b09907e8274d7b8ef9a91aab8619d1baca7cc/height=288;version=1;width=512/https%3A%2F%2Fblogger.googleusercontent.com%2Fimg%2Fa%2FAVvXsEj-CHeyb2JYlSTXJojwcQePbvce4q5Fe7XrVgWdjBv3CIHY0IgvqwSiyleEr8x8KuaDIQdDRr3NFl_83K8BmDALDwaFh9nguZc-Puvj_bZOHQx7s8HPNO9L1fMHXTTewXEG4_z5WK3VEZePG8GVZSZN4Apz06Vt1blLBwSkjZaQ-TGGN0lKIAuJlw%3Dw1200-h630-p-k-no-nu" alt="2022年1月においてCSRF未対策のサイトはどの条件で被害を受けるか"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://blog.tokumaru.org/2022/01/impact-conditions-for-no-CSRF-protection-sites.html" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-title"> 2022年1月においてCSRF未対策のサイトはどの条件で被害を受けるか </a> </h4> <a href="/entry/s/blog.tokumaru.org/2022/01/impact-conditions-for-no-CSRF-protection-sites.html" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-header-c-users"> 338 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://blog.flatt.tech/entry/samesite_csrf_hsts" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/2fcf401f0befd85ac6a6271346eafcce778cce4f/height=288;version=1;width=512/https%3A%2F%2Fcdn.image.st-hatena.com%2Fimage%2Fscale%2Fccf3d529b43499532bd9fb859af653f0fc9d3a76%2Fbackend%3Dimagemagick%3Bversion%3D1%3Bwidth%3D1300%2Fhttps%253A%252F%252Fcdn-ak.f.st-hatena.com%252Fimages%252Ffotolife%252Ff%252Fflattsecurity%252F20240126%252F20240126175227.png" alt="SameSite属性とCSRFとHSTS - Cookieの基礎知識からブラウザごとのエッジケースまでおさらいする - Flatt Security Blog"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://blog.flatt.tech/entry/samesite_csrf_hsts" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-title"> SameSite属性とCSRFとHSTS - Cookieの基礎知識からブラウザごとのエッジケースまでおさらいする - Flatt Security Blog </a> </h4> <a href="/entry/s/blog.flatt.tech/entry/samesite_csrf_hsts" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-header-c-users"> 203 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://fujiten3.hatenablog.com/entry/2019/07/13/130459" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/af2abc4ae4b50e99dd8391544424181caa45d6a6/height=288;version=1;width=512/https%3A%2F%2Fogimage.blog.st-hatena.com%2F17680117126989340948%2F17680117127217518878%2F1658794935" alt="SPAでのログイン認証とCSRF対策の実装(JWT使用) - Web備忘録"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://fujiten3.hatenablog.com/entry/2019/07/13/130459" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-title"> SPAでのログイン認証とCSRF対策の実装(JWT使用) - Web備忘録 </a> </h4> <a href="/entry/s/fujiten3.hatenablog.com/entry/2019/07/13/130459" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-header-c-users"> 8 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://ritou.hatenablog.com/entry/2020/04/20/010230" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/87cc78ca18760c013858b1f1cf1882f762267383/height=288;version=1;width=512/https%3A%2F%2Fcdn.image.st-hatena.com%2Fimage%2Fscale%2Fd63f9a7741d707e7084a3cde5863ef0fa1923cef%2Fbackend%3Dimagemagick%3Bversion%3D1%3Bwidth%3D1300%2Fhttps%253A%252F%252Fcdn-ak.f.st-hatena.com%252Fimages%252Ffotolife%252Fr%252Fritou%252F20200419%252F20200419022241.png" alt="ID連携におけるCSRF対策のチェック方法 - r-weblife"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://ritou.hatenablog.com/entry/2020/04/20/010230" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-title"> ID連携におけるCSRF対策のチェック方法 - r-weblife </a> </h4> <a href="/entry/s/ritou.hatenablog.com/entry/2020/04/20/010230" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-header-c-users"> 6 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://www.three-wise-monkeys.com/entry/2024/02/22/080000" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/64be82ea1cc411c24bb93901383f86ee7c622f1d/height=288;version=1;width=512/https%3A%2F%2Fcdn.image.st-hatena.com%2Fimage%2Fscale%2F9a9b050ac8985784c6eda6e725161b15ad5b69bd%2Fbackend%3Dimagemagick%3Bversion%3D1%3Bwidth%3D1300%2Fhttps%253A%252F%252Fcdn.user.blog.st-hatena.com%252Fdefault_entry_og_image%252F155736664%252F1585286924755700" alt="クロスサイトリクエストフォージェリ（ＣＳＲＦ）：気になる情報セキュリティ用語 - 叡智の三猿"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://www.three-wise-monkeys.com/entry/2024/02/22/080000" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-title"> クロスサイトリクエストフォージェリ（ＣＳＲＦ）：気になる情報セキュリティ用語 - 叡智の三猿 </a> </h4> <a href="/entry/s/www.three-wise-monkeys.com/entry/2024/02/22/080000" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-header-c-users"> 6 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://tech.nri-net.com/entry/easily_implement_csrf_countermeasures_with_spring_security" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/c9ef3b16cb018cf4bf2e7d79fde6881fe3ccc6cf/height=288;version=1;width=512/https%3A%2F%2Fcdn.image.st-hatena.com%2Fimage%2Fscale%2Fc82737a3afd911ce2546fa917e13402d0d01b088%2Fbackend%3Dimagemagick%3Bversion%3D1%3Bwidth%3D1300%2Fhttps%253A%252F%252Fcdn-ak.f.st-hatena.com%252Fimages%252Ffotolife%252Fm%252Fm2-kamimura%252F20231204%252F20231204092457.png" alt="Spring Securityで簡単にCSRF対策ができる - NRIネットコムBlog"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://tech.nri-net.com/entry/easily_implement_csrf_countermeasures_with_spring_security" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-title"> Spring Securityで簡単にCSRF対策ができる - NRIネットコムBlog </a> </h4> <a href="/entry/s/tech.nri-net.com/entry/easily_implement_csrf_countermeasures_with_spring_security" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-header-c-users"> 4 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://infosecwriteups.com/easy-csrf-bypass-7226b4e3593e" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/af083a3ba1a99b77cfd1c7b68f8aafa927145685/height=288;version=1;width=512/https%3A%2F%2Fmiro.medium.com%2Fv2%2Fresize%3Afit%3A1016%2F1%2ADX-jNmq46_kFTuS5yqGwKg.png" alt="Easy CSRF bypass"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://infosecwriteups.com/easy-csrf-bypass-7226b4e3593e" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-title"> Easy CSRF bypass </a> </h4> <a href="/entry/s/infosecwriteups.com/easy-csrf-bypass-7226b4e3593e" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-header-c-users"> 4 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://blog.turai.work/entry/20230325/1679743158" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/373497036397c5c1fd08e5acacece81dc2bf6cb2/height=288;version=1;width=512/https%3A%2F%2Fogimage.blog.st-hatena.com%2F11696248318757044978%2F4207112889974778378%2F1679743227" alt="Next.jsでCSRF対策を簡単に実装する方法 - 動かざることバグの如し"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://blog.turai.work/entry/20230325/1679743158" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-header-c-title"> Next.jsでCSRF対策を簡単に実装する方法 - 動かざることバグの如し </a> </h4> <a href="/entry/s/blog.turai.work/entry/20230325/1679743158" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-header-c-users"> 3 users </a> </div> </li> </ul> </div> <ul class="entrysearch-articles"> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://qiita.com/Hiro-mi/items/18e00060a0f8654f49d6"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://qiita.com/Hiro-mi/items/18e00060a0f8654f49d6" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fqiita.com%2FHiro-mi%2Fitems%2F18e00060a0f8654f49d6" alt="">SPAのログイン認証のベストプラクティスがわからなかったのでわりと網羅的に研究してみた〜JWT or Session どっち？〜 - Qiita </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/qiita.com/Hiro-mi/items/18e00060a0f8654f49d6" class="js-keyboard-entry-page-openable" title="SPAのログイン認証のベストプラクティスがわからなかったのでわりと網羅的に研究してみた〜JWT or Session どっち？〜 - Qiita (649 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 649 users </a> </span> </li> <li> <a href="/site/qiita.com/Hiro-mi" title="『qiita.com/Hiro-mi』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> qiita.com/Hiro-mi </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2020/04/24</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">SPAのログイン周りについて、「これがベストプラクティスだ！」という情報があまり見当たらないので、様々な可能性を模索してみました。いろいろな状況が想定され、今回記載する内容に考慮の漏れや不備などがありましたら是非コメントでご指摘いただきたいです！特に「おすすめ度：○」と記載しているものに対しての批判をどしどしお待ちしております！この記事でおすすめしているものであっても、ご自身の責任で十分な検討・検証の上で選択されてください。前提想定しているAPIは、ログイン外のAPIにはPOST/PUT/DELETEのものがなく、GETのみ GETのAPIにはDBを更新するなどの操作がないとし、そのためログイン外ではCSRFを考慮しなくてよい、という前提で話を進めます。また、XSSに関しては常に対策は必要なのですが（フレームワーク側が自動的にしてくれる部分もある）、認証周りに関係すること以</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/%E8%AA%8D%E8%A8%BC" data-gtm-click-label="entry-search-result-item-tag">認証</a></li> <li><a href="/q/JWT" data-gtm-click-label="entry-search-result-item-tag">JWT</a></li> <li><a href="/q/SPA" data-gtm-click-label="entry-search-result-item-tag">SPA</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/javascript" data-gtm-click-label="entry-search-result-item-tag">javascript</a></li> <li><a href="/q/Cookie" data-gtm-click-label="entry-search-result-item-tag">Cookie</a></li> <li><a href="/q/api" data-gtm-click-label="entry-search-result-item-tag">api</a></li> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://qiita.com/Hiro-mi/items/18e00060a0f8654f49d6"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://qiita.com/Hiro-mi/items/18e00060a0f8654f49d6" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/597486a82b1a0bc1f10cf74d2e4640ff3ace0765/height=288;version=1;width=512/https%3A%2F%2Fqiita-user-contents.imgix.net%2Fhttps%253A%252F%252Fqiita-user-contents.imgix.net%252Fhttps%25253A%25252F%25252Fcdn.qiita.com%25252Fassets%25252Fpublic%25252Farticle-ogp-background-afbab5eb44e0b055cce1258705637a91.png%253Fixlib%253Drb-4.0.0%2526w%253D1200%2526blend64%253DaHR0cHM6Ly9xaWl0YS11c2VyLXByb2ZpbGUtaW1hZ2VzLmltZ2l4Lm5ldC9odHRwcyUzQSUyRiUyRnFpaXRhLWltYWdlLXN0b3JlLnMzLmFwLW5vcnRoZWFzdC0xLmFtYXpvbmF3cy5jb20lMkYwJTJGMjM2NDcyJTJGcHJvZmlsZS1pbWFnZXMlMkYxNTg3NTU1OTAzP2l4bGliPXJiLTQuMC4wJmFyPTElM0ExJmZpdD1jcm9wJm1hc2s9ZWxsaXBzZSZmbT1wbmczMiZzPWZlZWZmYjRkYWM0YjdhOGUwMDI0ZmFiYzUxOWJjYjNl%2526blend-x%253D120%2526blend-y%253D467%2526blend-w%253D82%2526blend-h%253D82%2526blend-mode%253Dnormal%2526s%253D6a8342f804c4b6d59bae42cfb9b40336%3Fixlib%3Drb-4.0.0%26w%3D1200%26fm%3Djpg%26mark64%3DaHR0cHM6Ly9xaWl0YS11c2VyLWNvbnRlbnRzLmltZ2l4Lm5ldC9-dGV4dD9peGxpYj1yYi00LjAuMCZ3PTk2MCZoPTMyNCZ0eHQ9U1BBJUUzJTgxJUFFJUUzJTgzJUFEJUUzJTgyJUIwJUUzJTgyJUE0JUUzJTgzJUIzJUU4JUFBJThEJUU4JUE4JUJDJUUzJTgxJUFFJUUzJTgzJTk5JUUzJTgyJUI5JUUzJTgzJTg4JUUzJTgzJTk3JUUzJTgzJUE5JUUzJTgyJUFGJUUzJTgzJTg2JUUzJTgyJUEzJUUzJTgyJUI5JUUzJTgxJThDJUUzJTgyJThGJUUzJTgxJThCJUUzJTgyJTg5JUUzJTgxJUFBJUUzJTgxJThCJUUzJTgxJUEzJUUzJTgxJTlGJUUzJTgxJUFFJUUzJTgxJUE3JUUzJTgyJThGJUUzJTgyJThBJUUzJTgxJUE4JUU3JUI2JUIyJUU3JUJFJTg1JUU3JTlBJTg0JUUzJTgxJUFCJUU3JUEwJTk0JUU3JUE5JUI2JUUzJTgxJTk3JUUzJTgxJUE2JUUzJTgxJUJGJUUzJTgxJTlGJUUzJTgwJTlDSldUJTIwb3IlMjBTZSVFMiU4MCVBNiZ0eHQtYWxpZ249bGVmdCUyQ3RvcCZ0eHQtY29sb3I9JTIzMUUyMTIxJnR4dC1mb250PUhpcmFnaW5vJTIwU2FucyUyMFc2JnR4dC1zaXplPTU2JnR4dC1wYWQ9MCZzPWUwYWY4YTUwMmU0NjU0OTZmYzQ1Y2QyZDE5NjYyNmQ3%26mark-x%3D120%26mark-y%3D112%26blend64%3DaHR0cHM6Ly9xaWl0YS11c2VyLWNvbnRlbnRzLmltZ2l4Lm5ldC9-dGV4dD9peGxpYj1yYi00LjAuMCZ3PTgzOCZoPTU4JnR4dD0lNDBIaXJvLW1pJnR4dC1jb2xvcj0lMjMxRTIxMjEmdHh0LWZvbnQ9SGlyYWdpbm8lMjBTYW5zJTIwVzYmdHh0LXNpemU9MzYmdHh0LXBhZD0wJnM9NmE1MDVhODdkYjMzOWY4NWQ1MmRhZDFlZjhkNzM3Yjc%26blend-x%3D242%26blend-y%3D480%26blend-w%3D838%26blend-h%3D46%26blend-fit%3Dcrop%26blend-crop%3Dleft%252Cbottom%26blend-mode%3Dnormal%26s%3D5a8b65cc9ff25a6f9c567e4231c44335" alt="SPAのログイン認証のベストプラクティスがわからなかったのでわりと網羅的に研究してみた〜JWT or Session どっち？〜 - Qiita" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://www.slideshare.net/slideshow/phpconf2021spasecurity/250357376"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://www.slideshare.net/slideshow/phpconf2021spasecurity/250357376" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fwww.slideshare.net%2Fslideshow%2Fphpconf2021spasecurity%2F250357376" alt="">SPAセキュリティ入門～PHP Conference Japan 2021 </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/www.slideshare.net/slideshow/phpconf2021spasecurity/250357376" class="js-keyboard-entry-page-openable" title="SPAセキュリティ入門～PHP Conference Japan 2021 (557 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 557 users </a> </span> </li> <li> <a href="/site/www.slideshare.net/slideshow" title="『www.slideshare.net/slideshow』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> www.slideshare.net/slideshow </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2021/10/03</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">2. 徳丸浩の自己紹介 • 経歴 – 1985年京セラ株式会社入社 – 1995年京セラコミュニケーションシステム株式会社(KCCS)に出向・転籍 – 2008年 KCCS退職、HASHコンサルティング株式会社(現社名:EGセキュアソリューションズ株式会社)設立 • 経験したこと – 京セラ入社当時はCAD、計算幾何学、数値シミュレーションなどを担当 – その後、企業向けパッケージソフトの企画・開発・事業化を担当 – 1999年から、携帯電話向けインフラ、プラットフォームの企画・開発を担当 Webアプリケーションのセキュリティ問題に直面、研究、社内展開、寄稿などを開始 – 2004年にKCCS社内ベンチャーとしてWebアプリケーションセキュリティ事業を立ち上げ • 現在 – EGセキュアソリューションズ株式会社取締役CTO https://www.eg-secure.co.jp/ –</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/SPA" data-gtm-click-label="entry-search-result-item-tag">SPA</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/JWT" data-gtm-click-label="entry-search-result-item-tag">JWT</a></li> <li><a href="/q/php" data-gtm-click-label="entry-search-result-item-tag">php</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> <li><a href="/q/%E5%BE%B3%E4%B8%B8" data-gtm-click-label="entry-search-result-item-tag">徳丸</a></li> <li><a href="/q/javascript" data-gtm-click-label="entry-search-result-item-tag">javascript</a></li> <li><a href="/q/CORS" data-gtm-click-label="entry-search-result-item-tag">CORS</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://www.slideshare.net/slideshow/phpconf2021spasecurity/250357376"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://www.slideshare.net/slideshow/phpconf2021spasecurity/250357376" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/2c7edd1930e08fd482ec5be551f4fcf09adf1774/height=288;version=1;width=512/https%3A%2F%2Fcdn.slidesharecdn.com%2Fss_thumbnails%2Fphpconf2021-211003053717-thumbnail.jpg%3Fwidth%3D640%26height%3D640%26fit%3Dbounds" alt="SPAセキュリティ入門～PHP Conference Japan 2021" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://blog.jxck.io/entries/2024-04-26/csrf.html"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://blog.jxck.io/entries/2024-04-26/csrf.html" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fblog.jxck.io%2Fentries%2F2024-04-26%2Fcsrf.html" alt="">令和時代の API 実装のベースプラクティスと CSRF 対策 | blog.jxck.io </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/blog.jxck.io/entries/2024-04-26/csrf.html" class="js-keyboard-entry-page-openable" title="令和時代の API 実装のベースプラクティスと CSRF 対策 | blog.jxck.io (551 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 551 users </a> </span> </li> <li> <a href="/site/blog.jxck.io/" title="『blog.jxck.io』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> blog.jxck.io </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2024/04/26</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">Intro CSRF という古の攻撃がある。この攻撃を「古(いにしえ)」のものにすることができたプラットフォームの進化の背景を、「Cookie が SameSite Lax by Default になったからだ」という解説を見ることがある。確かに、現実的にそれによって攻撃の成立は難しくなり、救われているサービスもある。しかし、それはプラットフォームが用意した対策の本質から言うと、解釈が少しずれていると言えるだろう。今回は、「CSRF がどうして成立していたのか」を振り返ることで、本当にプラットフォームに足りていなかったものと、それを補っていった経緯、本当にすべき対策は何であるかを解説していく。結果として見えてくるのは、今サービスを実装する上での「ベース」(not ベスト)となるプラクティスだと筆者は考えている。 CSRF 成立の条件例えば、攻撃者が用意した attack.examp</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/api" data-gtm-click-label="entry-search-result-item-tag">api</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/cookie" data-gtm-click-label="entry-search-result-item-tag">cookie</a></li> <li><a href="/q/xss" data-gtm-click-label="entry-search-result-item-tag">xss</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> <li><a href="/q/%E9%96%8B%E7%99%BA" data-gtm-click-label="entry-search-result-item-tag">開発</a></li> <li><a href="/q/%E3%83%97%E3%83%AD%E3%82%B0%E3%83%A9%E3%83%9F%E3%83%B3%E3%82%B0" data-gtm-click-label="entry-search-result-item-tag">プログラミング</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://blog.jxck.io/entries/2024-04-26/csrf.html"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://blog.jxck.io/entries/2024-04-26/csrf.html" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/25f705929f7e98ea08f049f3c57b5de57a1b3ba0/height=288;version=1;width=512/https%3A%2F%2Fblog.jxck.io%2Fassets%2Fimg%2Fjxck.600x600.png" alt="令和時代の API 実装のベースプラクティスと CSRF 対策 | blog.jxck.io" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://zenn.dev/qnighy/articles/6ff23c47018380"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://zenn.dev/qnighy/articles/6ff23c47018380" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fzenn.dev%2Fqnighy%2Farticles%2F6ff23c47018380" alt="">CORSの仕様はなぜ複雑なのか </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/zenn.dev/qnighy/articles/6ff23c47018380" class="js-keyboard-entry-page-openable" title="CORSの仕様はなぜ複雑なのか (523 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 523 users </a> </span> </li> <li> <a href="/site/zenn.dev/qnighy" title="『zenn.dev/qnighy』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> zenn.dev/qnighy </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2021/07/31</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">Webアプリケーションを実装していると高確率で CORS の問題にぶつかります。CORSがどのようなものかはリンクしたMDNなど既存の解説を読むのが手っ取り早いと思いますが、「なぜそのように設計されたのか」という観点での説明はあまり見ないため、昔の資料の記述や現在の仕様からの推測をもとに整理してみました。 CORSとは現代のWebはドメイン名をもとにしたオリジン (Origin) という概念 (RFC 6454) をもとに権限管理とアクセス制御を行っています。その基本となるのが以下のルールです。 Same-origin policy (同一生成元ポリシー): 同じオリジンに由来するリソースだけを制御できる。上記Wikipedia記事によるとSOPの概念は1995年のNetscape 2.02に導入されたのが最初のようです。当時のドキュメンテーションを読む限り、これはウインドウ越しに別</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CORS" data-gtm-click-label="entry-search-result-item-tag">CORS</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> <li><a href="/q/javascript" data-gtm-click-label="entry-search-result-item-tag">javascript</a></li> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/http" data-gtm-click-label="entry-search-result-item-tag">http</a></li> <li><a href="/q/%E3%82%B5%E3%83%BC%E3%83%90" data-gtm-click-label="entry-search-result-item-tag">サーバ</a></li> <li><a href="/q/%E4%BB%95%E6%A7%98" data-gtm-click-label="entry-search-result-item-tag">仕様</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://zenn.dev/qnighy/articles/6ff23c47018380"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://zenn.dev/qnighy/articles/6ff23c47018380" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/ec6fbcba3cb36e49983cbb0eb1735c72edaf989d/height=288;version=1;width=512/https%3A%2F%2Fres.cloudinary.com%2Fzenn%2Fimage%2Fupload%2Fs--s71BKIOb--%2Fc_fit%252Cg_north_west%252Cl_text%3Anotosansjp-medium.otf_55%3ACORS%2525E3%252581%2525AE%2525E4%2525BB%252595%2525E6%2525A7%252598%2525E3%252581%2525AF%2525E3%252581%2525AA%2525E3%252581%25259C%2525E8%2525A4%252587%2525E9%25259B%252591%2525E3%252581%2525AA%2525E3%252581%2525AE%2525E3%252581%25258B%252Cw_1010%252Cx_90%252Cy_100%2Fg_south_west%252Cl_text%3Anotosansjp-medium.otf_37%3AMasaki%252520Hara%252Cx_203%252Cy_121%2Fg_south_west%252Ch_90%252Cl_fetch%3AaHR0cHM6Ly9saDMuZ29vZ2xldXNlcmNvbnRlbnQuY29tL2EtL0FPaDE0R2l3aEI4dTM5cFZyM09sWVFLcUU5Z1ozV2d3MHlsMS03cUZad0huYWc9czI1MC1j%252Cr_max%252Cw_90%252Cx_87%252Cy_95%2Fv1627283836%2Fdefault%2Fog-base-w1200-v2.png" alt="CORSの仕様はなぜ複雑なのか" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <div class="related-entry-wrapper"> <div class="entrysearch-related-entries" data-gtm-inview-label="entry-search-recommend-middle"> <h3 class="entrysearch-related-title">CSRFの関連エントリー</h3> <ul class="entrysearch-related-list"> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://forest.watch.impress.co.jp/docs/serial/yajiuma/2002656.html" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/b55315b1bec10117f14a6f657b5a3059518c9a82/height=288;version=1;width=512/https%3A%2F%2Fforest.watch.impress.co.jp%2Fimg%2Fwf%2Flist%2F2002%2F656%2Fwindows11.jpg" alt="ローカルアカウントでWindows 11をセットアップする方法【令和7年最新版】／「BypassNRO.cmd」スクリプトに代わるシンプルなやり方が発見される【やじうまの杜】"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://forest.watch.impress.co.jp/docs/serial/yajiuma/2002656.html" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-title"> ローカルアカウントでWindows 11をセットアップする方法【令和7年最新版】／「BypassNRO.cmd」スクリプトに代わるシンプルなやり方が発見される【やじうまの杜】 </a> </h4> <a href="/entry/s/forest.watch.impress.co.jp/docs/serial/yajiuma/2002656.html" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-middle-users"> 770 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://anond.hatelabo.jp/20250401022054" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/b1638cdb5807a4788e4ba3c1109a984166e095fc/height=288;version=1;width=512/https%3A%2F%2Fanond.hatelabo.jp%2Fimages%2Fog-image-1500.gif" alt="年収900万のソフトウェアエンジニアなのだが相談に乗ってほしい"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://anond.hatelabo.jp/20250401022054" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-title"> 年収900万のソフトウェアエンジニアなのだが相談に乗ってほしい </a> </h4> <a href="/entry/s/anond.hatelabo.jp/20250401022054" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-middle-users"> 442 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://gigazine.net/news/20250401-doge-plans-to-rebuild-ssa-cobol-database/" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/b4304551269e85066b12781f9dbf76098408eaf3/height=288;version=1;width=512/https%3A%2F%2Fi.gzn.jp%2Fimg%2F2025%2F04%2F01%2Fdoge-plans-to-rebuild-ssa-cobol-database%2F00_m.jpg" alt="イーロン・マスク率いるDOGEが6000万行ものCOBOLコードを含む社会保障局のシステムをコード生成AIでわずか数カ月の内に移行させようとしており危険性が指摘されている"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://gigazine.net/news/20250401-doge-plans-to-rebuild-ssa-cobol-database/" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-title"> イーロン・マスク率いるDOGEが6000万行ものCOBOLコードを含む社会保障局のシステムをコード生成AIでわずか数カ月の内に移行させようとしており危険性が指摘されている </a> </h4> <a href="/entry/s/gigazine.net/news/20250401-doge-plans-to-rebuild-ssa-cobol-database/" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-middle-users"> 644 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://speakerdeck.com/ymdkit/ge-ren-kai-fa-desheng-huo-suruyouninarumade" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/f2f3f1e4534cb6889ed9f7cbfddcf0dadf2381cb/height=288;version=1;width=512/https%3A%2F%2Ffiles.speakerdeck.com%2Fpresentations%2Fd91f7fb654654c7a84c5e9fb405061cd%2Fslide_0.jpg%3F34471817" alt="個人開発で生活するようになるまで"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://speakerdeck.com/ymdkit/ge-ren-kai-fa-desheng-huo-suruyouninarumade" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-title"> 個人開発で生活するようになるまで </a> </h4> <a href="/entry/s/speakerdeck.com/ymdkit/ge-ren-kai-fa-desheng-huo-suruyouninarumade" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-middle-users"> 76 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://trilltrill.jp/articles/4065698" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/ed2a5ef9ec0088f1610c1ee87419adbdd447e15c/height=288;version=1;width=512/https%3A%2F%2Fmedia.trilltrill.jp%2Farticles%2F4065698%2Fcover-image.d458a09d54fd49dae96a6b36ebd97bb1%3Fw%3D1200" alt="ハンバーガー店で「イヤホンなしでの動画視聴は禁止」投稿に賛否わかれる。親からは「子どもに見せたくて…」 | TRILL【トリル】"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://trilltrill.jp/articles/4065698" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-title"> ハンバーガー店で「イヤホンなしでの動画視聴は禁止」投稿に賛否わかれる。親からは「子どもに見せたくて…」 | TRILL【トリル】 </a> </h4> <a href="/entry/s/trilltrill.jp/articles/4065698" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-middle-users"> 222 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://ascii.jp/elem/000/004/260/4260618/" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/0b291ad9c6ee10199416d69043a01bab4cbaf78c/height=288;version=1;width=512/https%3A%2F%2Fascii.jp%2Fimg%2F2025%2F04%2F01%2F4185870%2Fxl%2Fbfd263735e465871.png%3F20200122" alt="サードウェーブがGALLERIAに対する不当な営業妨害を報告"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://ascii.jp/elem/000/004/260/4260618/" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-title"> サードウェーブがGALLERIAに対する不当な営業妨害を報告 </a> </h4> <a href="/entry/s/ascii.jp/elem/000/004/260/4260618/" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-middle-users"> 47 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://speakerdeck.com/nasuvitz/aikodeinguezientomian-qiang-hui" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/05a7c7189ebaf8f276d26a47546daf5c2243a909/height=288;version=1;width=512/https%3A%2F%2Ffiles.speakerdeck.com%2Fpresentations%2F954177edff6f4b5f82933da77ce9a7f4%2Fslide_0.jpg%3F34484300" alt="AIコーディングエージェント勉強会"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://speakerdeck.com/nasuvitz/aikodeinguezientomian-qiang-hui" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-title"> AIコーディングエージェント勉強会 </a> </h4> <a href="/entry/s/speakerdeck.com/nasuvitz/aikodeinguezientomian-qiang-hui" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-middle-users"> 600 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://forest.watch.impress.co.jp/docs/news/2003084.html" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/685281a4a3e164fd135cb4b5424f83940410b5ac/height=288;version=1;width=512/https%3A%2F%2Fforest.watch.impress.co.jp%2Fimg%2Fwf%2Flist%2F2003%2F084%2Fimage5.png" alt="新世代の「PowerToys Run」を搭載した「PowerToys 0.90」が公開／［Windows］＋［Alt］＋［Space］キーで起動。拡張性・速度・ビジュアルを磨く"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://forest.watch.impress.co.jp/docs/news/2003084.html" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-title"> 新世代の「PowerToys Run」を搭載した「PowerToys 0.90」が公開／［Windows］＋［Alt］＋［Space］キーで起動。拡張性・速度・ビジュアルを磨く </a> </h4> <a href="/entry/s/forest.watch.impress.co.jp/docs/news/2003084.html" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-middle-users"> 29 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://nowokay.hatenablog.com/entry/2025/04/01/144553" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/be843eeea7887ec7f7b5556afe35966d8d8a9645/height=288;version=1;width=512/https%3A%2F%2Fcdn.image.st-hatena.com%2Fimage%2Fscale%2Fe2dfcbb6a076b394ed97a4944537c9ba1031971b%2Fbackend%3Dimagemagick%3Bversion%3D1%3Bwidth%3D1300%2Fhttps%253A%252F%252Fm.media-amazon.com%252Fimages%252FI%252F41QzPmq0MEL._SL500_.jpg" alt="「生成AI」の成り立ちと流れの雑なまとめ - きしだのHatena"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://nowokay.hatenablog.com/entry/2025/04/01/144553" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-title"> 「生成AI」の成り立ちと流れの雑なまとめ - きしだのHatena </a> </h4> <a href="/entry/s/nowokay.hatenablog.com/entry/2025/04/01/144553" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-middle-users"> 26 users </a> </div> </li> <li class="entrysearch-related-listitem"> <div class="entrysearch-related-entry"> <a href="https://www.yasuhisay.info/entry/2025/03/31/230212" class="entrysearch-related-image" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-image"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/7080727bd86de27a5403d2df76b86511a5f573c3/height=288;version=1;width=512/https%3A%2F%2Fogimage.blog.st-hatena.com%2F12704591929890344785%2F6802418398340541728%2F1743429732" alt="ジュニアエンジニアからシニアエンジニアになるまでに自分がやっていたことまとめ - yasuhisa's blog"> </a> <h4 class="entrysearch-related-entry-title"> <a href="https://www.yasuhisay.info/entry/2025/03/31/230212" target="_blank" rel="noopener" data-gtm-click-label="entry-search-recommend-middle-title"> ジュニアエンジニアからシニアエンジニアになるまでに自分がやっていたことまとめ - yasuhisa's blog </a> </h4> <a href="/entry/s/www.yasuhisay.info/entry/2025/03/31/230212" class="entrysearch-related-users" data-gtm-click-label="entry-search-recommend-middle-users"> 265 users </a> </div> </li> </ul> </div> </div> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://speakerdeck.com/hiro_y/update-your-knowledge-of-csrf-protection"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://speakerdeck.com/hiro_y/update-your-knowledge-of-csrf-protection" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fspeakerdeck.com%2Fhiro_y%2Fupdate-your-knowledge-of-csrf-protection" alt="">CSRF対策のやり方、そろそろアップデートしませんか / Update your knowledge of CSRF protection </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/speakerdeck.com/hiro_y/update-your-knowledge-of-csrf-protection" class="js-keyboard-entry-page-openable" title="CSRF対策のやり方、そろそろアップデートしませんか / Update your knowledge of CSRF protection (453 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 453 users </a> </span> </li> <li> <a href="/site/speakerdeck.com/hiro_y" title="『speakerdeck.com/hiro_y』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> speakerdeck.com/hiro_y </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2024/03/09</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">PHPerKaigi 2024 • Day 1での登壇資料です。 https://phperkaigi.jp/2024/ https://fortee.jp/phperkaigi-2024/proposal/0d0f8507-0a53-46f6-bca6-23386d78f17f ※ Author…</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> <li><a href="/q/%E8%B3%87%E6%96%99" data-gtm-click-label="entry-search-result-item-tag">資料</a></li> <li><a href="/q/%E3%82%B9%E3%83%A9%E3%82%A4%E3%83%89" data-gtm-click-label="entry-search-result-item-tag">スライド</a></li> <li><a href="/q/web%E3%82%B5%E3%83%BC%E3%83%93%E3%82%B9" data-gtm-click-label="entry-search-result-item-tag">webサービス</a></li> <li><a href="/q/web%E5%88%B6%E4%BD%9C" data-gtm-click-label="entry-search-result-item-tag">web制作</a></li> <li><a href="/q/development" data-gtm-click-label="entry-search-result-item-tag">development</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://speakerdeck.com/hiro_y/update-your-knowledge-of-csrf-protection"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://speakerdeck.com/hiro_y/update-your-knowledge-of-csrf-protection" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/16941b80c8ebaf4eb666f4fc7709aea8dcca2b34/height=288;version=1;width=512/https%3A%2F%2Ffiles.speakerdeck.com%2Fpresentations%2F3b096a2496354773a9e2a6184240db8b%2Fslide_0.jpg%3F29217169" alt="CSRF対策のやり方、そろそろアップデートしませんか / Update your knowledge of CSRF protection" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://speakerdeck.com/akiym/websekiyuriteinoarukikata"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://speakerdeck.com/akiym/websekiyuriteinoarukikata" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fspeakerdeck.com%2Fakiym%2Fwebsekiyuriteinoarukikata" alt="">Webセキュリティのあるきかた </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/speakerdeck.com/akiym/websekiyuriteinoarukikata" class="js-keyboard-entry-page-openable" title="Webセキュリティのあるきかた (430 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 430 users </a> </span> </li> <li> <a href="/site/speakerdeck.com/akiym" title="『speakerdeck.com/akiym』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> speakerdeck.com/akiym </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2024/10/05</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">2024/10/5 YAPC::Hakodate 2024</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> <li><a href="/q/web%E3%82%B5%E3%83%BC%E3%83%93%E3%82%B9" data-gtm-click-label="entry-search-result-item-tag">webサービス</a></li> <li><a href="/q/slide" data-gtm-click-label="entry-search-result-item-tag">slide</a></li> <li><a href="/q/XSS" data-gtm-click-label="entry-search-result-item-tag">XSS</a></li> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/%E8%B3%87%E6%96%99" data-gtm-click-label="entry-search-result-item-tag">資料</a></li> <li><a href="/q/YAPC" data-gtm-click-label="entry-search-result-item-tag">YAPC</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://speakerdeck.com/akiym/websekiyuriteinoarukikata"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://speakerdeck.com/akiym/websekiyuriteinoarukikata" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/1d3e3f5fdaedae24f26199e10c78429d6c4d2c15/height=288;version=1;width=512/https%3A%2F%2Ffiles.speakerdeck.com%2Fpresentations%2F473aa98452d344609d90c9f8269f833a%2Fslide_0.jpg%3F32023668" alt="Webセキュリティのあるきかた" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://coliss.com/articles/build-websites/operation/work/cs-visualized-cors.html"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://coliss.com/articles/build-websites/operation/work/cs-visualized-cors.html" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fcoliss.com%2Farticles%2Fbuild-websites%2Foperation%2Fwork%2Fcs-visualized-cors.html" alt="">CORSの仕組みをGIFアニメで分かりやすく解説 </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/coliss.com/articles/build-websites/operation/work/cs-visualized-cors.html" class="js-keyboard-entry-page-openable" title="CORSの仕組みをGIFアニメで分かりやすく解説 (360 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 360 users </a> </span> </li> <li> <a href="/site/coliss.com/" title="『coliss.com』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> coliss.com </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2020/08/20</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">クロスオリジンのリクエストを安全にするための同一生成元ポリシーとオリジン間のリソース共有（CORS）の仕組みをGIFアニメで解説した記事を紹介します。 ✋🏼🔥 CS Visualized: CORS by Lydia Hallie 下記は各ポイントを意訳したものです。 ※当ブログでの翻訳記事は、元サイト様にライセンスを得て翻訳しています。はじめに ✋🏼同一生成元ポリシー（Same-Origin Policy）とは 🔥クライアントサイドのCORS 💻サーバーサイドのCORS 🚀プリフライトリクエスト（Preflighted Requests） 🍪認証はじめに「Access to fetched to fetched has been blocked by CORS policy error」と赤い文字がコンソールに表示されると、デベロッパーなら誰でもフラストレーションが</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CORS" data-gtm-click-label="entry-search-result-item-tag">CORS</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/HTTP" data-gtm-click-label="entry-search-result-item-tag">HTTP</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/%E3%82%B5%E3%83%BC%E3%83%90" data-gtm-click-label="entry-search-result-item-tag">サーバ</a></li> <li><a href="/q/%E3%83%96%E3%83%A9%E3%82%A6%E3%82%B6" data-gtm-click-label="entry-search-result-item-tag">ブラウザ</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> <li><a href="/q/API" data-gtm-click-label="entry-search-result-item-tag">API</a></li> <li><a href="/q/%E3%83%95%E3%83%AD%E3%83%B3%E3%83%88%E3%82%A8%E3%83%B3%E3%83%89" data-gtm-click-label="entry-search-result-item-tag">フロントエンド</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://coliss.com/articles/build-websites/operation/work/cs-visualized-cors.html"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://coliss.com/articles/build-websites/operation/work/cs-visualized-cors.html" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/4af0928cbe9c63961a24163909b32100c834c6bd/height=288;version=1;width=512/https%3A%2F%2Fcoliss.com%2Fwp-content%2Fuploads-202003%2F2020080801.png" alt="CORSの仕組みをGIFアニメで分かりやすく解説" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://zenn.dev/jxck/scraps/704a507575a7d2"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://zenn.dev/jxck/scraps/704a507575a7d2" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fzenn.dev%2Fjxck%2Fscraps%2F704a507575a7d2" alt="">CSRF 対策はいまだに Token が必須なのか? </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/zenn.dev/jxck/scraps/704a507575a7d2" class="js-keyboard-entry-page-openable" title="CSRF 対策はいまだに Token が必須なのか? (339 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 339 users </a> </span> </li> <li> <a href="/site/zenn.dev/jxck" title="『zenn.dev/jxck』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> zenn.dev/jxck </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2024/01/18</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">CSRF 対策は One Time Token を form なりに付与して、サーバ側でチェックすれば良い。それをデフォルトでサポートしてるフレームワークなどもあるし、なくてもライブラリでいくらでも対応できる。どうせ完全にステートレスなサービスはなかなかないので、サーバ側に redis や memcache を用意するのも別に大変じゃない。なので、 CSRF 対策として Token を付与するのは、最も安全で推奨できる方式ではある。っていうのを踏まえた上で、もう SameSite=Lax デフォルトだけど、今でも Token 必須なの？みたいなのがたびたび話に出るので、いい加減まとめる。前提この話は、スコープがどこなのかによって話が多少変わるので、そこを絞る。今回は Passive ではなく Active に対策していく場合を考えるので、前提をこうする。 SameSite=l</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/cookie" data-gtm-click-label="entry-search-result-item-tag">cookie</a></li> <li><a href="/q/xss" data-gtm-click-label="entry-search-result-item-tag">xss</a></li> <li><a href="/q/web%E3%82%B5%E3%83%BC%E3%83%93%E3%82%B9" data-gtm-click-label="entry-search-result-item-tag">webサービス</a></li> <li><a href="/q/programming" data-gtm-click-label="entry-search-result-item-tag">programming</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://zenn.dev/jxck/scraps/704a507575a7d2"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://zenn.dev/jxck/scraps/704a507575a7d2" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/83ae214d2f37b48df6da6fe273f501eb64bee988/height=288;version=1;width=512/https%3A%2F%2Flh3.googleusercontent.com%2Fa-%2FAOh14GiYWcGd4gB9v8-s4u6zRPInb2exCWf9tGGfQ-MD9A%3Ds250-c" alt="CSRF 対策はいまだに Token が必須なのか?" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://blog.tokumaru.org/2022/01/impact-conditions-for-no-CSRF-protection-sites.html"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://blog.tokumaru.org/2022/01/impact-conditions-for-no-CSRF-protection-sites.html" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fblog.tokumaru.org%2F2022%2F01%2Fimpact-conditions-for-no-CSRF-protection-sites.html" alt="">2022年1月においてCSRF未対策のサイトはどの条件で被害を受けるか </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/blog.tokumaru.org/2022/01/impact-conditions-for-no-CSRF-protection-sites.html" class="js-keyboard-entry-page-openable" title="2022年1月においてCSRF未対策のサイトはどの条件で被害を受けるか (338 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 338 users </a> </span> </li> <li> <a href="/site/blog.tokumaru.org/" title="『blog.tokumaru.org』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> blog.tokumaru.org </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2022/01/26</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">サマリ2020年2月にGoogle ChromeはCookieのデフォルトの挙動をsamesite=laxに変更しましたが、2022年1月11日にFirefoxも同様の仕様が導入されました。この変更はブラウザ側でCSRF脆弱性を緩和するためのもので、特定の条件下では、ウェブサイト側でCSRF対策をしていなくてもCSRF攻撃を受けなくなります。この記事では、デフォルトsamesite=laxについての基礎的な説明に加え、最近のブラウザの挙動の違いについて説明します。（2022年1月29日追記）本日確認したところ、Firefoxにおけるデフォルトsamesite=laxはキャンセルされ、従来の挙動に戻ったようです（Firefox 96.0.3にて確認）。デフォルトsamesite=lax自体は先行してGoogle Chromeにて実装されていましたが、細かい挙動の差異で既存サイトに不具合が</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/cookie" data-gtm-click-label="entry-search-result-item-tag">cookie</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/browser" data-gtm-click-label="entry-search-result-item-tag">browser</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/chrome" data-gtm-click-label="entry-search-result-item-tag">chrome</a></li> <li><a href="/q/%E3%83%96%E3%83%A9%E3%82%A6%E3%82%B6" data-gtm-click-label="entry-search-result-item-tag">ブラウザ</a></li> <li><a href="/q/firefox" data-gtm-click-label="entry-search-result-item-tag">firefox</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://blog.tokumaru.org/2022/01/impact-conditions-for-no-CSRF-protection-sites.html"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://blog.tokumaru.org/2022/01/impact-conditions-for-no-CSRF-protection-sites.html" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/666b09907e8274d7b8ef9a91aab8619d1baca7cc/height=288;version=1;width=512/https%3A%2F%2Fblogger.googleusercontent.com%2Fimg%2Fa%2FAVvXsEj-CHeyb2JYlSTXJojwcQePbvce4q5Fe7XrVgWdjBv3CIHY0IgvqwSiyleEr8x8KuaDIQdDRr3NFl_83K8BmDALDwaFh9nguZc-Puvj_bZOHQx7s8HPNO9L1fMHXTTewXEG4_z5WK3VEZePG8GVZSZN4Apz06Vt1blLBwSkjZaQ-TGGN0lKIAuJlw%3Dw1200-h630-p-k-no-nu" alt="2022年1月においてCSRF未対策のサイトはどの条件で被害を受けるか" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://tech.basicinc.jp/articles/231"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://tech.basicinc.jp/articles/231" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Ftech.basicinc.jp%2Farticles%2F231" alt="">今時の CSRF 対策ってなにをすればいいの？ | Basicinc Enjoy Hacking! </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/tech.basicinc.jp/articles/231" class="js-keyboard-entry-page-openable" title="今時の CSRF 対策ってなにをすればいいの？ | Basicinc Enjoy Hacking! (319 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 319 users </a> </span> </li> <li> <a href="/site/tech.basicinc.jp/" title="『tech.basicinc.jp』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> tech.basicinc.jp </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2022/08/27</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">こんにちは @zaru です。今回は昔からある CSRF (クロスサイト・リクエスト・フォージェリ) の今時の対策についてまとめてみました。もし、記事中に間違いがあれば @zaru まで DM もしくはメンションをください (セキュリティの細かい部分についての理解が乏しい…) 。 2022/08/29 : 徳丸さんからフィードバック頂いた内容を反映しました。徳丸さん、ありがとうございます！認証あり・なしで対策方法が違う点トークン確認方式のデメリットのクロスドメインについての言及を削除、代わりに Cookie 改変リスクを追記 Cookie 改ざん可能性について徳丸さんの動画リンクを追記 SameSite 属性で防げない具体的なケースを追記 nginx 説明が関係なかったので削除そもそも CSRF ってなに？昔からインターネットをやっている方であれば「ぼくはまちちゃん」騒動と言えば</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/%E3%82%B5%E3%83%BC%E3%83%90" data-gtm-click-label="entry-search-result-item-tag">サーバ</a></li> <li><a href="/q/Cookie" data-gtm-click-label="entry-search-result-item-tag">Cookie</a></li> <li><a href="/q/%E3%82%A4%E3%83%B3%E3%83%95%E3%83%A9" data-gtm-click-label="entry-search-result-item-tag">インフラ</a></li> <li><a href="/q/server" data-gtm-click-label="entry-search-result-item-tag">server</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://tech.basicinc.jp/articles/231"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://tech.basicinc.jp/articles/231" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/597bb3a17cc5ce62cf307c51754837955ce30ab4/height=288;version=1;width=512/https%3A%2F%2Ftech.basicinc.jp%2Fuploads%2Ffe2fc7662cb94cbfe2693ee4df97f310.jpeg" alt="今時の CSRF 対策ってなにをすればいいの？ | Basicinc Enjoy Hacking!" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://www.m3tech.blog/entry/2023/06/13/110000"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://www.m3tech.blog/entry/2023/06/13/110000" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fwww.m3tech.blog%2Fentry%2F2023%2F06%2F13%2F110000" alt="">セキュリティヘッダ警察です！既に包囲されている！観念してヘッダを挿入しなさい！ - エムスリーテックブログ </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/www.m3tech.blog/entry/2023/06/13/110000" class="js-keyboard-entry-page-openable" title="セキュリティヘッダ警察です！既に包囲されている！観念してヘッダを挿入しなさい！ - エムスリーテックブログ (315 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 315 users </a> </span> </li> <li> <a href="/site/www.m3tech.blog/" title="『www.m3tech.blog』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> www.m3tech.blog </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2023/06/13</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">【セキュリティチームブログリレー2回目】こんにちは。エンジニアリンググループの山本です。セキュリティチームは、エンジニアリンググループ全体のセキュリティを向上させるためのバーチャルチームなのですが、各プロダクト開発チームのサービスをチェックして、協力しながら全体のセキュリティを向上させていくのがミッションです。そのお仕事の一環として「この部分、セキュリティヘッダが足りないから入れてください！」というやりとりを日常的に行なっています。今日はこの「セキュリティヘッダ」というものが一体何なのか、今さら人に聞けないアレコレを取りまとめてみたいと思います。セキュリティヘッダ警察の日常の図(もちろん冗談です) セキュリティヘッダそもそもセキュリティヘッダとは？比較的安全なセキュリティヘッダ X-Content-Type-Options X-XSS-Protection Strict-Tr</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/http" data-gtm-click-label="entry-search-result-item-tag">http</a></li> <li><a href="/q/%E3%83%96%E3%83%A9%E3%82%A6%E3%82%B6" data-gtm-click-label="entry-search-result-item-tag">ブラウザ</a></li> <li><a href="/q/cookie" data-gtm-click-label="entry-search-result-item-tag">cookie</a></li> <li><a href="/q/%E3%83%98%E3%83%83%E3%83%80" data-gtm-click-label="entry-search-result-item-tag">ヘッダ</a></li> <li><a href="/q/browser" data-gtm-click-label="entry-search-result-item-tag">browser</a></li> <li><a href="/q/xss" data-gtm-click-label="entry-search-result-item-tag">xss</a></li> <li><a href="/q/%E8%B3%87%E6%96%99" data-gtm-click-label="entry-search-result-item-tag">資料</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://www.m3tech.blog/entry/2023/06/13/110000"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://www.m3tech.blog/entry/2023/06/13/110000" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/6dfb4037fa88aae12aecde50b76e35c95f449174/height=288;version=1;width=512/https%3A%2F%2Fcdn.image.st-hatena.com%2Fimage%2Fscale%2Ff43ffd29ccc51e155f8f00dd52f8e3021c224085%2Fbackend%3Dimagemagick%3Bversion%3D1%3Bwidth%3D1300%2Fhttps%253A%252F%252Fcdn-ak.f.st-hatena.com%252Fimages%252Ffotolife%252Fa%252Fatzy-yama%252F20230608%252F20230608194123.png" alt="セキュリティヘッダ警察です！既に包囲されている！観念してヘッダを挿入しなさい！ - エムスリーテックブログ" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://debiru.hatenablog.com/entry/20220412/value-domain-hijack"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://debiru.hatenablog.com/entry/20220412/value-domain-hijack" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fdebiru.hatenablog.com%2Fentry%2F20220412%2Fvalue-domain-hijack" alt="">VALUE-DOMAIN に存在していた2種類のドメインハイジャック脆弱性について - debiruはてなメモ </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/debiru.hatenablog.com/entry/20220412/value-domain-hijack" class="js-keyboard-entry-page-openable" title="VALUE-DOMAIN に存在していた2種類のドメインハイジャック脆弱性について - debiruはてなメモ (250 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 250 users </a> </span> </li> <li> <a href="/site/debiru.hatenablog.com/" title="『debiru.hatenablog.com』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> debiru.hatenablog.com </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2022/04/12</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">2022年3月2日に確認した VALUE-DOMAIN でのサブドメインハイジャックが可能な脆弱性について経緯を説明します。ついでに2016年の記事「VALUE-DOMAIN に存在していたアカウント乗っ取り可能な CSRF 脆弱性について」の続報も含めて、この記事で2022年現在の VALUE-DOMAIN の状況についてお伝えします。脆弱性を2つ発見しました第一：子ゾーン作成によるサブドメインハイジャック第一の脆弱性の攻撃の原理 VALUE-DOMAIN のネームサーバについて第一の脆弱性発見後の経緯サブドメインハイジャック攻撃を受けた場合の影響第二：CSRF 攻撃によるドメインハイジャックドメインハイジャック攻撃を受けた場合の影響 CSRF 攻撃によるドメインハイジャックの対策状況 VALUE-DOMAIN ユーザの方へ脆弱性を2つ発見しました（第一）子ゾーン作</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/DNS" data-gtm-click-label="entry-search-result-item-tag">DNS</a></li> <li><a href="/q/%E3%83%89%E3%83%A1%E3%82%A4%E3%83%B3" data-gtm-click-label="entry-search-result-item-tag">ドメイン</a></li> <li><a href="/q/%E3%82%B5%E3%83%BC%E3%83%90" data-gtm-click-label="entry-search-result-item-tag">サーバ</a></li> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/%E3%83%88%E3%83%A9%E3%83%96%E3%83%AB" data-gtm-click-label="entry-search-result-item-tag">トラブル</a></li> <li><a href="/q/domain" data-gtm-click-label="entry-search-result-item-tag">domain</a></li> <li><a href="/q/web%E3%82%B5%E3%83%BC%E3%83%93%E3%82%B9" data-gtm-click-label="entry-search-result-item-tag">webサービス</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://debiru.hatenablog.com/entry/20220412/value-domain-hijack"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://debiru.hatenablog.com/entry/20220412/value-domain-hijack" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/1ef103e1ab4b1adcae80abde8cd5ddddb27d76b3/height=288;version=1;width=512/https%3A%2F%2Fogimage.blog.st-hatena.com%2F6653458415121634972%2F13574176438082250498%2F1649762630" alt="VALUE-DOMAIN に存在していた2種類のドメインハイジャック脆弱性について - debiruはてなメモ" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://mond.how/ja/topics/dhs73m5j82plm42/cfvqxylc4ppam77"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://mond.how/ja/topics/dhs73m5j82plm42/cfvqxylc4ppam77" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fmond.how%2Fja%2Ftopics%2Fdhs73m5j82plm42%2Fcfvqxylc4ppam77" alt="">SPAのアプリケーションで、外部のIdPを使ってOpenID Connect によるログイン機能を開発しようと考えています。IDトークンの保存先として、ブラウザのCookieかサーバーのDBに保存するかの2つの案があると思っています。調べた限り、サーバーサイドで持つべきという意見が多いように見えますが、以下のような背景がある中で開発しても、ブラウザのCookieでは持つべきなのではないのでしょうか？ - IDトークン自体にも、個人の属性（氏名等）情報は無いことを確認している - サーバーサイドでIDトーク </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/mond.how/ja/topics/dhs73m5j82plm42/cfvqxylc4ppam77" class="js-keyboard-entry-page-openable" title="SPAのアプリケーションで、外部のIdPを使ってOpenID Connect によるログイン機能を開発しようと考えています。IDトークンの保存先として、ブラウザのCookieかサーバーのDBに保存するかの2つの案があると思っています。調べた限り、サーバーサイドで持つべきという意見が多いように見えますが、以下のような背景がある中で開発しても、ブラウザのCookieでは持つべきなのではないのでしょうか？ - IDトークン自体にも、個人の属性（氏名等）情報は無いことを確認している - サーバーサイドでIDトーク (246 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 246 users </a> </span> </li> <li> <a href="/site/mond.how/" title="『mond.how』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> mond.how </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2024/06/03</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">SPAのアプリケーションで、外部のIdPを使ってOpenID Connect によるログイン機能を開発しようと考えています。IDトークンの保存先として、ブラウザのCookieかサーバーのDBに保存するかの2つの案があると思っています。調べた限り、サーバーサイドで持つべきという意見が多いように見えますが、以下のような背景がある中で開発しても、ブラウザのCookieでは持つべきなのではないのでしょうか？ - IDトークン自体にも、個人の属性（氏名等）情報は無いことを確認している - サーバーサイドでIDトークンの署名検証をして、IDトークンの改ざんが無いか確認する - Http Only属性：JSによるCookieへのアクセスを防ぐため - Secure属性：流出防止のため - SameSite=strict：CSRF対策のため結論から言えば、「どちらでもよい」となります。しかし、恐らく話は</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/%E9%96%8B%E7%99%BA" data-gtm-click-label="entry-search-result-item-tag">開発</a></li> <li><a href="/q/SPA" data-gtm-click-label="entry-search-result-item-tag">SPA</a></li> <li><a href="/q/%E8%AA%8D%E8%A8%BC" data-gtm-click-label="entry-search-result-item-tag">認証</a></li> <li><a href="/q/cookie" data-gtm-click-label="entry-search-result-item-tag">cookie</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/%E3%83%96%E3%83%A9%E3%82%A6%E3%82%B6" data-gtm-click-label="entry-search-result-item-tag">ブラウザ</a></li> <li><a href="/q/%E3%82%A2%E3%83%97%E3%83%AA%E3%82%B1%E3%83%BC%E3%82%B7%E3%83%A7%E3%83%B3" data-gtm-click-label="entry-search-result-item-tag">アプリケーション</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://mond.how/ja/topics/dhs73m5j82plm42/cfvqxylc4ppam77"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://mond.how/ja/topics/dhs73m5j82plm42/cfvqxylc4ppam77" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/e6a65634860a793260ea8f7694e5ca22af5a2086/height=288;version=1;width=512/https%3A%2F%2Fasia-northeast1-pjt-knowledge.cloudfunctions.net%2Fogp_image%3Fq%3Dt%3Adhs73m5j82plm42%3A58221a5186dbd250e8d345fd0ea90d1f14d68bf3%26v%3D3" alt="SPAのアプリケーションで、外部のIdPを使ってOpenID Connect によるログイン機能を開発しようと考えています。IDトークンの保存先として、ブラウザのCookieかサーバーのDBに保存するかの2つの案があると思っています。調べた限り、サーバーサイドで持つべきという意見が多いように見えますが、以下のような背景がある中で開発しても、ブラウザのCookieでは持つべきなのではないのでしょうか？ - IDトークン自体にも、個人の属性（氏名等）情報は無いことを確認している - サーバーサイドでIDトーク" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://zenn.dev/yktakaha4/articles/study_csrf_attack"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://zenn.dev/yktakaha4/articles/study_csrf_attack" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fzenn.dev%2Fyktakaha4%2Farticles%2Fstudy_csrf_attack" alt="">CSRF(Cross-Site Request Forgery)攻撃について </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/zenn.dev/yktakaha4/articles/study_csrf_attack" class="js-keyboard-entry-page-openable" title="CSRF(Cross-Site Request Forgery)攻撃について (228 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 228 users </a> </span> </li> <li> <a href="/site/zenn.dev/yktakaha4" title="『zenn.dev/yktakaha4』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> zenn.dev/yktakaha4 </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2022/10/31</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">ふと気になって調べたことの備忘メモです ✍ （2022/11/3追記）ご指摘頂いた内容を踏まえて加筆修正をおこないましたなぜ調べたか Webアプリケーションの開発に携わっていると CSRF という脆弱性への対処を求められますが、多くの場合利用しているフレームワークが設定追加だけで対応してくれたり、既に前任者によって適切な処置がされていたりなど、実務上で目を向ける機会はその重要性と比較して少ないのでないかと思いますまた、Webブラウザの実装やHTTP周辺の関連仕様の変化から陳腐化している情報も多く、現代において全体感と具体的な対処法を理解するには少しばかりハードルが高いように感じていましたですので、自身の現時点での認識を明文化して残しておくことにしましたなお、私はWebセキュリティの専門家でなく、一介の開発者のため、誤りが多分に含まれる可能性がありますご指摘を頂ければ修正したいと思</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/IPA" data-gtm-click-label="entry-search-result-item-tag">IPA</a></li> <li><a href="/q/HTTP" data-gtm-click-label="entry-search-result-item-tag">HTTP</a></li> <li><a href="/q/Website" data-gtm-click-label="entry-search-result-item-tag">Website</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> <li><a href="/q/Web%E3%82%B5%E3%83%BC%E3%83%93%E3%82%B9" data-gtm-click-label="entry-search-result-item-tag">Webサービス</a></li> <li><a href="/q/%E3%83%96%E3%83%A9%E3%82%A6%E3%82%B6" data-gtm-click-label="entry-search-result-item-tag">ブラウザ</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://zenn.dev/yktakaha4/articles/study_csrf_attack"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://zenn.dev/yktakaha4/articles/study_csrf_attack" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/94d7d2ed4d5d3b49bf01d1b5719b179fca627e7d/height=288;version=1;width=512/https%3A%2F%2Fres.cloudinary.com%2Fzenn%2Fimage%2Fupload%2Fs--Ja1XbkYI--%2Fc_fit%252Cg_north_west%252Cl_text%3Anotosansjp-medium.otf_55%3ACSRF%252528Cross-Site%252520Request%252520Forgery%252529%2525E6%252594%2525BB%2525E6%252592%252583%2525E3%252581%2525AB%2525E3%252581%2525A4%2525E3%252581%252584%2525E3%252581%2525A6%252Cw_1010%252Cx_90%252Cy_100%2Fg_south_west%252Cl_text%3Anotosansjp-medium.otf_37%3AYuuki%252520Takahashi%252Cx_203%252Cy_121%2Fg_south_west%252Ch_90%252Cl_fetch%3AaHR0cHM6Ly9saDMuZ29vZ2xldXNlcmNvbnRlbnQuY29tL2EtL0FPaDE0R2huMEtJWDdJZzVrRm9aVVlkai1yWDZfYk1UNDhEUXE5WE53YUVsPXMyNTAtYw%3D%3D%252Cr_max%252Cw_90%252Cx_87%252Cy_95%2Fv1627283836%2Fdefault%2Fog-base-w1200-v2.png" alt="CSRF(Cross-Site Request Forgery)攻撃について" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://blog.flatt.tech/entry/samesite_csrf_hsts"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://blog.flatt.tech/entry/samesite_csrf_hsts" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fblog.flatt.tech%2Fentry%2Fsamesite_csrf_hsts" alt="">SameSite属性とCSRFとHSTS - Cookieの基礎知識からブラウザごとのエッジケースまでおさらいする - Flatt Security Blog </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/blog.flatt.tech/entry/samesite_csrf_hsts" class="js-keyboard-entry-page-openable" title="SameSite属性とCSRFとHSTS - Cookieの基礎知識からブラウザごとのエッジケースまでおさらいする - Flatt Security Blog (203 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 203 users </a> </span> </li> <li> <a href="/site/blog.flatt.tech/" title="『blog.flatt.tech』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> blog.flatt.tech </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2024/01/31</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">こんにちは、 @okazu_dm です。この記事は、CookieのSameSite属性についての解説と、その中でも例外的な挙動についての解説記事です。サードパーティCookieやCSRF対策の文脈でCookieのSameSite属性に関してはご存知の方も多いと思います。本記事でCookieの基礎から最近のブラウザ上でのSameSite属性の扱いについて触れつつ、最終的にHSTS(HTTP Strict Transport Security)のような注意点を含めて振り返るのに役立てていただければと思います。前提条件 Cookieについて Cookieの属性について SameSite属性について SameSite属性に関する落とし穴 SameSite属性を指定しなかった場合の挙動 SameSite: Strictでも攻撃が成功するケース例1: スキームだけ違うケース例2: サブドメイ</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/cookie" data-gtm-click-label="entry-search-result-item-tag">cookie</a></li> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/%E3%83%96%E3%83%A9%E3%82%A6%E3%82%B6" data-gtm-click-label="entry-search-result-item-tag">ブラウザ</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> <li><a href="/q/HTTP" data-gtm-click-label="entry-search-result-item-tag">HTTP</a></li> <li><a href="/q/HSTS" data-gtm-click-label="entry-search-result-item-tag">HSTS</a></li> <li><a href="/q/browser" data-gtm-click-label="entry-search-result-item-tag">browser</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://blog.flatt.tech/entry/samesite_csrf_hsts"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://blog.flatt.tech/entry/samesite_csrf_hsts" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/2fcf401f0befd85ac6a6271346eafcce778cce4f/height=288;version=1;width=512/https%3A%2F%2Fcdn.image.st-hatena.com%2Fimage%2Fscale%2Fccf3d529b43499532bd9fb859af653f0fc9d3a76%2Fbackend%3Dimagemagick%3Bversion%3D1%3Bwidth%3D1300%2Fhttps%253A%252F%252Fcdn-ak.f.st-hatena.com%252Fimages%252Ffotolife%252Ff%252Fflattsecurity%252F20240126%252F20240126175227.png" alt="SameSite属性とCSRFとHSTS - Cookieの基礎知識からブラウザごとのエッジケースまでおさらいする - Flatt Security Blog" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://qiita.com/risto24/items/e449c5edf648020258fa"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://qiita.com/risto24/items/e449c5edf648020258fa" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fqiita.com%2Fristo24%2Fitems%2Fe449c5edf648020258fa" alt="">攻撃から学ぶCSRF対策 - Qiita </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/qiita.com/risto24/items/e449c5edf648020258fa" class="js-keyboard-entry-page-openable" title="攻撃から学ぶCSRF対策 - Qiita (181 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 181 users </a> </span> </li> <li> <a href="/site/qiita.com/risto24" title="『qiita.com/risto24』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> qiita.com/risto24 </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2020/07/03</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">はじめに WEBエンジニアとして成長するために、セキュリティ対策は避けては通れない道ですよね。僕も含め「なんとなく知ってる」という方は多いのではないでしょうか。大切なWEBサイトを守るためにも、WEBエンジニアとしての基礎を固める為にも、しっかりと学んで一緒にレベルアップしていきましょう。また、本記事の内容は様々な文献をもとに自身で調べ、試したものをまとめています。至らぬ点や、間違いがありましたら、コメントにてご指摘をお願いします。他にも様々な攻撃手法についてまとめているので、興味のある方は読んでみてください。攻撃から学ぶXSS対策攻撃から学ぶSQLインジェクション対策 CSRFって何？ CSRF（Cross-Site Request Forgery）とは、サービスの利用者に意図しないHTTPリクエストを送信させ、意図しない処理を実行させる攻撃手法です。これだけでは分か</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> <li><a href="/q/XSS" data-gtm-click-label="entry-search-result-item-tag">XSS</a></li> <li><a href="/q/cookie" data-gtm-click-label="entry-search-result-item-tag">cookie</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/qiita" data-gtm-click-label="entry-search-result-item-tag">qiita</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://qiita.com/risto24/items/e449c5edf648020258fa"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://qiita.com/risto24/items/e449c5edf648020258fa" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/6da863861f07606bb766a056fe20cb409e2e9b7f/height=288;version=1;width=512/https%3A%2F%2Fqiita-user-contents.imgix.net%2Fhttps%253A%252F%252Fcdn.qiita.com%252Fassets%252Fpublic%252Farticle-ogp-background-412672c5f0600ab9a64263b751f1bc81.png%3Fixlib%3Drb-4.0.0%26w%3D1200%26mark64%3DaHR0cHM6Ly9xaWl0YS11c2VyLWNvbnRlbnRzLmltZ2l4Lm5ldC9-dGV4dD9peGxpYj1yYi00LjAuMCZ3PTk3MiZoPTM3OCZ0eHQ9JUU2JTk0JUJCJUU2JTkyJTgzJUUzJTgxJThCJUUzJTgyJTg5JUU1JUFEJUE2JUUzJTgxJUI2Q1NSRiVFNSVBRiVCRSVFNyVBRCU5NiZ0eHQtYWxpZ249bGVmdCUyQ3RvcCZ0eHQtY29sb3I9JTIzMUUyMTIxJnR4dC1mb250PUhpcmFnaW5vJTIwU2FucyUyMFc2JnR4dC1zaXplPTU2JnM9YTlmOTZlZDM0NTRlYzdkMDRiYzc1ZDE5MTI0OTYyY2M%26mark-x%3D142%26mark-y%3D57%26blend64%3DaHR0cHM6Ly9xaWl0YS11c2VyLWNvbnRlbnRzLmltZ2l4Lm5ldC9-dGV4dD9peGxpYj1yYi00LjAuMCZoPTc2Jnc9NzcwJnR4dD0lNDByaXN0bzI0JnR4dC1jb2xvcj0lMjMxRTIxMjEmdHh0LWZvbnQ9SGlyYWdpbm8lMjBTYW5zJTIwVzYmdHh0LXNpemU9MzYmdHh0LWFsaWduPWxlZnQlMkN0b3Amcz01ZTBhNDUwZGViNzY1ZjFiNGFkY2M3MDM0YjBjZGU3Mw%26blend-x%3D142%26blend-y%3D486%26blend-mode%3Dnormal%26s%3Da15c8ce1e447744928071667799a3d23" alt="攻撃から学ぶCSRF対策 - Qiita" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://zenn.dev/yskn_sid25/articles/3008cf70c5a560"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://zenn.dev/yskn_sid25/articles/3008cf70c5a560" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fzenn.dev%2Fyskn_sid25%2Farticles%2F3008cf70c5a560" alt="">LaravelはどのようにCSRF対策をしているのか？ </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/zenn.dev/yskn_sid25/articles/3008cf70c5a560" class="js-keyboard-entry-page-openable" title="LaravelはどのようにCSRF対策をしているのか？ (130 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 130 users </a> </span> </li> <li> <a href="/site/zenn.dev/yskn_sid25" title="『zenn.dev/yskn_sid25』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> zenn.dev/yskn_sid25 </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2024/10/19</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">技術記事ははてなブログへお引越ししました。興味を持ってくださった方はZennではなくこちらをご購読いただければと思います🙏 誰しもLaravelのbladeでformを書くにあたって、@csrfという魔法の呪文を書いたことがあるかと思います。「これを書いておけばCSRF対策はOK」ドキュメントにも要約するとそういう旨が書いてあります。この記事では@csrfについてLaravelの実装を実際に見てみることで、CSRFとその対策への理解を深めたいと思います。ちなみにこの記事はぺちこん2024で残念ながら採択に至らなかったCfPの供養です。[1] 利用するサンプルアプリ @csrf はなにをしているのか？そもそもですが、@csrfが何をしているのかを見てみます。 bladeに@csrfを埋め込んだ場所を、HTML変換後の状態から見てみます。 <input type="hidde</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/Laravel" data-gtm-click-label="entry-search-result-item-tag">Laravel</a></li> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/php" data-gtm-click-label="entry-search-result-item-tag">php</a></li> <li><a href="/q/article" data-gtm-click-label="entry-search-result-item-tag">article</a></li> <li><a href="/q/web%E5%88%B6%E4%BD%9C" data-gtm-click-label="entry-search-result-item-tag">web制作</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://zenn.dev/yskn_sid25/articles/3008cf70c5a560"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://zenn.dev/yskn_sid25/articles/3008cf70c5a560" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/802f5aed5917e5ee6e754ebf65053c3876951183/height=288;version=1;width=512/https%3A%2F%2Fres.cloudinary.com%2Fzenn%2Fimage%2Fupload%2Fs--hM8D-rHP--%2Fc_fit%252Cg_north_west%252Cl_text%3Anotosansjp-medium.otf_55%3ALaravel%2525E3%252581%2525AF%2525E3%252581%2525A9%2525E3%252581%2525AE%2525E3%252582%252588%2525E3%252581%252586%2525E3%252581%2525ABCSRF%2525E5%2525AF%2525BE%2525E7%2525AD%252596%2525E3%252582%252592%2525E3%252581%252597%2525E3%252581%2525A6%2525E3%252581%252584%2525E3%252582%25258B%2525E3%252581%2525AE%2525E3%252581%25258B%2525EF%2525BC%25259F%252Cw_1010%252Cx_90%252Cy_100%2Fg_south_west%252Cl_text%3Anotosansjp-medium.otf_37%3AKanon%252Cx_203%252Cy_121%2Fg_south_west%252Ch_90%252Cl_fetch%3AaHR0cHM6Ly9zdG9yYWdlLmdvb2dsZWFwaXMuY29tL3plbm4tdXNlci11cGxvYWQvYXZhdGFyLzM1OTY4ZjJmNWUuanBlZw%3D%3D%252Cr_max%252Cw_90%252Cx_87%252Cy_95%2Fv1627283836%2Fdefault%2Fog-base-w1200-v2.png" alt="LaravelはどのようにCSRF対策をしているのか？" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry "> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://web.dev/articles/same-site-same-origin"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://web.dev/articles/same-site-same-origin" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fweb.dev%2Farticles%2Fsame-site-same-origin" alt="">"Same-site" and "same-origin" | Articles | web.dev </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/web.dev/articles/same-site-same-origin" class="js-keyboard-entry-page-openable" title=""Same-site" and "same-origin" | Articles | web.dev (88 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 88 users </a> </span> </li> <li> <a href="/site/web.dev/" title="『web.dev』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> web.dev </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2020/04/18</span></li> </ul> </div> <div class="centerarticle-entry-contents "> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">"Same-site" and "same-origin" are frequently cited but often misunderstood terms. For example, they're used in the context of page transitions, fetch() requests, cookies, opening popups, embedded resources, and iframes. This page explains what they are and how they're different from each other. Origin The structure of an origin. "Origin" is a combination of a scheme (also known as the protocol, fo</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/csrf" data-gtm-click-label="entry-search-result-item-tag">csrf</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/https" data-gtm-click-label="entry-search-result-item-tag">https</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/network" data-gtm-click-label="entry-search-result-item-tag">network</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/document" data-gtm-click-label="entry-search-result-item-tag">document</a></li> <li><a href="/q/tech" data-gtm-click-label="entry-search-result-item-tag">tech</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://web.dev/articles/same-site-same-origin"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://www.docswell.com/s/ockeghem/ZM6VNK-phpconf2021-spa-security"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://www.docswell.com/s/ockeghem/ZM6VNK-phpconf2021-spa-security" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fwww.docswell.com%2Fs%2Fockeghem%2FZM6VNK-phpconf2021-spa-security" alt="">SPAセキュリティ入門～PHP Conference Japan 2021 | ドクセル </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/www.docswell.com/s/ockeghem/ZM6VNK-phpconf2021-spa-security" class="js-keyboard-entry-page-openable" title="SPAセキュリティ入門～PHP Conference Japan 2021 | ドクセル (85 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 85 users </a> </span> </li> <li> <a href="/site/www.docswell.com/" title="『www.docswell.com』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> www.docswell.com </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2022/04/01</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">スライド概要シングルページアプリケーション(SPA)において、セッションIDやトークンの格納場所はCookieあるいはlocalStorageのいずれが良いのかなど、セキュリティ上の課題がネット上で議論されていますが、残念ながら間違った前提に基づくものが多いようです。このトークでは、SPAのセキュリティを構成する基礎技術を説明した後、著名なフレームワークな状況とエンジニアの技術理解の現状を踏まえ、SPAセキュリティの現実的な方法について説明します。動画はこちら https://www.youtube.com/watch?v=pc57hw6haXk</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/SPA" data-gtm-click-label="entry-search-result-item-tag">SPA</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/jwt" data-gtm-click-label="entry-search-result-item-tag">jwt</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/%E3%82%B5%E3%83%BC%E3%83%90" data-gtm-click-label="entry-search-result-item-tag">サーバ</a></li> <li><a href="/q/xss" data-gtm-click-label="entry-search-result-item-tag">xss</a></li> <li><a href="/q/cookie" data-gtm-click-label="entry-search-result-item-tag">cookie</a></li> <li><a href="/q/php" data-gtm-click-label="entry-search-result-item-tag">php</a></li> <li><a href="/q/HTTPS" data-gtm-click-label="entry-search-result-item-tag">HTTPS</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://www.docswell.com/s/ockeghem/ZM6VNK-phpconf2021-spa-security"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://www.docswell.com/s/ockeghem/ZM6VNK-phpconf2021-spa-security" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/e0c407ed61dee19cdd7a477fde891238bcf19945/height=288;version=1;width=512/https%3A%2F%2Fbcdn.docswell.com%2Fpage%2FGYE9Q59WE3.jpg%3Fwidth%3D480" alt="SPAセキュリティ入門～PHP Conference Japan 2021 | ドクセル" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://qiita.com/MIDO-ruby7/items/e4aecedf015356004981"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://qiita.com/MIDO-ruby7/items/e4aecedf015356004981" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fqiita.com%2FMIDO-ruby7%2Fitems%2Fe4aecedf015356004981" alt="">ドラえも⚫︎で理解するCSRF - Qiita </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/qiita.com/MIDO-ruby7/items/e4aecedf015356004981" class="js-keyboard-entry-page-openable" title="ドラえも⚫︎で理解するCSRF - Qiita (78 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 78 users </a> </span> </li> <li> <a href="/site/qiita.com/MIDO-ruby7" title="『qiita.com/MIDO-ruby7』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> qiita.com/MIDO-ruby7 </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2023/11/30</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article? ドラえも⚫︎で理解するCSRF はじめに ※コメントにて徳丸浩先生(@ockeghem)に間違いをいくつかご指摘頂き修正中です。また、@rudorufu1981様よりブラウザの同一オリジンポリシーについての補足を頂いております。ぜひ記事の下部、コメント欄までご覧頂きますようお願いいたします。ご指摘や補足、本当に有難うございます。【追記2023.12.2】同一オリジンポリシーの補足についても徳丸先生のご見解コメントを頂いております。ぜひそちらもご確認下さい。【追記2023.12.5】ご指摘を受けて同一オリジンポリシーはCSR</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/HTTP" data-gtm-click-label="entry-search-result-item-tag">HTTP</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/%E8%B3%87%E6%96%99" data-gtm-click-label="entry-search-result-item-tag">資料</a></li> <li><a href="/q/%E9%96%8B%E7%99%BA" data-gtm-click-label="entry-search-result-item-tag">開発</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://qiita.com/MIDO-ruby7/items/e4aecedf015356004981"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://qiita.com/MIDO-ruby7/items/e4aecedf015356004981" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/f258005a038b107d9471637eec27188432733b4d/height=288;version=1;width=512/https%3A%2F%2Fqiita-user-contents.imgix.net%2Fhttps%253A%252F%252Fqiita-user-contents.imgix.net%252Fhttps%25253A%25252F%25252Fcdn.qiita.com%25252Fassets%25252Fpublic%25252Farticle-ogp-background-afbab5eb44e0b055cce1258705637a91.png%253Fixlib%253Drb-4.0.0%2526w%253D1200%2526blend64%253DaHR0cHM6Ly9xaWl0YS11c2VyLXByb2ZpbGUtaW1hZ2VzLmltZ2l4Lm5ldC9odHRwcyUzQSUyRiUyRmF2YXRhcnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tJTJGdSUyRjExMTU1NzI5MiUzRnYlM0Q0P2l4bGliPXJiLTQuMC4wJmFyPTElM0ExJmZpdD1jcm9wJm1hc2s9ZWxsaXBzZSZmbT1wbmczMiZzPTIzZWJmYzViY2U4MmE2YTFmNmQ5ZGRhOTRmZDZjZmMw%2526blend-x%253D120%2526blend-y%253D467%2526blend-w%253D82%2526blend-h%253D82%2526blend-mode%253Dnormal%2526s%253D02db3a57fb0771c0bfff1c1cf64db038%3Fixlib%3Drb-4.0.0%26w%3D1200%26fm%3Djpg%26mark64%3DaHR0cHM6Ly9xaWl0YS11c2VyLWNvbnRlbnRzLmltZ2l4Lm5ldC9-dGV4dD9peGxpYj1yYi00LjAuMCZ3PTk2MCZoPTMyNCZ0eHQ9JUUzJTgzJTg5JUUzJTgzJUE5JUUzJTgxJTg4JUUzJTgyJTgyJUUyJTlBJUFCJUVGJUI4JThFJUUzJTgxJUE3JUU3JTkwJTg2JUU4JUE3JUEzJUUzJTgxJTk5JUUzJTgyJThCQ1NSRiZ0eHQtYWxpZ249bGVmdCUyQ3RvcCZ0eHQtY29sb3I9JTIzMUUyMTIxJnR4dC1mb250PUhpcmFnaW5vJTIwU2FucyUyMFc2JnR4dC1zaXplPTU2JnR4dC1wYWQ9MCZzPTgyMDljMWM1MDcwNjhhYWM2ZTJiYmUyMzgwMDZkMTkx%26mark-x%3D120%26mark-y%3D112%26blend64%3DaHR0cHM6Ly9xaWl0YS11c2VyLWNvbnRlbnRzLmltZ2l4Lm5ldC9-dGV4dD9peGxpYj1yYi00LjAuMCZ3PTgzOCZoPTU4JnR4dD0lNDBNSURPLXJ1Ynk3JnR4dC1jb2xvcj0lMjMxRTIxMjEmdHh0LWZvbnQ9SGlyYWdpbm8lMjBTYW5zJTIwVzYmdHh0LXNpemU9MzYmdHh0LXBhZD0wJnM9ZDQxZTBjOGZjZGYzNTlmZmY5MDczNTE2ZmJhYzVjYTY%26blend-x%3D242%26blend-y%3D480%26blend-w%3D838%26blend-h%3D46%26blend-fit%3Dcrop%26blend-crop%3Dleft%252Cbottom%26blend-mode%3Dnormal%26s%3Dffe07ed94fdf797e7e226d63856bebe0" alt="ドラえも⚫︎で理解するCSRF - Qiita" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://speakerdeck.com/masatokinugawa/security-dot-tokyo-number-3"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://speakerdeck.com/masatokinugawa/security-dot-tokyo-number-3" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fspeakerdeck.com%2Fmasatokinugawa%2Fsecurity-dot-tokyo-number-3" alt="">注目したいクライアントサイドの脆弱性2選/ Security.Tokyo #3 </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/speakerdeck.com/masatokinugawa/security-dot-tokyo-number-3" class="js-keyboard-entry-page-openable" title="注目したいクライアントサイドの脆弱性2選/ Security.Tokyo #3 (46 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 46 users </a> </span> </li> <li> <a href="/site/speakerdeck.com/masatokinugawa" title="『speakerdeck.com/masatokinugawa』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> speakerdeck.com/masatokinugawa </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2024/02/22</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">Security.Tokyo #3の発表資料です。クライアントサイドのパストラバーサルと、postMessage経由の脆弱性を取り上げました。</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/xss" data-gtm-click-label="entry-search-result-item-tag">xss</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/javascript" data-gtm-click-label="entry-search-result-item-tag">javascript</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://speakerdeck.com/masatokinugawa/security-dot-tokyo-number-3"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://speakerdeck.com/masatokinugawa/security-dot-tokyo-number-3" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/59455bed36acc223a76ef2a46743a8284a8c8d03/height=288;version=1;width=512/https%3A%2F%2Ffiles.speakerdeck.com%2Fpresentations%2Fc7836dd4449143b4ab61658bdda884e2%2Fslide_0.jpg%3F29440953" alt="注目したいクライアントサイドの脆弱性2選/ Security.Tokyo #3" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://blog.jxck.io/entries/2024-05-07/referrer-policy.html"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://blog.jxck.io/entries/2024-05-07/referrer-policy.html" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fblog.jxck.io%2Fentries%2F2024-05-07%2Freferrer-policy.html" alt="">Referrer-Policy の制限を強めると安全になるという誤解 | blog.jxck.io </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/blog.jxck.io/entries/2024-05-07/referrer-policy.html" class="js-keyboard-entry-page-openable" title="Referrer-Policy の制限を強めると安全になるという誤解 | blog.jxck.io (37 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 37 users </a> </span> </li> <li> <a href="/site/blog.jxck.io/" title="『blog.jxck.io』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> blog.jxck.io </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2024/05/08</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">Intro Referrer-Policy は、送信される Referer の値を制御することが可能だ。このヘッダの副次的な効果をよく理解していないと、「no-referrer にして送らないのが最も安全だ」という誤解を生むことになる。では、複数あるポリシーの中でどのような観点で、どのディレクティブを採用するのが良いのだろうか? 前提として前回の記事の「リクエストの出自をチェックすることは現代の実装のベースプラクティスである」という点を踏まえて考えてみる。令和時代の API 実装のベースプラクティスと CSRF 対策 | blog.jxck.io https://blog.jxck.io/entries/2024-04-26/csrf.html Referer とアナリティクス Referer は、リクエストに対してその前のページの URL を送るところから始まった。 GET / H</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/http" data-gtm-click-label="entry-search-result-item-tag">http</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/referer" data-gtm-click-label="entry-search-result-item-tag">referer</a></li> <li><a href="/q/browser" data-gtm-click-label="entry-search-result-item-tag">browser</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://blog.jxck.io/entries/2024-05-07/referrer-policy.html"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://blog.jxck.io/entries/2024-05-07/referrer-policy.html" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/25f705929f7e98ea08f049f3c57b5de57a1b3ba0/height=288;version=1;width=512/https%3A%2F%2Fblog.jxck.io%2Fassets%2Fimg%2Fjxck.600x600.png" alt="Referrer-Policy の制限を強めると安全になるという誤解 | blog.jxck.io" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://www.mbsd.jp/research/20220617/blog/"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://www.mbsd.jp/research/20220617/blog/" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fwww.mbsd.jp%2Fresearch%2F20220617%2Fblog%2F" alt="">検出例から学ぶクロスサイトリクエストフォージェリ | 技術者ブログ | 三井物産セキュアディレクション株式会社 </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/www.mbsd.jp/research/20220617/blog/" class="js-keyboard-entry-page-openable" title="検出例から学ぶクロスサイトリクエストフォージェリ | 技術者ブログ | 三井物産セキュアディレクション株式会社 (27 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 27 users </a> </span> </li> <li> <a href="/site/www.mbsd.jp/" title="『www.mbsd.jp』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> www.mbsd.jp </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2022/06/17</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">本サイトは、快適にご利用いただくためにクッキー（Cookie）を使用しております。 Cookieの使用に同意いただける場合は「同意する」ボタンを押してください。なお本サイトのCookie使用については、「個人情報保護方針」をご覧ください。</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/%E3%83%96%E3%83%A9%E3%82%A6%E3%82%B6" data-gtm-click-label="entry-search-result-item-tag">ブラウザ</a></li> <li><a href="/q/%E3%82%B5%E3%82%A4%E3%83%88" data-gtm-click-label="entry-search-result-item-tag">サイト</a></li> <li><a href="/q/Web" data-gtm-click-label="entry-search-result-item-tag">Web</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://www.mbsd.jp/research/20220617/blog/"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://www.mbsd.jp/research/20220617/blog/" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/9b887c3583b1f896d5a660a085071647a1177925/height=288;version=1;width=512/https%3A%2F%2Fwww.mbsd.jp%2F2022%2F06%2F17%2Fassets%2Fimages%2F20220617_thumb_csrf.jpg" alt="検出例から学ぶクロスサイトリクエストフォージェリ | 技術者ブログ | 三井物産セキュアディレクション株式会社" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry "> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://blog.vnaik.com/posts/web-attacks.html"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://blog.vnaik.com/posts/web-attacks.html" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fblog.vnaik.com%2Fposts%2Fweb-attacks.html" alt="">CSRF, CORS, and HTTP Security headers Demystified </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/blog.vnaik.com/posts/web-attacks.html" class="js-keyboard-entry-page-openable" title="CSRF, CORS, and HTTP Security headers Demystified (27 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 27 users </a> </span> </li> <li> <a href="/site/blog.vnaik.com/" title="『blog.vnaik.com』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> blog.vnaik.com </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2021/04/30</span></li> </ul> </div> <div class="centerarticle-entry-contents "> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">With an increasing number of breaches, intrusions, and data thefts, securing a web application is extremely important. On the other hand, programmers often do not have a strong grasp of how attacks work and how to mitigate them. This post attempts to close that gap a little. CSRF Cross-Site Request Forgery is an attack where a third party forces a user to execute actions against a site where they</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/http" data-gtm-click-label="entry-search-result-item-tag">http</a></li> <li><a href="/q/browser" data-gtm-click-label="entry-search-result-item-tag">browser</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://blog.vnaik.com/posts/web-attacks.html"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://www.docswell.com/s/MasatoshiTada/ZYWP29-spring-boot-security"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://www.docswell.com/s/MasatoshiTada/ZYWP29-spring-boot-security" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fwww.docswell.com%2Fs%2FMasatoshiTada%2FZYWP29-spring-boot-security" alt="">Webアプリケーションセキュリティの基礎とSpring Bootでの実装 #jjug_ccc #jjug_ccc_c | ドクセル </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/www.docswell.com/s/MasatoshiTada/ZYWP29-spring-boot-security" class="js-keyboard-entry-page-openable" title="Webアプリケーションセキュリティの基礎とSpring Bootでの実装 #jjug_ccc #jjug_ccc_c | ドクセル (23 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 23 users </a> </span> </li> <li> <a href="/site/www.docswell.com/" title="『www.docswell.com』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> www.docswell.com </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2024/06/16</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">スライド概要 JJUG CCC 2024 Springの発表資料です。 Webアプリケーションをクラッカーの攻撃から守るために様々な対策が求められます。例えばSQLインジェクション対策、CSRF対策、XSS対策、セッションID固定化対策などです。このセッションでは、これらの対策について基礎から解説したあと、Spring Bootでどのように実装するかを解説します。</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/development" data-gtm-click-label="entry-search-result-item-tag">development</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://www.docswell.com/s/MasatoshiTada/ZYWP29-spring-boot-security"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://www.docswell.com/s/MasatoshiTada/ZYWP29-spring-boot-security" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/bc36910b461ff1ab651434432c448efb88e0454c/height=288;version=1;width=512/https%3A%2F%2Fbcdn.docswell.com%2Fpage%2FY79WGDNZ73.jpg%3Fwidth%3D480" alt="Webアプリケーションセキュリティの基礎とSpring Bootでの実装 #jjug_ccc #jjug_ccc_c | ドクセル" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://scgajge12.hatenablog.com/entry/bugbounty_xss_escalation"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://scgajge12.hatenablog.com/entry/bugbounty_xss_escalation" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fscgajge12.hatenablog.com%2Fentry%2Fbugbounty_xss_escalation" alt="">バグバウンティにおける XSS の具体的な脅威の事例まとめ - blog of morioka12 </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/scgajge12.hatenablog.com/entry/bugbounty_xss_escalation" class="js-keyboard-entry-page-openable" title="バグバウンティにおける XSS の具体的な脅威の事例まとめ - blog of morioka12 (18 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 18 users </a> </span> </li> <li> <a href="/site/scgajge12.hatenablog.com/" title="『scgajge12.hatenablog.com』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> scgajge12.hatenablog.com </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2024/01/17</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">1. 始めにこんにちは、morioka12 です。本稿では、バグバウンティで実際にあった脆弱性報告の事例をもとに、XSS の具体的な脅威(Impact)についていくつか紹介します。 1. 始めに免責事項想定読者 2. XSS (Cross Site Scripting) HackerOne Top 10 Vulnerability Types Escalation (Goal) 3. XSS の脅威 (Impact) 3.1 Response Body から Session ID の奪取 3.2 Local Storage から Access Token の奪取 3.3 IndexedDB から Session Data の奪取 3.4 メールアドレスの改ざん 3.5 パスワードの改ざん 3.6 管理者アカウントの招待 3.7 POST Based Reflected XSS 4.</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/XSS" data-gtm-click-label="entry-search-result-item-tag">XSS</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> <li><a href="/q/%E3%83%90%E3%82%B0%E3%83%90%E3%82%A6%E3%83%B3%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">バグバウンティ</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://scgajge12.hatenablog.com/entry/bugbounty_xss_escalation"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://scgajge12.hatenablog.com/entry/bugbounty_xss_escalation" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/3121dd2ab9e8c283144a51ab66e896c890f9a5ea/height=288;version=1;width=512/https%3A%2F%2Fogimage.blog.st-hatena.com%2F17680117126979573192%2F820878482970833553%2F1716184514" alt="バグバウンティにおける XSS の具体的な脅威の事例まとめ - blog of morioka12" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://zenn.dev/leaner_dev/articles/20210930-rails-api-spa-csrf"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://zenn.dev/leaner_dev/articles/20210930-rails-api-spa-csrf" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fzenn.dev%2Fleaner_dev%2Farticles%2F20210930-rails-api-spa-csrf" alt="">Rails API + SPAのCSRF対策例 </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/zenn.dev/leaner_dev/articles/20210930-rails-api-spa-csrf" class="js-keyboard-entry-page-openable" title="Rails API + SPAのCSRF対策例 (15 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 15 users </a> </span> </li> <li> <a href="/site/zenn.dev/leaner_dev" title="『zenn.dev/leaner_dev』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> zenn.dev/leaner_dev </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2021/10/01</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">Leaner Technologies の @corocn です。本記事では Ruby on Rails の基本的な CSRF 対策の方法である "Synchronizer Token Pattern" を Rails API + SPA の構成でどう実装するかについてお伝えします。 CSRF 対策について解説した記事は多くありますが、最近直面したユースケースに沿った記事がなかったので、改めて整理しておくと誰かの役にたつかなと思ったので書きました。前提次のようなシンプルな構成のシステムを考えます。ログインして操作するシステム Cookie と Session ID でセッション管理をするステートフルな API SPA からのリクエストは axios を利用 Rails の強みを生かし、小さく立ち上げたいときにありがちな構成です。Cookie を利用するため、CSRF 対策が必要にな</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/rails" data-gtm-click-label="entry-search-result-item-tag">rails</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://zenn.dev/leaner_dev/articles/20210930-rails-api-spa-csrf"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://zenn.dev/leaner_dev/articles/20210930-rails-api-spa-csrf" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/fac83edb522e47a77abd360d390696ee9001c746/height=288;version=1;width=512/https%3A%2F%2Fres.cloudinary.com%2Fzenn%2Fimage%2Fupload%2Fs--UKe1M0fm--%2Fc_fit%252Cg_north_west%252Cl_text%3Anotosansjp-medium.otf_55%3ARails%252520API%252520%25252B%252520SPA%2525E3%252581%2525AECSRF%2525E5%2525AF%2525BE%2525E7%2525AD%252596%2525E4%2525BE%25258B%252Cw_1010%252Cx_90%252Cy_100%2Fg_south_west%252Cl_text%3Anotosansjp-medium.otf_34%3Acorocn%252Cx_220%252Cy_108%2Fbo_3px_solid_rgb%3Ad6e3ed%252Cg_south_west%252Ch_90%252Cl_fetch%3AaHR0cHM6Ly9zdG9yYWdlLmdvb2dsZWFwaXMuY29tL3plbm4tdXNlci11cGxvYWQvYXZhdGFyLzhhNjFkZTAyMDUuanBlZw%3D%3D%252Cr_20%252Cw_90%252Cx_92%252Cy_102%2Fco_rgb%3A6e7b85%252Cg_south_west%252Cl_text%3Anotosansjp-medium.otf_30%3A%2525E3%252583%2525AA%2525E3%252583%2525BC%2525E3%252583%25258A%2525E3%252583%2525BC%2525E3%252583%252586%2525E3%252583%252583%2525E3%252582%2525AF%2525E3%252583%252596%2525E3%252583%2525AD%2525E3%252582%2525B0%252Cx_220%252Cy_160%2Fbo_4px_solid_white%252Cg_south_west%252Ch_50%252Cl_fetch%3AaHR0cHM6Ly9zdG9yYWdlLmdvb2dsZWFwaXMuY29tL3plbm4tdXNlci11cGxvYWQvYXZhdGFyL2I1ZTI5Y2FhYzEuanBlZw%3D%3D%252Cr_max%252Cw_50%252Cx_139%252Cy_84%2Fv1627283836%2Fdefault%2Fog-base-w1200-v2.png" alt="Rails API + SPAのCSRF対策例" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://victorzhou.com/blog/csrf/"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://victorzhou.com/blog/csrf/" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fvictorzhou.com%2Fblog%2Fcsrf%2F" alt="">Web Security 101: An Interactive Cross-Site Request Forgery (CSRF) Demo - victorzhou.com </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/victorzhou.com/blog/csrf/" class="js-keyboard-entry-page-openable" title="Web Security 101: An Interactive Cross-Site Request Forgery (CSRF) Demo - victorzhou.com (13 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 13 users </a> </span> </li> <li> <a href="/site/victorzhou.com/" title="『victorzhou.com』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> victorzhou.com </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2020/06/11</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">Looking for an introduction to Cross-Site Request Forgery (CSRF)? This post will be a little different - instead of telling you what it is, I’m going to show you. Ready? Setting the Scene You’re a responsible, hardworking person. You’ve saved up your money over the years at Definitely Secure Bank®. The Definitely Secure Bank logo. You love Definitely Secure Bank - they’ve always been good to you,</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/techfeed" data-gtm-click-label="entry-search-result-item-tag">techfeed</a></li> <li><a href="/q/article" data-gtm-click-label="entry-search-result-item-tag">article</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> <li><a href="/q/web" data-gtm-click-label="entry-search-result-item-tag">web</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://victorzhou.com/blog/csrf/"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://victorzhou.com/blog/csrf/" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/7a34ee71ab9546a34d444d08952579b1ac381e23/height=288;version=1;width=512/https%3A%2F%2Fvictorzhou.com%2Fmedia%2Fcsrf-post%2Fdsb_2.png" alt="Web Security 101: An Interactive Cross-Site Request Forgery (CSRF) Demo - victorzhou.com" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry "> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="http://blog.a-way-out.net/blog/2022/08/16/codeigniter4-shield-csrf-protection-bypass/?utm_source=pocket_mylist"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="http://blog.a-way-out.net/blog/2022/08/16/codeigniter4-shield-csrf-protection-bypass/?utm_source=pocket_mylist" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=http%3A%2F%2Fblog.a-way-out.net%2Fblog%2F2022%2F08%2F16%2Fcodeigniter4-shield-csrf-protection-bypass%2F%3Futm_source%3Dpocket_mylist" alt="">SameSite攻撃者がCodeIgniter4とShieldでのCSRF保護を回避できる脆弱性の解説 — A Day in Serenity (Reloaded) — PHP, CodeIgniter, FuelPHP, Linux or something </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/blog.a-way-out.net/blog/2022/08/16/codeigniter4-shield-csrf-protection-bypass/?utm_source=pocket_mylist" class="js-keyboard-entry-page-openable" title="SameSite攻撃者がCodeIgniter4とShieldでのCSRF保護を回避できる脆弱性の解説 — A Day in Serenity (Reloaded) — PHP, CodeIgniter, FuelPHP, Linux or something (11 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 11 users </a> </span> </li> <li> <a href="/site/blog.a-way-out.net/" title="『blog.a-way-out.net』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> blog.a-way-out.net </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2022/08/16</span></li> </ul> </div> <div class="centerarticle-entry-contents "> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">CodeIgniter4とCodeIgniter Shieldでの組み合わせで、CSRF保護を回避できる脆弱性に関するセキュリティ勧告が2022/08/08に公表されました。今日は、この脆弱性について解説しておきます。 SameSite Attackers may Bypass the CSRF Protection · Advisory · codeigniter4/shield なお、この攻撃方法はCodeIgniterに限定されるものではありません。修正済みのバージョン CodeIgniter 4.2.3 CodeIgniter Shield 1.0.0-beta.2 前提条件この脆弱性を攻撃するには、攻撃者が攻撃対象のサイトと同じドメインのサブドメインサイトを支配下に置いている必要があります。簡単に言えば、サブドメインサイトのページを書き換えられるということです。これはそのサ</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/codeigniter" data-gtm-click-label="entry-search-result-item-tag">codeigniter</a></li> <li><a href="/q/php" data-gtm-click-label="entry-search-result-item-tag">php</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="http://blog.a-way-out.net/blog/2022/08/16/codeigniter4-shield-csrf-protection-bypass/?utm_source=pocket_mylist"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://midorimici.com/posts/rails-api-csrf"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://midorimici.com/posts/rails-api-csrf" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fmidorimici.com%2Fposts%2Frails-api-csrf" alt="">【Rails API】CSRF 対策をあきらめないでちゃんとやる | みどりみちのブログ </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/midorimici.com/posts/rails-api-csrf" class="js-keyboard-entry-page-openable" title="【Rails API】CSRF 対策をあきらめないでちゃんとやる | みどりみちのブログ (11 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 11 users </a> </span> </li> <li> <a href="/site/midorimici.com/" title="『midorimici.com』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> midorimici.com </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2021/09/07</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">Ruby on Rails を API として、フロントエンドとの間で通信をしようとしたところ、セッションが保存されなかったり、Can't verify CSRF token authenticity というエラーが出てくることがあります。多くのページでは解決方法として CSRF 対策をあきらめていますが、ここではちゃんとしたセキュアな解消方法について書いていきます。エラーも出ないがセッションが保存されないときこの記事にもあるように、CSRF という攻撃からサイトを守るために、 Rails はリクエストが不正でないか確認できないとセッションを空にしてしまいます。エラーも出ないのでわかりづらいですが、 application_controller.rb に protect_from_forgery with: :exception を記述すると Can't verify CSRF</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/rails" data-gtm-click-label="entry-search-result-item-tag">rails</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://midorimici.com/posts/rails-api-csrf"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://midorimici.com/posts/rails-api-csrf" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/fc7b952f42b902d5842a6d40420ddff86907e3de/height=288;version=1;width=512/https%3A%2F%2Fimages.ctfassets.net%2Fl7rmedbaynfb%2F41qTGwiuEOn3Eg9rkTEJi2%2F5eb9902d03de6fdd7fb58dee8465141c%2F_index.jpg" alt="【Rails API】CSRF 対策をあきらめないでちゃんとやる | みどりみちのブログ" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://blog.jxck.io/entries/2023-12-21/same-site.html"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://blog.jxck.io/entries/2023-12-21/same-site.html" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fblog.jxck.io%2Fentries%2F2023-12-21%2Fsame-site.html" alt="">3PCA 21 日目: SameSite Cookie | blog.jxck.io </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/blog.jxck.io/entries/2023-12-21/same-site.html" class="js-keyboard-entry-page-openable" title="3PCA 21 日目: SameSite Cookie | blog.jxck.io (11 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 11 users </a> </span> </li> <li> <a href="/site/blog.jxck.io/" title="『blog.jxck.io』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> blog.jxck.io </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2023/12/21</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">Intro このエントリは、3rd Party Cookie Advent Calendar の 21 日目である。 3rd Party Cookie のカレンダー | Advent Calendar 2023 - Qiita https://qiita.com/advent-calendar/2023/3rd-party-cookie Google が 3rd Party Cookie を Deprecate していく方針を発表してから、最初に始めたのが SameSite Lax by Default だった。これが何のために行われたのかを解説する。 eTLD+1 とは SameSite とは「eTLD+1 が同じ」という説明になる。これを理解するには eTLD を理解する必要がある。例として example.com ドメインを持ち、そこに以下のような Cookie を付与するところ</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/cookie" data-gtm-click-label="entry-search-result-item-tag">cookie</a></li> <li><a href="/q/%E3%83%96%E3%83%A9%E3%82%A6%E3%82%B6" data-gtm-click-label="entry-search-result-item-tag">ブラウザ</a></li> <li><a href="/q/Chrome" data-gtm-click-label="entry-search-result-item-tag">Chrome</a></li> <li><a href="/q/article" data-gtm-click-label="entry-search-result-item-tag">article</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://blog.jxck.io/entries/2023-12-21/same-site.html"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://blog.jxck.io/entries/2023-12-21/same-site.html" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/25f705929f7e98ea08f049f3c57b5de57a1b3ba0/height=288;version=1;width=512/https%3A%2F%2Fblog.jxck.io%2Fassets%2Fimg%2Fjxck.600x600.png" alt="3PCA 21 日目: SameSite Cookie | blog.jxck.io" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry "> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://kimuson.dev/blog/%E3%83%95%E3%83%AD%E3%83%B3%E3%83%88%E3%82%A8%E3%83%B3%E3%83%89/csrf_spa/"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://kimuson.dev/blog/%E3%83%95%E3%83%AD%E3%83%B3%E3%83%88%E3%82%A8%E3%83%B3%E3%83%89/csrf_spa/" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fkimuson.dev%2Fblog%2F%25E3%2583%2595%25E3%2583%25AD%25E3%2583%25B3%25E3%2583%2588%25E3%2582%25A8%25E3%2583%25B3%25E3%2583%2589%2Fcsrf_spa%2F" alt="">SPA + WebAPI でアプリケーションを構築するときの CSRF 対策についてのメモ </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/kimuson.dev/blog/%E3%83%95%E3%83%AD%E3%83%B3%E3%83%88%E3%82%A8%E3%83%B3%E3%83%89/csrf_spa/" class="js-keyboard-entry-page-openable" title="SPA + WebAPI でアプリケーションを構築するときの CSRF 対策についてのメモ (10 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 10 users </a> </span> </li> <li> <a href="/site/kimuson.dev/" title="『kimuson.dev』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> kimuson.dev </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2023/05/26</span></li> </ul> </div> <div class="centerarticle-entry-contents "> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">モノリス(MPA)だと、CSRF 対策として CSRF トークンを置いて検証するのが主流で、だいたいフレームワークに実装されてる機能を使うけど、SPA だと HTML は静的にビルドされるので、トークンを埋め込むことができない埋め込むなら SSR をすることになるけど、BFF と API サーバーは一般に別なので、トークンの管理が大変セッションを管理したいのは API サーバー (CSRF トークンはセッションに置いて API 呼び出し検証する必要があるので) だけど、CSRF トークンを set-cookie できるのは BFF のサーバーなので色々大変。考えたくないまずもって(他の理由で SSR する必要があるならともかく) SSR もしたくないし埋め込みではなく、ページロード後に API サーバーに CSRF トークンを問い合わせる案一応できなくはないけど、読み込み時の状態</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://kimuson.dev/blog/%E3%83%95%E3%83%AD%E3%83%B3%E3%83%88%E3%82%A8%E3%83%B3%E3%83%89/csrf_spa/"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://fujiten3.hatenablog.com/entry/2019/07/13/130459"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://fujiten3.hatenablog.com/entry/2019/07/13/130459" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Ffujiten3.hatenablog.com%2Fentry%2F2019%2F07%2F13%2F130459" alt="">SPAでのログイン認証とCSRF対策の実装(JWT使用) - Web備忘録 </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/fujiten3.hatenablog.com/entry/2019/07/13/130459" class="js-keyboard-entry-page-openable" title="SPAでのログイン認証とCSRF対策の実装(JWT使用) - Web備忘録 (8 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 8 users </a> </span> </li> <li> <a href="/site/fujiten3.hatenablog.com/" title="『fujiten3.hatenablog.com』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> fujiten3.hatenablog.com </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2020/04/27</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">SPA(Vue + RailsAPI)で何とかログイン認証機能 + CSRF対策を実装したので、ブログにメモしておきます。実装の概要使用した技術たち JWT(JsonWebToken) アクセストークン、リフレッシュトークンって？ WebStorage JWTSession 遷移の概要(より正確な内容は要Gem参照) トークンストアの設定バックエンド側の仕事 Signinコントローラーフロントエンド側の仕事 axiosのインスタンスの作成 main.jsでインスタンスの読み込みインスタンスの使用方法ただ、ブラウザによって上手く動作しないものが… 3rd party cookiesとは？余談実装の概要今回は、JWT + (WebStorage + Cookie）を使って実装しました。（後に用語説明します） WebStorageとJWTによるセッションの管理（ログイン状態の管</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/JWT" data-gtm-click-label="entry-search-result-item-tag">JWT</a></li> <li><a href="/q/%E8%AA%8D%E8%A8%BC" data-gtm-click-label="entry-search-result-item-tag">認証</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://fujiten3.hatenablog.com/entry/2019/07/13/130459"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://fujiten3.hatenablog.com/entry/2019/07/13/130459" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/af2abc4ae4b50e99dd8391544424181caa45d6a6/height=288;version=1;width=512/https%3A%2F%2Fogimage.blog.st-hatena.com%2F17680117126989340948%2F17680117127217518878%2F1658794935" alt="SPAでのログイン認証とCSRF対策の実装(JWT使用) - Web備忘録" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://www.ipa.go.jp/security/vuln/websecurity/csrf.html"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://www.ipa.go.jp/security/vuln/websecurity/csrf.html" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fwww.ipa.go.jp%2Fsecurity%2Fvuln%2Fwebsecurity%2Fcsrf.html" alt="">安全なウェブサイトの作り方 - 1.6 CSRF（クロスサイト・リクエスト・フォージェリ） | 情報セキュリティ | IPA 独立行政法人情報処理推進機構 </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/www.ipa.go.jp/security/vuln/websecurity/csrf.html" class="js-keyboard-entry-page-openable" title="安全なウェブサイトの作り方 - 1.6 CSRF（クロスサイト・リクエスト・フォージェリ） | 情報セキュリティ | IPA 独立行政法人情報処理推進機構 (8 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 8 users </a> </span> </li> <li> <a href="/site/www.ipa.go.jp/" title="『www.ipa.go.jp』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> www.ipa.go.jp </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2020/08/03</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">ログイン後の利用者のみが利用可能なサービスの悪用不正な送金、利用者が意図しない商品購入、利用者が意図しない退会処理等ログイン後の利用者のみが編集可能な情報の改ざん、新規登録各種設定の不正な変更（管理者画面、パスワード等）、掲示板への不適切な書き込み等注意が必要なウェブサイトの特徴次の技術を利用してセッション管理を実装しているウェブサイトが、CSRF攻撃による影響を受ける可能性があります。 Cookieを用いたセッション管理 Basic認証 SSLクライアント認証また、上記を実装するウェブサイトのうち、ログイン後に決済処理等の重要な処理を行うサイトは、攻撃による被害が大きくなるため、特に注意が必要です。届出状況 CSRFの脆弱性に関する届出が、ウェブサイトの届出全体に占める割合は、1パーセント未満と多くはありません。しかしながらこれらの脆弱性については、ソフトウェア製品の届</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://www.ipa.go.jp/security/vuln/websecurity/csrf.html"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://www.ipa.go.jp/security/vuln/websecurity/csrf.html" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/b9ae4e41e8b2184c612831da1241b4cf079ca73a/height=288;version=1;width=512/https%3A%2F%2Fwww.ipa.go.jp%2Fk3q2q400000050d7-img%2Fk3q2q400000050dg.png" alt="安全なウェブサイトの作り方 - 1.6 CSRF（クロスサイト・リクエスト・フォージェリ） | 情報セキュリティ | IPA 独立行政法人情報処理推進機構" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://ritou.hatenablog.com/entry/2020/04/20/010230"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://ritou.hatenablog.com/entry/2020/04/20/010230" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fritou.hatenablog.com%2Fentry%2F2020%2F04%2F20%2F010230" alt="">ID連携におけるCSRF対策のチェック方法 - r-weblife </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/ritou.hatenablog.com/entry/2020/04/20/010230" class="js-keyboard-entry-page-openable" title="ID連携におけるCSRF対策のチェック方法 - r-weblife (6 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 6 users </a> </span> </li> <li> <a href="/site/ritou.hatenablog.com/" title="『ritou.hatenablog.com』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> ritou.hatenablog.com </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2020/04/20</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">こんばんは、OAuth👮‍♂️です。緊急事態宣言、外出自粛、みなさまどうお過ごしでしょうか？お家に高い椅子と4KディスプレイとYouTuber並みのマイクを準備し、ようやくOAuth/OIDCを用いたID連携機能の実装に手をつけられるようになった頃かと思います。本日はID連携時のCSRF対策について、動くものがある状態からのチェックの方法を紹介します。手元で開発したサービスの登録とかログインにソーシャルログイン機能をつけて「おっ、IdPと繋がった！」ってなったら、Qiitaにその手順を晒すまえにこういうのを試してみましょう。 IdPに遷移する時のURLを確認するライブラリとかで作る場合は、登録もログインも既存アカウントへの連携も同じような処理が行われるはずです。なのでだいたいどこでも良いと思います。 ※画像はイメージです ※画像はイメージです Googleでログイン機能とかを</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/security" data-gtm-click-label="entry-search-result-item-tag">security</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://ritou.hatenablog.com/entry/2020/04/20/010230"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://ritou.hatenablog.com/entry/2020/04/20/010230" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/87cc78ca18760c013858b1f1cf1882f762267383/height=288;version=1;width=512/https%3A%2F%2Fcdn.image.st-hatena.com%2Fimage%2Fscale%2Fd63f9a7741d707e7084a3cde5863ef0fa1923cef%2Fbackend%3Dimagemagick%3Bversion%3D1%3Bwidth%3D1300%2Fhttps%253A%252F%252Fcdn-ak.f.st-hatena.com%252Fimages%252Ffotolife%252Fr%252Fritou%252F20200419%252F20200419022241.png" alt="ID連携におけるCSRF対策のチェック方法 - r-weblife" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://qiita.com/flyaway/items/d30c99a662330df0c00d"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://qiita.com/flyaway/items/d30c99a662330df0c00d" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fqiita.com%2Fflyaway%2Fitems%2Fd30c99a662330df0c00d" alt="">SameSite属性の付与によるCSRF脆弱性対策 - Qiita </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/qiita.com/flyaway/items/d30c99a662330df0c00d" class="js-keyboard-entry-page-openable" title="SameSite属性の付与によるCSRF脆弱性対策 - Qiita (6 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 6 users </a> </span> </li> <li> <a href="/site/qiita.com/flyaway" title="『qiita.com/flyaway』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> qiita.com/flyaway </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2021/04/30</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">概要 CookieにSameSite属性を付与することで、CSRF脆弱性1に対していくらかの防御ができる。 SameSite属性はStrict,Lax,Noneの3つの値を取り、設定値により効果の範囲は異なる Strictを設定することで、CSRFを防げる。ただし、Webサイトの使いやすさが損なわれる場合がある Laxを設定することで、POSTメソッドのリクエストのみを受け付ける処理でCSRFを防げる None は従来通りの動作であり、外部サイトからCookieを送信する Webサイトのセキュリティ要件により、設定すべき値が異なる SameSite属性は主要なブラウザすべてで対応されている SameSite属性の付与がCSRF脆弱性への防御とならないケース Windows 10 RS3（2017 Fall Creators Update）未満のIE 11など、SameSite属性をサポート</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/CSRF" data-gtm-click-label="entry-search-result-item-tag">CSRF</a></li> <li><a href="/q/Cookie" data-gtm-click-label="entry-search-result-item-tag">Cookie</a></li> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> <li><a href="/q/%E8%A8%AD%E5%AE%9A" data-gtm-click-label="entry-search-result-item-tag">設定</a></li> <li><a href="/q/Web%E3%82%B5%E3%83%BC%E3%83%93%E3%82%B9" data-gtm-click-label="entry-search-result-item-tag">Webサービス</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://qiita.com/flyaway/items/d30c99a662330df0c00d"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://qiita.com/flyaway/items/d30c99a662330df0c00d" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/157b9941c13aed616acb92ee16518675895628ec/height=288;version=1;width=512/https%3A%2F%2Fqiita-user-contents.imgix.net%2Fhttps%253A%252F%252Fcdn.qiita.com%252Fassets%252Fpublic%252Farticle-ogp-background-412672c5f0600ab9a64263b751f1bc81.png%3Fixlib%3Drb-4.0.0%26w%3D1200%26mark64%3DaHR0cHM6Ly9xaWl0YS11c2VyLWNvbnRlbnRzLmltZ2l4Lm5ldC9-dGV4dD9peGxpYj1yYi00LjAuMCZ3PTk3MiZoPTM3OCZ0eHQ9U2FtZVNpdGUlRTUlQjElOUUlRTYlODAlQTclRTMlODElQUUlRTQlQkIlOTglRTQlQjglOEUlRTMlODElQUIlRTMlODIlODglRTMlODIlOEJDU1JGJUU4JTg0JTg2JUU1JUJDJUIxJUU2JTgwJUE3JUU1JUFGJUJFJUU3JUFEJTk2JnR4dC1hbGlnbj1sZWZ0JTJDdG9wJnR4dC1jb2xvcj0lMjMxRTIxMjEmdHh0LWZvbnQ9SGlyYWdpbm8lMjBTYW5zJTIwVzYmdHh0LXNpemU9NTYmcz0yOTM5YmQ3MjE2MmMxMGUxMjQ5NDMxOWYwOWMwYjMyOA%26mark-x%3D142%26mark-y%3D57%26blend64%3DaHR0cHM6Ly9xaWl0YS11c2VyLWNvbnRlbnRzLmltZ2l4Lm5ldC9-dGV4dD9peGxpYj1yYi00LjAuMCZoPTc2Jnc9NzcwJnR4dD0lNDBmbHlhd2F5JnR4dC1jb2xvcj0lMjMxRTIxMjEmdHh0LWZvbnQ9SGlyYWdpbm8lMjBTYW5zJTIwVzYmdHh0LXNpemU9MzYmdHh0LWFsaWduPWxlZnQlMkN0b3Amcz1lYTU1YjMyOTVjOGZlODAwN2MzNzUxMjBjNDI2MWNiMg%26blend-x%3D142%26blend-y%3D436%26blend-mode%3Dnormal%26txt64%3DaW4g5qCq5byP5Lya56S-V29ya3MgSHVtYW4gSW50ZWxsaWdlbmNl%26txt-width%3D770%26txt-clip%3Dend%252Cellipsis%26txt-color%3D%25231E2121%26txt-font%3DHiragino%2520Sans%2520W6%26txt-size%3D36%26txt-x%3D156%26txt-y%3D536%26s%3D6a2b924bf0d7c6f49502f0ed9baf7274" alt="SameSite属性の付与によるCSRF脆弱性対策 - Qiita" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://qiita.com/naoya_matsuda/items/992c67b803ff460818ec"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://qiita.com/naoya_matsuda/items/992c67b803ff460818ec" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fqiita.com%2Fnaoya_matsuda%2Fitems%2F992c67b803ff460818ec" alt="">OAuth2.0 PKCEとは〜Stateとの違い〜 - Qiita </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/qiita.com/naoya_matsuda/items/992c67b803ff460818ec" class="js-keyboard-entry-page-openable" title="OAuth2.0 PKCEとは〜Stateとの違い〜 - Qiita (6 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 6 users </a> </span> </li> <li> <a href="/site/qiita.com/naoya_matsuda" title="『qiita.com/naoya_matsuda』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> qiita.com/naoya_matsuda </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2022/10/08</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">はじめに OAuth2.0の拡張仕様で当たり前になりつつある？PKCEについてまとめました。「PKCE」とは PKCEとは、「Proof Key for Code Exchange by OAuth Public Clients」の略称で、認可コード横取り攻撃を対策するための、OAuth2.0の拡張仕様です。みんな大好き？RFCの7636に定義されています。 RFCに読み方も定義されており、「PKCE」も定義されています。 PKCE, pronounced "pixy" とあるので「PKCE」は「ピクシー」と読みます。 ※ ポケ○ンではありません。認可コード横取り攻撃この拡張仕様は「認可コード横取り攻撃」の対策を行うための仕様なので、まず、このRFCで対策する攻撃についてまとめます。この攻撃にはいくつかの前提があります。 OAuth2.0の「認可コード」フローを使用 Public</p> <ul class="entrysearch-entry-tags"> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://qiita.com/naoya_matsuda/items/992c67b803ff460818ec"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://qiita.com/naoya_matsuda/items/992c67b803ff460818ec" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/73172e9e0e495c5dd5b94c10e42dee4b5471c0e5/height=288;version=1;width=512/https%3A%2F%2Fqiita-user-contents.imgix.net%2Fhttps%253A%252F%252Fcdn.qiita.com%252Fassets%252Fpublic%252Farticle-ogp-background-412672c5f0600ab9a64263b751f1bc81.png%3Fixlib%3Drb-4.0.0%26w%3D1200%26mark64%3DaHR0cHM6Ly9xaWl0YS11c2VyLWNvbnRlbnRzLmltZ2l4Lm5ldC9-dGV4dD9peGxpYj1yYi00LjAuMCZ3PTk3MiZoPTM3OCZ0eHQ9T0F1dGgyLjAlMjBQS0NFJUUzJTgxJUE4JUUzJTgxJUFGJTIwJUUzJTgwJTlDU3RhdGUlRTMlODElQTglRTMlODElQUUlRTklODElOTUlRTMlODElODQlRTMlODAlOUMmdHh0LWFsaWduPWxlZnQlMkN0b3AmdHh0LWNvbG9yPSUyMzFFMjEyMSZ0eHQtZm9udD1IaXJhZ2lubyUyMFNhbnMlMjBXNiZ0eHQtc2l6ZT01NiZzPTFiZjUzOTYyN2M1NzUwN2U0YTkzMzM3MjU2ZTdhODBl%26mark-x%3D142%26mark-y%3D57%26blend64%3DaHR0cHM6Ly9xaWl0YS11c2VyLWNvbnRlbnRzLmltZ2l4Lm5ldC9-dGV4dD9peGxpYj1yYi00LjAuMCZoPTc2Jnc9NzcwJnR4dD0lNDBpc3Qtbi1tJnR4dC1jb2xvcj0lMjMxRTIxMjEmdHh0LWZvbnQ9SGlyYWdpbm8lMjBTYW5zJTIwVzYmdHh0LXNpemU9MzYmdHh0LWFsaWduPWxlZnQlMkN0b3Amcz01MjQyNzBiNDJjNGU5MTU5YzJkNzRkNDY1NjM1MmM4YQ%26blend-x%3D142%26blend-y%3D436%26blend-mode%3Dnormal%26txt64%3DaW4g5qCq5byP5Lya56S-IOaDheWgseaIpueVpeODhuOCr-ODjuODreOCuOODvA%26txt-width%3D770%26txt-clip%3Dend%252Cellipsis%26txt-color%3D%25231E2121%26txt-font%3DHiragino%2520Sans%2520W6%26txt-size%3D36%26txt-x%3D156%26txt-y%3D536%26s%3Ddae658b162f430111a5642efea82f33b" alt="OAuth2.0 PKCEとは〜Stateとの違い〜 - Qiita" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://eset-info.canon-its.jp/malware_info/special/detail/200602.html"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://eset-info.canon-its.jp/malware_info/special/detail/200602.html" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Feset-info.canon-its.jp%2Fmalware_info%2Fspecial%2Fdetail%2F200602.html" alt="">クロスサイト･スクリプティング（XSS）とクロスサイト･リクエスト･フォージェリ（CSRF）の違い | サイバーセキュリティ情報局 </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/eset-info.canon-its.jp/malware_info/special/detail/200602.html" class="js-keyboard-entry-page-openable" title="クロスサイト･スクリプティング（XSS）とクロスサイト･リクエスト･フォージェリ（CSRF）の違い | サイバーセキュリティ情報局 (5 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 5 users </a> </span> </li> <li> <a href="/site/eset-info.canon-its.jp/" title="『eset-info.canon-its.jp』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> eset-info.canon-its.jp </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2020/06/02</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">インターネットの普及により、私たちはWebサイト上でさまざまなサービスを受けることが可能になった。その一方で、こうしたWebアプリケーションの脆弱性を狙った攻撃は年々増加している。本記事では、その中でも古典的ながら今なお代表的な脆弱性で、混同されがちなクロスサイト・スクリプティング（XSS）と、クロスサイト・リクエスト・フォージェリ（CSRF）について、改めて仕組みの違いや過去の被害事例、対策を整理し紹介する。クロスサイト･スクリプティング（XSS）とは 2019年10月24日に独立行政法人情報処理推進機構（IPA）が発表した報告資料によると、2019年第3四半期におけるWebサイト脆弱性に関する届け出件数は278件。そのうち、約58％をクロスサイト・スクリプティング（以下、XSS）が占めている。脆弱性はセキュリティホールとも呼ばれ、アプリケーションのプログラムの不具合や設計ミスによって</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/%E3%82%BB%E3%82%AD%E3%83%A5%E3%83%AA%E3%83%86%E3%82%A3" data-gtm-click-label="entry-search-result-item-tag">セキュリティ</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://eset-info.canon-its.jp/malware_info/special/detail/200602.html"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://eset-info.canon-its.jp/malware_info/special/detail/200602.html" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/d1d332807ed39b2e1727a8512fbb470ae045bf53/height=288;version=1;width=512/https%3A%2F%2Feset-info.canon-its.jp%2Ffiles%2Ftopics%2F3137_ext_01_0.jpg" alt="クロスサイト･スクリプティング（XSS）とクロスサイト･リクエスト･フォージェリ（CSRF）の違い | サイバーセキュリティ情報局" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://qiita.com/silane1001/items/2adba867f2c4e60ca8e5"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://qiita.com/silane1001/items/2adba867f2c4e60ca8e5" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fqiita.com%2Fsilane1001%2Fitems%2F2adba867f2c4e60ca8e5" alt="">CSRFトークンはもはや不要です - Qiita </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/qiita.com/silane1001/items/2adba867f2c4e60ca8e5" class="js-keyboard-entry-page-openable" title="CSRFトークンはもはや不要です - Qiita (4 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 4 users </a> </span> </li> <li> <a href="/site/qiita.com/silane1001" title="『qiita.com/silane1001』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> qiita.com/silane1001 </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2024/03/11</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary"><form action="https://bank.example.com/transfer" method="post"> <input type="hidden" name="to" value="cracker" /> <input type="hidden" name="amount" value="¥10000000" /> <button>今すぐクリック！！！</button> </form> 問題は何の関係性もないmalicious.example.comのサイトから発せられたbank.example.comへのリクエストにbank.example.comの認証情報（Cookie）が付与されてしまうことです。これによってbank.example.comに対するユーザ認証付きの操作を第三者がそれと分からない形で実行させることができてしまうわけです。そこで導入されたのがSet</p> <ul class="entrysearch-entry-tags"> <li><a href="/q/%E3%81%82%E3%81%A8%E3%81%A7%E8%AA%AD%E3%82%80" data-gtm-click-label="entry-search-result-item-tag">あとで読む</a></li> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://qiita.com/silane1001/items/2adba867f2c4e60ca8e5"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://qiita.com/silane1001/items/2adba867f2c4e60ca8e5" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/e7efe96fcbad096fe4b5794f7cd3278d5b92cdf5/height=288;version=1;width=512/https%3A%2F%2Fqiita-user-contents.imgix.net%2Fhttps%253A%252F%252Fqiita-user-contents.imgix.net%252Fhttps%25253A%25252F%25252Fcdn.qiita.com%25252Fassets%25252Fpublic%25252Farticle-ogp-background-afbab5eb44e0b055cce1258705637a91.png%253Fixlib%253Drb-4.0.0%2526w%253D1200%2526blend64%253DaHR0cHM6Ly9xaWl0YS11c2VyLXByb2ZpbGUtaW1hZ2VzLmltZ2l4Lm5ldC9odHRwcyUzQSUyRiUyRnFpaXRhLWltYWdlLXN0b3JlLnMzLmFwLW5vcnRoZWFzdC0xLmFtYXpvbmF3cy5jb20lMkYwJTJGMjM1NDYxMiUyRnByb2ZpbGUtaW1hZ2VzJTJGMTcwMTI1MTk3MD9peGxpYj1yYi00LjAuMCZhcj0xJTNBMSZmaXQ9Y3JvcCZtYXNrPWVsbGlwc2UmZm09cG5nMzImcz1jYWFhMzI1ZmI1OTJlZTVkZDQ4MTAwYTQ3ZjMwYzM1OQ%2526blend-x%253D120%2526blend-y%253D467%2526blend-w%253D82%2526blend-h%253D82%2526blend-mode%253Dnormal%2526s%253Df8139e6c591645e127946d19b5603ada%3Fixlib%3Drb-4.0.0%26w%3D1200%26fm%3Djpg%26mark64%3DaHR0cHM6Ly9xaWl0YS11c2VyLWNvbnRlbnRzLmltZ2l4Lm5ldC9-dGV4dD9peGxpYj1yYi00LjAuMCZ3PTk2MCZoPTMyNCZ0eHQ9Q1NSRiVFMyU4MyU4OCVFMyU4MyVCQyVFMyU4MiVBRiVFMyU4MyVCMyVFMyU4MSVBRiVFMyU4MiU4MiVFMyU4MSVBRiVFMyU4MiU4NCVFNCVCOCU4RCVFOCVBNiU4MSVFMyU4MSVBNyVFMyU4MSU5OSZ0eHQtYWxpZ249bGVmdCUyQ3RvcCZ0eHQtY29sb3I9JTIzMUUyMTIxJnR4dC1mb250PUhpcmFnaW5vJTIwU2FucyUyMFc2JnR4dC1zaXplPTU2JnR4dC1wYWQ9MCZzPTdjMTI2NDE4ZmM5MTgyNjFjYTEwNTNlNjllZmMzNTQ4%26mark-x%3D120%26mark-y%3D112%26blend64%3DaHR0cHM6Ly9xaWl0YS11c2VyLWNvbnRlbnRzLmltZ2l4Lm5ldC9-dGV4dD9peGxpYj1yYi00LjAuMCZ3PTgzOCZoPTU4JnR4dD0lNDBzaWxhbmUxMDAxJnR4dC1jb2xvcj0lMjMxRTIxMjEmdHh0LWZvbnQ9SGlyYWdpbm8lMjBTYW5zJTIwVzYmdHh0LXNpemU9MzYmdHh0LXBhZD0wJnM9ZTgxNWRjMjcyMDc5MzUxZTk5MWFlZThiMTFhNTY4NGM%26blend-x%3D242%26blend-y%3D480%26blend-w%3D838%26blend-h%3D46%26blend-fit%3Dcrop%26blend-crop%3Dleft%252Cbottom%26blend-mode%3Dnormal%26s%3Def5b31b8fad4cc161eeb2518e255eda9" alt="CSRFトークンはもはや不要です - Qiita" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> <li class="bookmark-item js-user-bookmark-item js-keyboard-selectable-item"> <div class="centerarticle-entry is-image-entry-unit"> <div class="js-bookmark-stock-button is-hidden"> <button class="js-bookmark-stock-button-ready readlater-button" data-gtm-click-label="entry-search-result-item-stock-button" title="あとで読む" aria-label="あとで読む" tabindex="0" type="button" data-href="https://blog.logrocket.com/protecting-next-js-apps-csrf-attacks/"><span>あとで読む</span> </button> </div> <div class="centerarticle-entry-header"> <h3 class="centerarticle-entry-title"> <a href="https://blog.logrocket.com/protecting-next-js-apps-csrf-attacks/" class="js-clickable-link js-keyboard-openable" target="_blank" rel="noopener" data-gtm-click-label="entry-search-result-item-title"> <img class="centerarticle-entry-favicon" src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fblog.logrocket.com%2Fprotecting-next-js-apps-csrf-attacks%2F" alt="">Protecting Next.js apps from CSRF attacks - LogRocket Blog </a> </h3> <ul class="centerarticle-entry-data"> <li> <span class="centerarticle-users"> <a href="/entry/s/blog.logrocket.com/protecting-next-js-apps-csrf-attacks/" class="js-keyboard-entry-page-openable" title="Protecting Next.js apps from CSRF attacks - LogRocket Blog (3 ブックマーク)" data-gtm-click-label="entry-search-result-item-users"> 3 users </a> </span> </li> <li> <a href="/site/blog.logrocket.com/" title="『blog.logrocket.com』の新着エントリー" data-gtm-click-label="entry-search-result-item-site-search-url"> blog.logrocket.com </a> </li> <li> <a href="/hotentry/it" data-gtm-click-label="entry-search-result-item-category">テクノロジー</a> </li> <li><span class="entry-contents-date">2023/05/14</span></li> </ul> </div> <div class="centerarticle-entry-contents has-image"> <div class="centerarticle-entry-item"> <p class="centerarticle-entry-summary">Using HTTP-only cookies By setting the HttpOnly cookie flag, you can reduce the likelihood of a CSRF attack since HTTP-only cookies cannot be retrieved by JavaScript through client-side scripts. res.setHeader("Set-Cookie", `session=${sessionId}; Path=/; Max-Age=600; SameSite=Strict; HttpOnly`); Using CSRF tokens One way to protect your web application against a CSRF attack is to use CSRF tokens. A</p> <ul class="entrysearch-entry-tags"> </ul> <div class="following-bookmarks-container js-following-bookmarks-container" data-entry-url="https://blog.logrocket.com/protecting-next-js-apps-csrf-attacks/"> <ul class="following-bookmarks js-following-bookmarks"></ul> <script type="text/x-template" id="template-following-bookmark"> <li> <a href="{{ anchor_path }}" class="following-bookmark-link" data-gtm-label="entry-info-followingBookmarks"> <img src="{{ profile_image_url }}" alt="{{ user_name }}" class="following-bookmark-icon"> </a> <span class="following-bookmark-popup"> <span class="following-bookmark-username">{{ user_name }}</span><span class="following-bookmark-timestamp">{{ created }}</span> <span class="following-bookmark-text"> {{ #comment }}<span class="following-bookmark-comment">{{ comment }}</span>{{ /comment }} <ul class="following-bookmark-tags">{{ #tags }}<li>{{ label }}</li>{{ /tags }}</ul> </span> </span> </li> </script> </div> </div> <div class="centerarticle-entry-image-wrapper"> <a href="https://blog.logrocket.com/protecting-next-js-apps-csrf-attacks/" class="centerarticle-entry-image" target="_blank" rel="noopener"> <img src="https://cdn-ak-scissors.b.st-hatena.com/image/square/7d3bf8eae63badb41aeaad50d42a8abb9879bc01/height=288;version=1;width=512/https%3A%2F%2Fblog.logrocket.com%2Fwp-content%2Fuploads%2F2023%2F04%2Fprotecting-next-js-apps-csrf-attacks.png" alt="Protecting Next.js apps from CSRF attacks - LogRocket Blog" data-gtm-click-label="entry-search-result-item-image"> </a> </div> </div> </div> </li> </ul> <div class="centerarticle-pager "> <span>1</span> <span class="js-keyboard-selectable-item"><a href="https://b.hatena.ne.jp/q/CSRF?page=2" class="js-keyboard-openable">2</a></span> <span class="centerarticle-pager-next js-keyboard-selectable-item"><a href="https://b.hatena.ne.jp/q/CSRF?page=2" class="js-keyboard-openable">次のページ</a></span> </div> </div> <ins id="entrysearch-ad-rectangle-middle-sp" class="entrylist-ad-sp-fluid for-sp"></ins> <div id="entrysearch-ad-rectangle-bottom-sp" class="touch-ad-rectangle"></div> </div> <div class="entry-wrapper"> <section class="entry-group"> <h2 class="entry-group-sectionTitle">新着記事</h2> <ul class="entry-group-list"> <li> <div class="entry-group-list-inner"> <div class="entry-group-text"> <h3 class="entry-group-title"><a href="/entry/s/forums.androidcentral.com/threads/ways-to-communicate-with-volaris-customer-service-by-phone-emails-chat-and-other-options-a-complete-guide.1077257/::" title="https://forums.androidcentral.com/threads/ways-to-communicate-with-volaris-customer-service-by-phone-emails-chat-and-other-options-a-complete-guide.1077257/::" data-gtm-label="entry-recentEntriesInEntrySearch-title">https://forums.androidcentral.com/threads/ways-to-communicate-with-volaris-customer-service-by-phone-emails-chat-and-other-options-a-complete-guide.1077257/::</a></h3> <p class="entry-group-meta"><span class="entry-group-users"><a href="/entry/s/forums.androidcentral.com/threads/ways-to-communicate-with-volaris-customer-service-by-phone-emails-chat-and-other-options-a-complete-guide.1077257/::" data-gtm-label="entry-recentEntriesInEntrySearch-users">1 user</a></span><span class="entry-group-domain"><a href="/site/forums.androidcentral.com/" data-gtm-label="entry-recentEntriesInEntrySearch-domain"><img src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fforums.androidcentral.com%2Fthreads%2Fways-to-communicate-with-volaris-customer-service-by-phone-emails-chat-and-other-options-a-complete-guide.1077257%2F%3A%3A" alt="">forums.androidcentral.com</a></span></p> </div> </div> </li> <li> <div class="entry-group-list-inner"> <div class="entry-group-text"> <h3 class="entry-group-title"><a href="/entry/s/support.google.com/admanager/thread/335199841?hl=en" title="https://support.google.com/admanager/thread/335199841?hl=en" data-gtm-label="entry-recentEntriesInEntrySearch-title">https://support.google.com/admanager/thread/335199841?hl=en</a></h3> <p class="entry-group-meta"><span class="entry-group-users"><a href="/entry/s/support.google.com/admanager/thread/335199841?hl=en" data-gtm-label="entry-recentEntriesInEntrySearch-users">1 user</a></span><span class="entry-group-domain"><a href="/site/support.google.com/" data-gtm-label="entry-recentEntriesInEntrySearch-domain"><img src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fsupport.google.com%2Fadmanager%2Fthread%2F335199841%3Fhl%3Den" alt="">support.google.com</a></span></p> </div> </div> </li> <li> <div class="entry-group-list-inner"> <div class="entry-group-text"> <h3 class="entry-group-title"><a href="/entry/s/forums.androidcentral.com/threads/ways-to-communicate-with-volaris-customer-service-by-phone-emails-chat-and-other-options-a-complete-guide.1077257/:" title="https://forums.androidcentral.com/threads/ways-to-communicate-with-volaris-customer-service-by-phone-emails-chat-and-other-options-a-complete-guide.1077257/:" data-gtm-label="entry-recentEntriesInEntrySearch-title">https://forums.androidcentral.com/threads/ways-to-communicate-with-volaris-customer-service-by-phone-emails-chat-and-other-options-a-complete-guide.1077257/:</a></h3> <p class="entry-group-meta"><span class="entry-group-users"><a href="/entry/s/forums.androidcentral.com/threads/ways-to-communicate-with-volaris-customer-service-by-phone-emails-chat-and-other-options-a-complete-guide.1077257/:" data-gtm-label="entry-recentEntriesInEntrySearch-users">1 user</a></span><span class="entry-group-domain"><a href="/site/forums.androidcentral.com/" data-gtm-label="entry-recentEntriesInEntrySearch-domain"><img src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fforums.androidcentral.com%2Fthreads%2Fways-to-communicate-with-volaris-customer-service-by-phone-emails-chat-and-other-options-a-complete-guide.1077257%2F%3A" alt="">forums.androidcentral.com</a></span></p> </div> </div> </li> <li> <div class="entry-group-list-inner"> <div class="entry-group-text"> <h3 class="entry-group-title"><a href="/entry/s/note.com/brekekegames/n/n5bc17fa69907" title="第4回名古屋ボードゲーム楽市(2025年)に出展してきました｜ぶれけけゲームズ" data-gtm-label="entry-recentEntriesInEntrySearch-title">第4回名古屋ボードゲーム楽市(2025年)に出展してきました｜ぶれけけゲームズ</a></h3> <p class="entry-group-meta"><span class="entry-group-users"><a href="/entry/s/note.com/brekekegames/n/n5bc17fa69907" data-gtm-label="entry-recentEntriesInEntrySearch-users">1 user</a></span><span class="entry-group-domain"><a href="/site/note.com/brekekegames" data-gtm-label="entry-recentEntriesInEntrySearch-domain"><img src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fnote.com%2Fbrekekegames%2Fn%2Fn5bc17fa69907" alt="">note.com/brekekegames</a></span></p> </div> </div> </li> <li> <div class="entry-group-list-inner"> <div class="entry-group-text"> <h3 class="entry-group-title"><a href="/entry/s/ncode.syosetu.com/n1314hd/447" title="魔術師クノンは見えている - ４４５．荒れる準教師たち" data-gtm-label="entry-recentEntriesInEntrySearch-title">魔術師クノンは見えている - ４４５．荒れる準教師たち</a></h3> <p class="entry-group-meta"><span class="entry-group-users"><a href="/entry/s/ncode.syosetu.com/n1314hd/447" data-gtm-label="entry-recentEntriesInEntrySearch-users">1 user</a></span><span class="entry-group-domain"><a href="/site/ncode.syosetu.com/" data-gtm-label="entry-recentEntriesInEntrySearch-domain"><img src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fncode.syosetu.com%2Fn1314hd%2F447" alt="">ncode.syosetu.com</a></span></p> </div> </div> </li> <li> <div class="entry-group-list-inner"> <div class="entry-group-text"> <h3 class="entry-group-title"><a href="/entry/s/forums.androidcentral.com/threads/ways-to-communicate-with-volaris-customer-service-by-phone-emails-chat-and-other-options-a-complete-guide.1077257/%5D" title="https://forums.androidcentral.com/threads/ways-to-communicate-with-volaris-customer-service-by-phone-emails-chat-and-other-options-a-complete-guide.1077257/%5D" data-gtm-label="entry-recentEntriesInEntrySearch-title">https://forums.androidcentral.com/threads/ways-to-communicate-with-volaris-customer-service-by-phone-emails-chat-and-other-options-a-complete-guide.1077257/%5D</a></h3> <p class="entry-group-meta"><span class="entry-group-users"><a href="/entry/s/forums.androidcentral.com/threads/ways-to-communicate-with-volaris-customer-service-by-phone-emails-chat-and-other-options-a-complete-guide.1077257/%5D" data-gtm-label="entry-recentEntriesInEntrySearch-users">1 user</a></span><span class="entry-group-domain"><a href="/site/forums.androidcentral.com/" data-gtm-label="entry-recentEntriesInEntrySearch-domain"><img src="https://cdn-ak2.favicon.st-hatena.com/64?url=https%3A%2F%2Fforums.androidcentral.com%2Fthreads%2Fways-to-communicate-with-volaris-customer-service-by-phone-emails-chat-and-other-options-a-complete-guide.1077257%2F%255D" alt="">forums.androidcentral.com</a></span></p> </div> </div> </li> </ul> </section> </div> </div> <div id="keyboard-shortcut-help" class="shortcut-help is-hidden"> <h3 class="shortcut-help-title">キーボードショートカット一覧</h3> <p><span class="shortcut-help-key">j</span>次のブックマーク</p> <p><span class="shortcut-help-key">k</span>前のブックマーク</p> <p><span class="shortcut-help-key">l</span>あとで読む</p> <p><span class="shortcut-help-key">e</span>コメント一覧を開く</p> <p><span class="shortcut-help-key">o</span>ページを開く</p> <button tyle="button" class="shortcut-help-close js-close-button">✕</button> </div> <script type="text/javascript"> // ---------------- dfp section ---------------- var valve = valve || []; if (isMobile()) { valve.push(function(v) { v.defineDFPSlot({ unit: '/4374287/bookmark_overlay_sp', sizes: [[320,80],[320,70],[320,50]], slotId: 'touch-footer-ad' }); v.defineDFPSlot({ unit: '/4374287/bookmark_entrysearch_rectangle_bottom_sp', sizes: [[300,250]], slotId: 'entrysearch-ad-rectangle-bottom-sp' }); v.sealDFPSlots(); }); } else { valve.push(function(v) { v.defineDFPSlot({ unit: '/4374287/bookmark_entrysearch_sidebar_top_pc', sizes: [[300,250]], slotId: 'entrysearch-ad-sidebar-top' }); v.defineDFPSlot({ unit: '/4374287/bookmark_entrysearch_sidebar_bottom_pc', sizes: [[300,250]], slotId: 'entrysearch-ad-sidebar-bottom' }); v.sealDFPSlots(); }); } // ---------------- ydn section ---------------- if (isMobile()) { valve.push(function(v) { v.defineFluidSlot({ insId: 'entrysearch-ad-rectangle-middle-sp', yadsAdDs: '62199_242886' }); }); } </script> <script> var valve = window.valve || []; valve.push(function(v) { var pageKeyValues = {}; if (document.cookie.split(';').some(function(item) { return item.indexOf('202011_guest_status=register_incomplete') >= 0})) { pageKeyValues.bookmark_status = 'register_incomplete'; } v.config({ pageKeyValues: pageKeyValues, textSelector: ".entry-search-articles", content: { result: "ng" }, service: 'bookmark' }); }); </script> <script src="https://cdn.pool.st-hatena.com/valve/valve.js" async></script> <div class="footer"> <div class="footer-inner"> <div class="footer-inner-group footer-bookmark"> <h2 class="footer-title"><a href="/" data-gtm-label="footer-btop">はてなブックマーク</a></h2> <div class="footer-list-wrapper"> <ul class="footer-list footer-list--pc"> <li class="footer-list-item js-keyboard-selectable-item"><a href="/hotentry/all" class="hotentry js-keyboard-openable" data-gtm-label="footerCategories-hotentry">総合</a></li> <li class="footer-list-item js-keyboard-selectable-item"><a href="/hotentry/general" class="general js-keyboard-openable" data-gtm-label="footerCategories-general">一般</a></li> <li class="footer-list-item js-keyboard-selectable-item"><a href="/hotentry/social" class="cat-social js-keyboard-openable" data-gtm-label="footerCategories-social">世の中</a></li> <li class="footer-list-item js-keyboard-selectable-item"><a href="/hotentry/economics" class="cat-economics js-keyboard-openable" data-gtm-label="footerCategories-economics">政治と経済</a></li> <li class="footer-list-item js-keyboard-selectable-item"><a href="/hotentry/life" class="cat-life js-keyboard-openable" data-gtm-label="footerCategories-life">暮らし</a></li> <li class="footer-list-item js-keyboard-selectable-item"><a href="/hotentry/knowledge" class="cat-knowledge js-keyboard-openable" data-gtm-label="footerCategories-knowledge">学び</a></li> </ul> <ul class="footer-list footer-list--pc"> <li class="footer-list-item js-keyboard-selectable-item"><a href="/hotentry/it" class="cat-it js-keyboard-openable" data-gtm-label="footerCategories-it">テクノロジー</a></li> <li class="footer-list-item js-keyboard-selectable-item"><a href="/hotentry/entertainment" class="cat-entertainment js-keyboard-openable" data-gtm-label="footerCategories-entertainment">エンタメ</a></li> <li class="footer-list-item js-keyboard-selectable-item"><a href="/hotentry/game" class="cat-game js-keyboard-openable" data-gtm-label="footerCategories-game">アニメとゲーム</a></li> <li class="footer-list-item js-keyboard-selectable-item"><a href="/hotentry/fun" class="cat-fun js-keyboard-openable" data-gtm-label="footerCategories-fun">おもしろ</a></li> </ul> <ul class="footer-list"> <li class="footer-list-item"><a href="/guide/tools">アプリ・拡張機能</a></li> <li class="footer-list-item"><a href="https://bookmark.hatenastaff.com/">開発ブログ</a></li> <li class="footer-list-item"><a href="/help/">ヘルプ</a></li> <li class="footer-list-item"><a href="https://hatena.zendesk.com/hc/ja/categories/900000153166">お問い合わせ</a></li> <li class="footer-list-item footer-list-item--sp"><a href="/guide/guideline">ガイドライン</a></li> <li class="footer-list-item footer-list-item--sp"><a href="https://policies.hatena.ne.jp/rule">利用規約</a></li> <li class="footer-list-item footer-list-item--sp"><a href="https://policies.hatena.ne.jp/privacypolicy-ja">プライバシーポリシー</a></li> <li class="footer-list-item footer-list-item--sp"><a href="https://policies.hatena.ne.jp/cookie-policy">利用者情報の外部送信について</a></li> </ul> <ul class="footer-list footer-list--pc"> <li class="footer-list-item footer-list-item--pc"><a href="/guide/guideline">ガイドライン</a></li> <li class="footer-list-item footer-list-item--pc"><a href="https://policies.hatena.ne.jp/rule">利用規約</a></li> <li class="footer-list-item footer-list-item--pc"><a href="https://policies.hatena.ne.jp/privacypolicy-ja">プライバシーポリシー</a></li> <li class="footer-list-item footer-list-item--pc"><a href="https://policies.hatena.ne.jp/cookie-policy">利用者情報の外部送信について</a></li> </ul> </div> </div> <div class="footer-inner-group footer-bookmark-sns"> <h2 class="footer-title">公式Twitter</h2> <div class="footer-bookmark-list"> <ul class="footer-list"> <li class="footer-list-item"><a href="https://twitter.com/HatenaBookmark" target="_blank" rel="noopener" data-gtm-click-label="footer-officialTwitter-name">公式アカウント</a></li> <li class="footer-list-item"><a href="https://twitter.com/hatebu" target="_blank" rel="noopener" data-gtm-click-label="footer-hotentryTwitter-name">ホットエントリー</a></li> </ul> </div> </div> <div class="footer-inner-group footer-hatena"> <h2 class="footer-title">はてなのサービス</h2> <ul class="footer-list"> <li class="footer-list-item"><a href="https://hatenablog.com/" data-gtm-label="footerServices-blog">はてなブログ</a></li> <li class="footer-list-item"><a href="https://hatenablog.com/guide/pro?plus_via=hatenabookmark_footer&utm_source=hatenabookmark&utm_medium=referral&utm_campaign=hatenabookmark_to_hatenablog_pro&utm_content=hatenabookmark_footer" data-gtm-label="footerServices-blog-pro">はてなブログPro</a></li> <li class="footer-list-item"><a href="https://q.hatena.ne.jp/" data-gtm-label="footerServices-question">人力検索はてな</a></li> <li class="footer-list-item"><a href="http://d.hatena.ne.jp/" data-gtm-label="footerServices-keyword">はてなブログタグ</a></li> <li class="footer-list-item"><a href="http://hatenanews.com/" data-gtm-label="footerServices-hatenanews">はてなニュース</a></li> <li class="footer-list-item"><a href="https://soredoko.jp/" data-gtm-label="footerServices-soredoko">ソレドコ</a></li> </ul> </div> </div> <div class="footer-bottom"> <div class="footer-app"> <ul> <li class="footer-list-item"><a href="https://apps.apple.com/jp/app/hatenabukkumaku/id354976659?mt=8" target="_blank" rel="noopener" data-gtm-click-label="footer-app-ios"><img src="https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/images/v4/public/common/dl-button/appstore@2x.png" alt="App Storeからダウンロード"></a></li> <li class="footer-list-item"><a href="https://play.google.com/store/apps/details?id=com.hatena.android.bookmark&referrer=utm_source%3Dbookmark_sp%26utm_campaign%3Dbookmark_sp_user&hl=ja" target="_blank" rel="noopener" data-gtm-click-label="footer-app-android"><img src="https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/images/v4/public/common/dl-button/googleplay@2x.png" alt="Google Playで手に入れよう"></a></li> </ul> </div> <div class="copyright">Copyright © 2005-2025 <a href="http://www.hatena.ne.jp/">Hatena</a>. All Rights Reserved.</div> </div> </div> <div id="touch-footer-ad"></div> <div id="touch-footer-ad-placeholder"></div> <div class="modal-overlay"></div> <script type="text/javascript" src="https://b.st-hatena.com/21bb37de101e3d895eac61554a1ca07012b63961/js/v4/bookmark.star.js" async></script> <div class="js-head-notify is-hidden">設定を変更しました<span class="js-head-notify-close-button">x</span></div> </body> </html>