February 2013
Intermediate to advanced
380 pages
7h 45m
Japanese
Content preview from Nodeクックブック
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
255
レシピ 7.5 クロスサイトリクエストフォージェリを予防する
login/views/admin.jade
mixin del(id)
td
a.del(href='/admin/del?id=#{id}&p=#{page}&_csrf=#{_csrf}') //
⨂
// ...
管理画面ではプロフィールを削除できますが、
URL
の直接入力では削除できなくなりました。
解説
csrf
ミドルウェアはユニークなトークンを生成し、ユーザセッションに格納します。このトー
クンはアクションを伴うリクエスト（ログイン、ログアウト、追加、削除）に
_csrf
プロパティの
値として含まれている必要があります。
リクエストに含まれている
_csrf
の値が
session
オブジェクトに格納されている
_csrf
トークン
と一致しない場合、サーバはアクセスを拒否します。したがって、アクションは実行されません。
この仕組みがどうやって
CSRF
攻撃を防ぐのでしょうか。攻撃者は
_csrf
の値を知る手立てが
なく、サーバが受け入れる
POST
リクエストを捏造することができません。
しかし、
/del
ルートの防御は
POST
ほど安全ではありません。
_csrf
の値が
URL
に含まれてい
るため、攻撃者が
_csrf
の値を取得するためのわずかな隙があります。これは非常にわずかな隙で
はありますが、攻撃者にとっては有効な機会です。このような隙を作らないために、
GET
リクエ
ストは情報の取得にとどめておき、アクションを伴うリクエストは常に ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.