February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
313
22
장
XSS 공격 방어
22.4.3
CSP
구현
CSP
는 단순히 문자열 구성 수정자로, 브라우저가 읽어서 보안 규칙으로 해석하는 것이므로 구
현하기 쉽다. 주요 브라우저는 여러 방식으로
CSP
를 구현할 수 있게 지원하며 가장 일반적인
방법은 다음과 같다.
●
서버가 요청할 때마다
Content
-
Security
-
Policy
헤더를 보내게 한다. 헤더의 데이터
자체가 보안 정책이 된다.
●
HTML
마크업에
<
meta
>
태그를 포함시킨다. 메타 태그는 다음과 같이 보일 것이다.
<meta http-equiv="Content-Security-Policy" content="script-src https://www.mega-bank.
com;">
프로그래밍 구조와 애플리케이션이 의존하는
API
를 이미 알고 있다면
CSP
를
XSS
완화의 첫
단계로 삼는 것이 현명하다. 이는 코드를 어디에서 소비할지 알고 어떻게 소비할지 안다면, 개
발을 시작할 때부터 올바른
CSP
문자열을 작성해 제대로 활용해야 함을 의미한다.
CSP
는 나
중에 쉽게 변경할 수 있다.
22.5
마치며
XSS
의 가장 일반적인 형태는 방어하기 쉽다.
XSS
로부터 웹사이트를 보호하는 데 어려움은 사
용자 제출 정보를 텍스트가 아닌
DOM
으로 표시하는 기능 요구사항으로부터 빚어지곤 한다.
네트워크 수준에서부터 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.