February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
315
23
장
CSRF 공격 방어
CSRF
공격 방어
CHAPTER
23
2
부에서 사용자의 인증된 세션을 이용해 요청을 일으키는 사이트 간 요청 위조 (
CSRF
) 공격을
다뤘다.
<
a
></
a
>
링크와
<
img
></
img
>
태그를 이용해
CSRF
공격을 수행했으며 웹 폼을 사용
해
HTTP
POST
를 통한
CSRF
공격도 수행했다.
CSRF
공격이 애플리케이션에 대해 효과적
이고 위험한 이유는 상승된 권한 수준에서 작동하며 인증된 사용자가 알아차리지 못할 때가 많
기 때문이다.
23
장에서는 그와 같은 공격으로부터 코드베이스를 지키고 인증된 세션을 타깃으로 삼는 공격
으로 사용자가 피해를 당할 가능성을 줄이는 방법을 배운다.
23.1
헤더 검증
<
a
></
a
>
링크를 사용한
CSRF
공격을 논의할 때 이메일을 사용하거나 타깃으로부터 완전히 독
립적인 웹사이트를 통해 링크를 배포했던 것을 기억할 것이다.
CSRF
요청의 원점은 웹 애플리케이션과 다른 경우가 많으므로 요청의 출처를 확인함으로써
CSRF
공격 위험을 완화할 수 있다.
HTTP
요청이 어디에서 왔는지는
referer
와
origin
헤
더로 확인한다. 주요 브라우저에서는 자바스크립트 프로그래밍으로 이 헤더들을 변경하지 못
하게 되어 있기 때문에 중요성이 있다. 브라우저의
referer
와
origin
헤더가 그와 같이 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.