February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
319
23
장
CSRF 공격 방어
했다.
현대 웹 애플리케이션에서는 상태 비저장을
API
설계 요건으로 하는 경우가 많다. 상태 비저장
설계의 장점은 과소평가할 수 없다.
CSRF
토큰을 추가하려는 목적에서 상태 비저장 설계를 상
태 저장으로 변경하는 것은 현명하지 못하다. 상태 비저장
API
에도
CSRF
토큰을 쉽게 추가할
수 있는데 이를 위해 암호화가 필요하다.
상태 비저장 인증 토큰과 비슷하게 상태 비저장
CSRF
토큰은 다음으로 구성된다.
●
토큰을 갖는 사용자의 고유 식별자
●
타임스탬프 (만료를 위해 사용 )
●
암호학적 논스
cryptographic
nonce
1
(논스의 키는 서버에만 존재해야 함 )
이러한 요소들을 조합한다면 상태 비저장
CSRF
토큰은 실용적일 뿐 아니라 세션 관리의 확장
성이 떨어지는 상태 저장 방식에 비해 서버 리소스를 적게 소모하는 장점도 있다.
23.3
안티
CSRF
코딩 모범 사례
웹 애플리케이션 코드나 설계 단계에서
CSRF
위험을 제거 혹은 완화하는 방법이 많이 있다.
가장 효과적인 방법은 다음과 같다.
●
상태 비저장
GET
요청을 리팩터링
●
애플리케이션 차원의
CSRF
방어 구현
●
요청 검사 미들웨어를 도입
이와 같이 단순한 방어를 웹 애플리케이션에 구현하기만 해도
CSRF
를 노리는 해커에게 당할
위험을 극적으로 줄일 수
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.