February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
193
11
장
사이트 간 요청 위조(CSRF)
11.4
마치며
CSRF
공격은 웹 브라우저, 사용자, 웹 서버/
API
사이에 존재하는 신뢰 관계를 이용한다. 브라
우저는 기본적으로 사용자 장치에서 이뤄지는 행위는 사용자 본인의 의사로 행한 것으로 간주
한다.
그러나
CSRF
의 사례에서는 사용자가 행위를 한 것은 사실이나, 실제로 어떤 일이 일어나는지
인지하지 못하므로 온전히 사용자의 행위라고 할 수 없다. 사용자가 링크를 클릭하면 브라우저
는 사용자를 대신해
HTTP
GET
요청을 일으키며 링크를 어디서 받은 것인지 상관하지 않는
다. 그 링크를 믿기 때문에 귀중한 인증 데이터를
GET
요청과 함께 보낸다.
WhatWG
같은 브라우저 표준화 위원회에서 개발한 신뢰 모델이
CSRF
공격의 빌미를 제공한
다고 볼 수 있다. 앞으로 이러한 표준이 바뀐다면
CSRF
방식의 공격을 하기가 더 힘들어질 수
도 있겠지만, 당분간은 사라지지 않을 전망이다. 웹에 흔하며 익스플로잇하기 쉽다.
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.