Gotanda.rb#56

Transcript

1. © 2023 Wantedly, Inc. Rails 7.0 ΞοϓάϨʔυͰ ηογϣϯ؅ཧ͕յΕͨ࿩ Dec. 20 2023 - ਫ໺ խ೭
2. ࠓ೔࿩͢͜ͱ © 2023 Wantedly, Inc.
3. ࠓ೔࿩͢ࣄ • ֤ϚΠΫϩαʔϏεͰผݸʹ CookieStore Λ࢖ͬͨηογϣϯ؅ཧΛߦ͏ϚΠΫϩ αʔϏεΞʔΩςΫνϟ © 2023 Wantedly, Inc. Rails 7.0 ΞοϓσʔτͰηογϣϯ؅ཧ͕յΕͨ࿩ https://www.wantedly.com/companies/wantedly/post_articles/466117 ΞʔΩςΫνϟ࣍ୈͰਂࠁͳӨڹ͕ग़Δ৔߹͕͋Δ
4. Կ͕ى͖ͨͷ͔ © 2023 Wantedly, Inc.
5. Կ͕ى͖ͨͷ͔ ϑΥʔϜࣗಈೖྗϘλϯ͕ಈ࡞͠ͳ͘ͳͬͨ © 2023 Wantedly, Inc. • 2022೥ͷ2݄͝Ζ
6. ى͖͍ͯͨΤϥʔ ϑΥʔϜදࣔ࣌ʹউखʹϩάΠϯঢ়ଶ͕ղআ͞ΕΔ © 2023 Wantedly, Inc. • ग़୫໨ͳ CookieStore ηογϣϯͰ্ॻ͖͞Εͯ͠·͏
7. ݪҼͷௐࠪ © 2023 Wantedly, Inc.
8. എܠ: Wantedly ͷΞʔΩςΫνϟ ೝূ༻ͷϚΠΫϩαʔϏεͱɺΤϯτϦʔϑΥʔϜ༻ͷ ϚΠΫϩαʔϏε͕ผΕ͍ͯΔ • ֤ϚΠΫϩαʔϏεͰผݸʹ CookieStore ηογϣϯΛݕূ͍ͯ͠Δ © 2023 Wantedly, Inc. ೝূ༻ϚΠΫϩαʔϏε ϑΥʔϜ༻ϚΠΫϩαʔϏε ೝূཁٻ ηογϣϯ৘ใ ϑΥʔϜೖྗཁٻ + ηογϣϯ৘ใ ϑΥʔϜ৘ใ ηογϣϯݕূ CookieStore ҉߸༻ڞ༗伴Λڞ༗
9. ೝূʹࣦഊͨ͠ݪҼͷௐࠪ CookieStore ηογϣϯͷ෮߸ʹࣦഊ • ೝূ༻ϚΠΫϩαʔϏεͷੜ੒ͨ͠ηογϣϯ͕ɺϑΥʔϜ༻ϚΠΫϩαʔϏεʹෆ ਖ਼ͳ΋ͷͱͯ͠ѻΘΕͨ © 2023 Wantedly, Inc. ೝূ༻ϚΠΫϩαʔϏε ϑΥʔϜ༻ϚΠΫϩαʔϏε ೝূཁٻ ηογϣϯ৘ใ ϑΥʔϜೖྗཁٻ + ηογϣϯ৘ใ ೝূΤϥʔ ηογϣϯݕূʹ ࣦഊ
10. CookieStore ηογϣϯ෮߸ʹࣦഊͨ͠ݪҼͷௐࠪ ηογϣϯ෮߸ͷͨΊͷڞ༗伴͕৯͍ҧ͍ͬͯͨ © 2023 Wantedly, Inc.
11. എܠ: ڞ༗伴ੜ੒ͷΞϧΰϦζϜ secret_key_base + ιϧτʹϋογϡؔ਺Λ܁Γฦ͠ద༻ • PBKDF2-HMAC • ૯౰ͨΓ߈ܸରࡦͷͨΊʹܭࢉΛॏ͍ͯ͘͠Δʢ͍ΘΏΔετϨονϯάʣ © 2023 Wantedly, Inc. ϋογϡؔ਺ʢSHA256౳ʣ secret_key_base + ιϧτ ڞ༗伴 KeyGenerator
12. Τϥʔͷى͖ͨݪҼ Rails 7.0 ͔ΒσϑΥϧτͰڞ༗伴ੜ੒ʹ༻͍Δ ϋογϡؔ਺͕มߋ͞Εͨ © 2023 Wantedly, Inc. SHA-1 SHA-256 secret_key_base + ιϧτ ڞ༗伴 ҟͳΔڞ༗伴 KeyGenerator
13. ໰୊ͷमਖ਼ © 2023 Wantedly, Inc.
14. Ұ࣌ରԠ ڞ༗伴ੜ੒ʹ༻͍Δϋογϡؔ਺ͷઃఆΛ໭ͨ͠ © 2023 Wantedly, Inc. • SHA-1 ͸࣌୅஗ΕͳͷͰɺ͓͍͓͍ SHA-256 ʹΞοϓσʔτ͍ͨ͠ • ԁ׈ͳҠߦʹ͸ϩʔςʔλ͕ඞཁ
15. ·ͱΊ © 2023 Wantedly, Inc.
16. ·ͱΊ • ֤ϚΠΫϩαʔϏεͰผݸʹ CookieStore Λ࢖ͬͨηογϣϯ؅ཧΛߦ͏ϚΠΫϩ αʔϏεΞʔΩςΫνϟ © 2023 Wantedly, Inc. Rails 7.0 ΞοϓσʔτͰηογϣϯ؅ཧ͕ӨڹΛड͚Δ https://www.wantedly.com/companies/wantedly/post_articles/466117 ΞʔΩςΫνϟ࣍ୈͰਂࠁͳӨڹ͕ग़Δ৔߹͕͋Δ