Upgrade to Pro — share decks privately, control downloads, hide ads and more …

マクロな視点から捉える Web セキュリティ / Web Security from the ...

マクロな視点から捉える Web セキュリティ / Web Security from the Macro Perspective

セキュリティ・キャンプ全国大会 2020 オンラインの 講義 B7 「マクロな視点から捉える Web セキュリティ: Web インフラストラクチャを利用した攻撃とサイドチャネル攻撃の実践と評価」のスライドです。

発表者の情報: https://shift-js.info
Twitter: https://twitter.com/lmt_swallow

Takashi Yoneuchi

November 23, 2020
Tweet

More Decks by Takashi Yoneuchi

Other Decks in Programming

Transcript

  1. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ XIPBNJ 4FFIUUQTTIJGUKTJOGP ‣ :0/&6$)* 5BLBTIJถ಺وࢤ ‣ 5XJUUFS!MNU@TXBMMPX ‣

    ԿΛ͍ͯ͠Δਓʁ ‣ ηΩϡϦςΟΤϯδχΞ!גࣜձࣾ'MBUU4FDVSJUZ ‣ #!౦ژେֶཧֶ෦৘ใՊֶՊ ‣ ηΩϡϦςΟɾΩϟϯϓͱͷؔ܎ੑ͸ʁ ‣ ೥தԝେձ8FCηΩϡϦςΟΫϥεଔۀ ‣ ೥ϛχΩϟϯϓJOԬࢁߨࢣ ‣ ೥શࠃେձߨࢣʢ#ʣ ‣ Ҏ߱ηΩϡϦςΟɾΩϟϯϓڠٞձߨࢣҭ੒(޿ใ( 
  2. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ XIPBNJ ׆ಈ঺հ  ‣ ػց͕ಈ͍͍ͯΔͷΛݟΔͷ͕޷͖Ͱ͢ɻ ‣ ༡ͼͷҰ؀ͱͯ͠ɺ౓ʑंྠͷ࠶ൃ໌Λ͍ͯ͠·͢ɻ ‣

    ྫ-JOVY͕ಈ࡞͢Δ3*4$7$16Λࣗ࡞ͨ͠ ೥౓$16࣮ݧ༨ڵ  IUUQTEJBSZTIJGUKTJOGPCVJMEJOHBSJTDWDQVGPSMJOVY 
  3. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ XIPBNJ ׆ಈ঺հ  ‣ ಈ͍͍ͯΔػցͷηΩϡϦςΟΛߟ͑Δͷ΋޷͖Ͱ͢ɻ ‣ ݸਓతͳ׆ಈͱͯ͠͸ɺ5IFPSFUJDBMͱ1SBDUJDBMͷؒʹҐஔ͢ΔΑ͏ͳ߈ܸ ख๏ͷݕ౼ɾௐࠪΛ͍ͯ͠·͢ɻ

    ‣ ྫ"3PVHI*EFBPG#MJOE3FHVMBS&YQSFTTJPO*OKFDUJPO"UUBDL IUUQTEJBSZTIJGUKTJOGPCMJOESFHVMBSFYQSFTTJPOJOKFDUJPO  import re import sys secret = "this_is_secret_value" r = input("Give a regexp to search: ") _ = timeout(re.match(r, secret), 5) print("Done :P") ৚݅͑͞ἧ͑͹TFDSFUͷ ಺༰͕ϦʔΫͰ͖Δʂ
  4. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ຊߨٛͷ໨త ‣ 8FCΞϓϦέʔγϣϯͷηΩϡϦςΟΛɺैདྷΑΓ΋େہతʹϨϏϡʔͰ͖Δ ਓࡐΛ૿΍͢͜ͱɻ ‣ 8FCΞϓϦέʔγϣϯͷҰߦҰߦΛηΩϡΞʹॻͨ͘Ίͷํ๏࿦ɺ͍Θ͹8FCΞϓϦ έʔγϣϯͷϛΫϩͳηΩϡϦςΟ؍఺ʹؔͯ͠͸ɺ͢Ͱʹଟ͘ͷॻ੶΍8FCαΠτ ͷจݙʹΑΓઆ໌͞Ε͍ͯ·͢ɻ

    ‣ ຊߨٛͰ͸ɺ8FCΞϓϦέʔγϣϯΛ࣮Քಇʹ͍࣋ͬͯ͘ࡍʹ࣋ͨͳͯ͘͸ͳΒͳ͍ɺ 8FCΞϓϦέʔγϣϯͷϚΫϩͳηΩϡϦςΟ؍఺ΛओʹऔΓѻ͍͖ͬͯ·͢ɻ ‣ ࠷ઌ୺ͷ8FCηΩϡϦςΟྖҬʹڵຯΛֶ࣋ͬͨੜΛ૿΍͢͜ͱɻ ‣ ͥͻ๻ͱҰॹʹ8FCηΩϡϦςΟʹ͍ͭͯߟ͍͖͑ͯ·͠ΐ͏ʂ 
  5. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ͱ΋ɺߨٛ͸࣌ؒΆ͖ͬΓͳͷͰʜ ‣ ߨٛ͸I͔͋͠Γ·ͤΜ͔ΒɺԿ΋͔΋͓఻͑Ͱ͖ΔΘ͚Ͱ͸͋Γ·ͤΜ ‣ ͔͠͠ɺ͜ͷݶΒΕͨ࣌ؒͷதͰɺҎԼΛఏڙͰ͖ͨΒͱࢥ͍ͬͯ·͢ɻ ‣ ֶशͷ౔୆Λங͘ػձ ‣

    ຊߨٛͰ͸ɺ͸͡Ίʹɺ8FCηΩϡϦςΟྖҬͷ֓؍ʹ͍ͭͯऔΓѻ͍·͢ɻ ‣ ຊߨٛʹඞཁͳൣғͷ஌ࣝ͸ɺͰ͖Δ͚ͩTFMGDPOUBJOFEͳܗͰऔΓѻ͍·͢ɻ ‣ 8FCηΩϡϦςΟྖҬͷֶशΛਐΊ͍ͯ͘Լ஍Λ࡞Γ·͠ΐ͏ɻ ‣ ֶशͷࢦ਑ΛಘΔػձ ‣ 0QUJPOBMͱ͍͏෇ه͕͋Δԋश͸ɺΑΓਂ͘ߨٛͷຊےΛֶͿͨΊͷ΋ͷͰ͢ɻ ‣ "EWBODFEͱ͍͏෇ه͕͋Δԋश͸ɺߨٛͷຊےͱ͸ඞͣ͠΋ؔ܎ͷͳ͍ɺൃలత ͳ࿩୊ΛֶͿͨΊͷ΋ͷͰ͢ɻ ‣ ʮ͜͏͍͏ੈք͕͋ΔΜͩʯͱ͍͏ؾ͖ͮΛͨ͘͞Μಘͯ΋Β͑Δͱخ͍͠Ͱ͢ɻ 
  6. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ͓͠ͳ͕͖ ‣ $IBQUFS͍·ͷʮ8FCηΩϡϦςΟʯͱ͸ ‣ 8FCηΩϡϦςΟͳΔ޿େͳྖҬͷதͷԿΛຊߨ͕ٛऔΓѻ͏ͷ͔Λ໌ྎʹ͠·͢ɻ ‣ $IBQUFSҰ؏ੑΛอͪͳ͕Βͭͳ͛Δ ‣

    $IBQUFSͰಋೖ͢Δ؍఺ͷҰͭͰ͋Δɺιϑτ΢ΣΞؒͷҰ؏ੑʢ$SPTTTPGUXBSF *ODPOTJTUFODZʣʹ͍ͭͯऔΓѻ͍·͢ɻ ‣ $IBQUFSαΠυνϟωϧ߈ܸͷجૅ ‣ $IBQUFSͰಋೖ͢Δ؍఺ͷҰͭͰ͋Δɺ8FCΞϓϦέʔγϣϯͷαΠυνϟωϧ଱ ੑʹ͍ͭͯऔΓѻ͍·͢ɻ 
  7. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ యܕతͳΞʔΩςΫνϟ ‣ αʔόαΠυ8FCΞϓϦέʔγϣϯͷయܕతͳΞʔΩςΫνϟ ‣ .POPMJUIJD"SDIJUFDUVSF ‣ ෳ਺ͷػೳΛେ͖ͳͭͷΞϓϦέʔγϣϯͱͯ͠ߏ੒͢ΔΞʔΩςΫνϟ ‣

    .JDSPTFSWJDFT"SDIJUFDUVSF ‣ ۀ຿ػೳ΍νʔϜΛ୯Ґͱͯ͠ಠཱͨ͠αʔϏεʢ.JDSPTFSWJDFʣΛ࡞ΓɺͦΕΒ ͷ૯ମͱͯ͠ΞϓϦέʔγϣϯΛߏ੒͢ΔΞʔΩςΫνϟ   .POPMJUIJD"SDIJUFDUVSF .JDSPTFSWJDFT"SDIJUFDUVSF
  8. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ‣ ෳ਺ͷػೳ͕ͭͷΞϓϦέʔγϣϯʹ٧Ί͜·ΕΔΞʔΩςΫνϟͷ͜ͱɻ .POPMJUIJD"SDIJUFDUVSF  ػೳ ػೳ ػೳ ػೳ

    ػೳ ػೳ αʔόαΠυ8FCΞϓϦέʔγϣϯ ‣ ༷ʑͳཁૉ͔ΒͳΔ ‣ ϓϨθϯςʔγϣϯ૚ ‣ ϏδωεϩδοΫ૚ ‣ σʔλετΞΛऔΓѻ͏૚ ‣ ʜ
  9. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ .POPMJUIJD"SDIJUFDUVSF ߏ੒ͷΠϝʔδ  ػೳ ػೳ ػೳ ػೳ ػೳ

    ػೳ αʔόαΠυ8FCγεςϜ αʔόαΠυ8FCΞϓϦέʔγϣϯ ϩʔυόϥϯα౳ σʔλετΞ౳
  10. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ‣ ෳ਺ͷػೳ͕ͭͷΞϓϦέʔγϣϯʹ٧Ί͜·ΕΔΞʔΩςΫνϟͷ͜ͱɻ .POPMJUIJD"SDIJUFDUVSF ՝୊   ػೳ ػೳ

    ػೳ ػೳ ػೳ ػೳ αʔόαΠυ8FCΞϓϦέʔγϣϯ ‣ ༷ʑͳཁૉ͔ΒͳΔ ‣ ϓϨθϯςʔγϣϯ૚ ‣ ϏδωεϩδοΫ૚ ‣ σʔλετΞΛऔΓѻ͏૚ ‣ ʜ ίʔυϕʔε͕༰қʹ ංେԽͯ͠͠·͏
  11. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ .POPMJUIJD"SDIJUFDUVSF ՝୊   ػೳ ػೳ ػೳ ػೳ

    ػೳ ػೳ αʔόαΠυ8FCγεςϜ αʔόαΠυ8FCΞϓϦέʔγϣϯ σʔλετΞ౳ ϩʔυόϥϯα౳ εέʔϧ͚ͤͨ͞Ε͹શମΛ ಈ࡞ͤ͞ͳͯ͘͸͍͚ͳ͍
  12. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ۜͷ஄ؙ͸ͳ͍ ‣ .POPMJUIJD"SDIJUFDUVSFΑΓ.JDSPTFSWJDFT"SDIJUFDUVSFΛ࠾༻͢Δ৔߹ͷ ΄͏͕ͭΒ͍͜ͱ΋໪࿦͋Δɻ ‣ τϥϯβΫγϣϯ؅ཧ ‣ ͨ͘͞ΜͷΠϯλʔϑΣΠεఆٛ

    ‣ αʔϏεؒͷґଘؔ܎ͷ؅ཧ ‣ FUD ‣ ؔ৺ͷ෼཭ʹΑΔޮ཰Խͱɺ෼཭ͷͨΊͷੜ͡ΔΦʔόʔϔουͷͤΊ͍͕͗͋ ൃੜ͢Δ͜ͱΛɺ࠾༻࣌ʹ͸೦಄ʹஔ͘ͱΑ͍͔΋͠Εͳ͍ɻ ‣ 8FCͷจ຺Ͱͷ.POPMJUIJD"SDIJUFDUVSFWT.JDSPTFSWJDFT"SDIJUFDUVSFͱ͍ ͏࿩୊ʹݶΒͣɺʮૄ݁߹ʯΛ࣮ݱ͠Α͏ͱ͢Δͱɺେମಉ͡Α͏ͳนʹͿ͔ͭΔʜ 
  13. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ࣮ߦج൫Λ͔Β४උ͢Δͷ͸େม  ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ ؔ਺ ؔ਺

    ‣ αʔϏεΛӡ༻͢ΔͨΊʹϋʔυ΢ΣΞ͔Β༻ҙ͢Δ৔߹ʜ ‣ ૿΍͢ͷʹ΋ݮΒ͢ͷʹ΋ʹؾ߹͕ඞཁʹͳΔɻ ‣ ૿΍ͦ͏ʹ΋ߪೖʹ͕͔͔࣌ؒΔ ‣ ݮΒͨ͢Ίʹ͸ద੾ʹഇغ͢Δඞཁ͕͋Δ ‣ ʮյΕ͏Δʯͱ͍͏ҙࣝΛڧ࣋ͨ͘Ͷ͹ͳΒͳ͍ɻ ‣ ؒҧͬͯػثʹίʔώʔΛ͜΅͢ͱյΕΔ ‣ ಈ͔͠ଓ͚͍ͯΔ͚ͩͰ΋յΕΔ ‣ ͏·͘΍͍ͬͯ͘ʹ͸े෼ͳઐ໳ੑͱܦݧ͕ඞཁͰ͋Δɻ ‣ ͭΒ͍ ˞Ϋϥ΢υ؀ڥʹ΋େن໛ো֐͸ͨ·ʹ͋ΔͷͰɺʮյΕΔʯ͜ͱΛҙࣝ͠ͳͯ͘͸͍͚ͳ͍ͷ͸ ෺ཧػثΛऔΓѻ͏৔߹ಛ༗ͷͭΒ͞ɺͱ͍͏Θ͚Ͱ͸ͳ͍͕ʜ
  14. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ࣮ߦج൫ͷԾ૝Խɾந৅Խͷਐߦ ‣ ௕೥ʹ౉ͬͯΞϓϦέʔγϣϯͷ࣮ߦج൫ͷԾ૝Խɾந৅Խ͕ਐΊΒΕ͖ͯͨɻ ‣ *OGSBTUSVDUVSFBTB4FSWJDF *BB4  ‣

    1MBUGPSNBTB4FSWJDF 1BB4  ‣ $POUBJOFSBTB4FSWJDFʢ$BB4ʣ ‣ 'VODUJPOBTB4FSWJDF 'BB4  ‣ ࠓͰ͸ඇৗʹखܰʹ࣮ߦج൫͕࡞੒ɾഁغͰ͖ΔΑ͏ʹͳ͍ͬͯΔɻ 
  15. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 9BB4͕ఏڙ͢ΔൣғʢΠϝʔδʣ  ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ *BB4͕ఏڙ͢Δج൫ ؔ਺

    ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ $BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ 1BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ 'BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺
  16. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ࣮ߦج൫ͷԾ૝Խɾந৅Խͷਐߦ  ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ *BB4͕ఏڙ͢Δج൫ ؔ਺

    ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ $BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ 1BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ 'BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ϋʔυ΢ΣΞ͸9BB4ఏڙଆ͕ ؅ཧͯ͘͠ΕΔˠخ͍͠ʂ
  17. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ࣮ߦج൫ͷԾ૝Խɾந৅Խͷਐߦ  ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ *BB4͕ఏڙ͢Δج൫ ؔ਺

    ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ $BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ 1BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ϋʔυ΢ΣΞ 04 ϥϯλΠϜ ΞϓϦέʔγϣϯ 'BB4͕ఏڙ͢Δج൫ ؔ਺ ؔ਺ ͍Ζ͍Ζ؅ཧͯ͘͠ΕΔͷͰɺࣗ ෼͕औΓѻ͏΂͖ϨΠϠ͚ͩʹؔ ৺ΛڱΊΒΕΔˠخ͍͠ʂ
  18. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ΠϯϑϥετϥΫνϟͷίʔυԽ ‣ Ծ૝Խɾந৅Խ͞Εɺϋʔυ΢ΣΞͷ ΍Γ͘Γ͕Ӆṭ͞ΕͨΞϓϦέʔγϣ ϯ࣮ߦج൫͸ɺ΄΅७ਮͳιϑτ΢Σ Ξͱಉ౳ʹऔΓѻ͑ΔΑ͏ʹɻ ‣ ίϚϯυҰͭͰԾ૝ϚγϯΠϯελϯε

    Λ֬อͨ͠Γʜ ‣ ίʔυʹΑΓΠϯϑϥετϥΫνϟͷߏ ੒Λهड़ɾ؅ཧͨ͠Γʜ ‣ ॴҦ*OGSBTUSVDUVSFBT$PEFʢ*B$ʣ ‣ ຊߨٛͷԋश؀ڥ΋5FSSBGPSNͰߏ ੒͕هड़ɾ؅ཧ͞Ε͍ͯΔɻ  resource "google_container_cluster" "challenge_cluster" { name = "challenges" location = "asia-northeast1" initial_node_count = 1 cluster_autoscaling { enabled = true resource_limits { resource_type = "cpu" minimum = 3 maximum = 32 } resource_limits { resource_type = "memory" minimum = 3 maximum = 32 } } ...
  19. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ϛωʔδυͳϛυϧ΢ΣΞ ‣ ϚωʔδυͳܗͰఏڙ͞Ε͍ͯΔϛυϧ΢ΣΞ΋ͨ͘͞Μ͋Δɻ ‣ σʔλετΞͷྫ ‣ $MPVE42-΍"NB[PO3%4ͷΑ͏ͳ3%# ‣

    $MPVE%BUBTUPSF΍%ZOBNP%#ͷΑ͏ͳ,74 ‣ FUD ‣ ηΩϡϦςΟؔ࿈ͷػೳΛऔΓѻͬͯ͘ΕΔϛυϧ΢ΣΞͷྫ ‣ ΞΫηε੍ޚʹศརͳ$MPVE*EFOUJUZ"XBSF1SPYZ ‣ "848"'ͷΑ͏ͳ8"' ‣ FUD 
  20. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ʮ૊Έ߹ΘͤΔ͜ͱͰ࡞Δʯ ‣ ·ͱΊΔͱɺΞϓϦέʔγϣϯͷ࣮ߦج൫΍ϛυϧ΢ΣΞ͸ʜ ‣ ϋʔυ΢ΣΞͷ੍໿͕ʢΫϥ΢υϕϯμʹΑΓʣ͏·͘Ӆṭ͞ΕΔΑ͏ʹͳͬͨɻ ‣ ༰қʹมߋ΍औࣺબ୒͕Ͱ͖ΔΑ͏ʹͳͬͨɻ ‣

    ΞϓϦέʔγϣϯ։ൃͱ͍ۙํ๏Ͱߏ੒Ͱ͖ΔΑ͏ʹͳͬͨɻ ‣ ݁Ռɺʮ૊Έ߹ΘͤΔ͜ͱͰ࡞ΔʯతΞϓϩʔν͕औΓ΍͘͢ͳͬͨɻ ‣ ݱ୅ͷ8FCΞϓϦέʔγϣϯʹٻΊΒΕ͍ͯΔʮ౰ͨΓલ඼࣭ʯʢDGङ໺Ϟσϧʣ͸ߴ͍ɻ ‣ ྫෳࡶͳػೳཁ݅ ߴՄ༻ੑ ߴ଎ͳಈ࡞  ‣ શ෦͔Β࡞ΕΔͷ͸͔͍͍͕ͬ͜ɺߴ͍ʮ౰ͨΓલ඼࣭ʯΛୡ੒͢Δͷ͸ࠔ೉ɻ ‣ ৴པͰ͖Δ΋ͷΛ૊Έ߹ΘͤΔ͜ͱͰɺϕʔεͷʮ౰ͨΓલ඼࣭ʯΛఈ্͛͠ͳ͕Βɺ ࣗ෼͕࣮ݱ͢Δ΂͖͜ͱʹ஫ྗ͢Δ͜ͱ͕Ͱ͖Δʢخ͍͠ʂʣ 
  21. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ‣ ΞϓϦέʔγϣϯͷ࣮ߦج൫΍ϛυϧ΢ΣΞ͸ʜ ‣ ϋʔυ΢ΣΞͷ੍໿͕ʢΫϥ΢υϕϯμʹΑΓʣ͏·͘Ӆṭ͞ΕΔΑ͏ʹͳͬͨɻ ‣ ༰қʹมߋ΍औࣺબ୒͕Ͱ͖ΔΑ͏ʹͳͬͨɻ ‣ ΞϓϦέʔγϣϯ։ൃͱ͍ۙํ๏Ͱߏ੒Ͱ͖ΔΑ͏ʹͳͬͨɻ

    ‣ ݁Ռɺʮ૊Έ߹ΘͤΔ͜ͱͰ࡞ΔʯతΞϓϩʔν͕औΓ΍͘͢ͳͬͨʂ ‣ ݱ୅ͷ8FCΞϓϦέʔγϣϯʹٻΊΒΕ͍ͯΔʮ౰ͨΓલ඼࣭ʯ͸ߴ͍ɻ ‣ ྫෳࡶͳػೳཁ݅ ߴՄ༻ੑ ߴ଎ͳಈ࡞  ‣ ࢀߟङ໺Ϟσϧ ‣ શ෦͔Β࡞ΕΔͷ͸͔͍͍͕ͬ͜ɺߴ͍ʮ౰ͨΓલ඼࣭ʯΛୡ੒͢Δͷ͸ࠔ೉ɻ ‣ ৴པͰ͖Δ΋ͷΛ૊Έ߹ΘͤΔ͜ͱͰɺϕʔεͷʮ౰ͨΓલ඼࣭ʯΛఈ্͛͠ͳ͕Βɺ ࣗ෼͕࣮ݱ͢Δ΂͖͜ͱʹ஫ྗ͢Δ͜ͱ͕Ͱ͖Δɻ αʔόαΠυ8FCγεςϜͷηΩϡϦςΟ ߏ੒ɾ࣮ߦ؀ڥͷมԽΛ࠶ߟ͢Δ  ϙΠϯτ࿈ܞͷ૿Ճ ϙΠϯτಈ࡞ج൫ͷଟ༷Խ
  22. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ αʔόαΠυ8FCγεςϜͷηΩϡϦςΟ มԽ͔Β࠶ߟ͢Δ ‣ αʔόαΠυ8FCγεςϜ͕ܴ͑ͨมԽ ‣ ੹຿ͷ෼ࢄʜݩདྷαʔόαΠυ8FCΞϓϦέʔγϣϯͷ࣮૷தͰըҰత ʹऔΓѻΘΕ͍ͯͨ੹຿͕ɺ෼ࢄ͢ΔΑ͏ʹͳͬͨɻ ‣

    ࿈ܞͷ૿Ճʜͭͷૢ࡞ͷ࣮ݱͷͨΊʹɺෳ਺ͷιϑτ΢ΣΞ͕ؒ࿈ܞ͠ ͯಈ͘͜ͱ͕૿͖͑ͯͨɻ ‣ ಈ࡞ج൫ͷଟ༷ԽʜΞϓϦέʔγϣϯͷಈ࡞ج൫͕ɺ։ൃऀ͕༰қʹऔΓ ѻ͑Δର৅΁ͱมԽͨ͠ɻ ‣ ͦ͜Ͱɺ͜ͷྖҬͷηΩϡϦςΟΛɺҎԼͷ؍఺ʹ෼ׂͯ͠ߟ͑ͯΈΑ͏ɻ ‣ ηΩϡΞʹͭ͘Δ ‣ ηΩϡΞʹͭͳ͛Δ ‣ ηΩϡΞʹ͏͔͢͝ 
  23. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ηΩϡΞʹͭ͘Δ ‣ ·ͣ͸ίϯϙʔωϯτͷ֤ʑ͕ηΩϡΞʹ࡞ΒΕ͍ͯΔ͜ ͱ͕ɺ͢΂ͯͷେલఏɻ ‣ ·ͣ͸ʰମܥతʹֶͿ҆શͳ8FCΞϓϦέʔγϣϯͷ࡞Γ ํʱʢ௨শಙؙຊʣΛҰ௨Γಡ΋͏ɻ ‣

    8FCʹ·ͭΘΔجૅతͳ੬ऑੑΛɺ͜ͷߨٛ࣌ؒͷதͰҰ௨Γ औΓѻ͏ͷ͸೉͍͠ͷͰʜ ‣ ຊߨٛͰ͸ۙ೥੝Γ্͕͍ͬͯΔτϐοΫͱͯ͠ɺαΠυ νϟωϧ߈ܸʹ͍ͭͯͷΈऔΓѻ͏ɻ  .JDSPTFSWJDF ػೳ
  24. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ηΩϡΞʹͭͳ͛Δ ηΩϡΞͳܦ࿏Ͱͭͳ͛Δ ‣ αʔϏεؒͷ௨৴ΛͲ͏ηΩϡΞʹߦ͏͔ɺ΋ඇৗʹॏཁͳ؍఺ɻ ‣ αʔϏεؒͷ௨৴ܦ࿏ʹ͸౪ௌɾվ͟ΜΛૂ͏߈ܸऀ͕͍Δ͔΋ʜ ‣ ͭͷίϯϙʔωϯτ͕৵֐͞ΕΔ͜ͱͰɺࢥΘ͵ͱ͜Ζ͔Β௨৴͕ߦͳΘ

    ΕΔ͔΋͠Εͳ͍ʜ ‣ ຊߨٛͰ͸औΓѻΘͳ͍͕ɺ༷ʑͳϓϨΠϠʔ͕ؤு͍ͬͯΔͷͰɺ௥͍͔͚ͯ ΈΔͱָ͍͔͠΋͠Εͳ͍ɻ ‣ ྫ*TUJPͳͲͷ4FSWJDF.FTIϓϩμΫτͳͲ ‣ ͍ΘΏΔθϩτϥετϞσϧ͕ࠜఈʹ͋Δ 
  25. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ ͍·ͷʮ8FCηΩϡϦςΟʯͱ͸  αʔόαΠυ 8FCγεςϜ ΫϥΠΞϯταΠυ 8FCγεςϜ ‣

    ٞ࿦ͷൣғΛ໌֬ʹ͢ΔͨΊʹɺҎޙ͸ʮ8FCηΩϡϦςΟʯͱ͍͏ྖҬΛɺ ҎԼͷྖҬʹ෼͚ͯߟ͑Δɻ ‣ ΫϥΠΞϯταΠυ8FCγεςϜͷηΩϡϦςΟ ‣ αʔόαΠυ8FCγεςϜͷηΩϡϦςΟ
  26. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ ͍·ͷʮ8FCηΩϡϦςΟʯͱ͸  αʔόαΠυ 8FCγεςϜ ΫϥΠΞϯταΠυ 8FCγεςϜ ‣

    ͜ͷηΩϡϦςΟΛҎԼͷ̏؍఺͔Βߟ͑Α͏ ‣ ηΩϡΞʹͭ͘Δ ‣ ηΩϡΞʹͭͳ͛Δ ‣ ηΩϡΞʹ͏͔͢͝
  27. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ ͍·ͷʮ8FCηΩϡϦςΟʯͱ͸  αʔόαΠυ 8FCγεςϜ ΫϥΠΞϯταΠυ 8FCγεςϜ ‣

    ͜ͷηΩϡϦςΟΛҎԼͷ̏؍఺͔Βߟ͑Α͏ ‣ ηΩϡΞʹͭ͘Δ ‣ ηΩϡΞʹͭͳ͛Δ ‣ ηΩϡΞʹ͏͔͢͝ ηΩϡΞͳܦ࿏Ͱͭͳ͛Δ Ұ؏ੑΛอͬͯͭͳ͛Δ
  28. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ ͍·ͷʮ8FCηΩϡϦςΟʯͱ͸  αʔόαΠυ 8FCγεςϜ ΫϥΠΞϯταΠυ 8FCγεςϜ ;

    ‣ ͪ͜ΒΛֶͿͨΊͷૉࡐ΋ݱࡏ४උதʜ ‣ ϦϦʔεͰ͖ͨΒ5XJUUFS౳ͰҊ಺͠·͢ɻ ‣ $IFDLJUPVUIUUQTUXJUUFSDPNMNU@TXBMMPX
  29. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 5$1ίωΫγϣϯͷ࠶ར༻ ‣ )551ʜConnection: Keep-AliveϔομΛɺίωΫγϣϯͷ࠶ར༻Λࢦ ࣔ͢ΔͨΊʹར༻Ͱ͖Δɻ ‣ )551ʜ͸͡Ί͔ΒConnection: closeϔομʹΑΓίωΫγϣϯͷऴྃ

    ͕໌ࣔ͞Εͳ͍ݶΓɺίωΫγϣϯ͕࠶ར༻͞ΕΔɻ ‣ )551ʜͭͷίωΫγϣϯ಺ʹετϦʔϜͱ͍͏Ծ૝తͳ૒ํ޲௨৴࿏͕ෳ਺ ઃ͚ΒΕɺ)551ΑΓ΋ߋʹߴ౓ͳܗͰίωΫγϣϯ͕࠶ར༻͞ΕΔɻ  ΫϥΠΞϯτ 8FCαʔό ͭͷ5$1ίωΫγϣϯ
  30. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ $POUFOU-FOHUI ‣ $POUFOU-FOHUIϔομʜϦΫΤετʢPSϨεϙϯεʣͷૹ৴࣌ʹɺϦΫΤε τϘσΟ PSϨεϙϯεϘσΟ ͷαΠζΛ఻͑ΔͨΊͷϔομ ‣ ϦΫΤετ

    PSϨεϙϯε ͕ѹॖ͞Ε͍ͯΔ৔߹͸ѹॖޙͷαΠζ͕ࢦఆ͞ΕΔ ‣ ਐ਺Ͱදه͞ΕΔ  POST / HTTP/1.1 Host: example.com Content-Length: 8 test\r\n aa ϘσΟͷ௕͞ͷࢦఆ όΠτͷϘσΟ
  31. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ‣ 5SBOTGFS&ODPEJOHϔομ ‣ ϦΫΤετ PSϨεϙϯε ͷసૹํࣜΛද͢ϔομ ‣ DIVOLFE΍EFqBUF౳ɺ͍͔ͭ͘ͷσΟϨΫςΟϒ͕ଘࡏ͢Δ

    ‣ DIVOLFEσΟϨΫςΟϒ͕ࢦఆ͞Εͨ৔߹ ‣ (16 ਐ਺Ͱදه͞ΕͨνϟϯΫͷαΠζ)\r\n(࣮ࡍͷσʔλ)\r\nΛͭͷνϟϯΫͱͯ͠ɺ ίωΫγϣϯ্ʹਵ࣌νϟϯΫ͕ૹ৴͞Ε͍ͯ͘ ‣ αΠζͷνϟϯΫ͕ϦΫΤετ PSϨεϙϯε ͷऴ୺Λҙຯ͢Δ 5SBOTGFS&ODPEJOH  POST / HTTP/1.1 Host: example.com Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n సૹʹDIVOLFEํࣜ Λར༻͢Δ͜ͱͷએݴ νϟϯΫ  νϟϯΫ 
  32. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 3'$ʹΑΔͱʜ ‣ *GBNFTTBHFJTSFDFJWFEXJUICPUIB5SBOTGFS&ODPEJOHBOEB$POUFOU -FOHUIIFBEFSpFME UIF5SBOTGFS&ODPEJOHPWFSSJEFTUIF$POUFOU -FOHUI IUUQTUPPMTJFUGPSHIUNMSGDTFDUJPOΑΓҾ༻ 

    ‣ ͭ·Γɺ$POUFOU-FOHUIϔομͱ5SBOTGFS&ODPEJOHϔομ͕ͱ΋ʹࢦఆ͞Ε ͨ৔߹͸ɺ$POUFOU-FOHUIϔομ͕ແࢹ͞ΕΔ΂͖Ͱ͋Δɻ  POST / HTTP/1.1 Host: example.com Content-Length: 18 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n ແࢹ͞ΕΔ ར༻͞ΕΔ νϟϯΫྻͱͯ͠ ղऍ͞ΕΔ
  33. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 3'$ʹΑΔͱʜ ‣ *GBNFTTBHFJTSFDFJWFEXJUIPVU5SBOTGFS&ODPEJOHBOEXJUIFJUIFSNVMUJQMF $POUFOU-FOHUIIFBEFSpFMETIBWJOHEJ⒎FSJOHpFMEWBMVFTPSBTJOHMF $POUFOU-FOHUIIFBEFSpFMEIBWJOHBOJOWBMJEWBMVF UIFOUIFNFTTBHF GSBNJOHJTJOWBMJEBOEUIFSFDJQJFOU.645USFBUJUBTBOVOSFDPWFSBCMFFSSPS *GUIJTJTBSFRVFTUNFTTBHF

    UIFTFSWFS.645SFTQPOEXJUIB #BE 3FRVFTU TUBUVTDPEFBOEUIFODMPTFUIFDPOOFDUJPO IUUQTUPPMTJFUGPSH IUNMSGDTFDUJPOΑΓҾ༻  ‣ ͭ·ΓɺϦΫΤετதʹ஋ͷҟͳΔ$POUFOU-FOHUIϔομ͕ෳ਺͋Δͱ͖͸ɺ #BE3FRVFTU͕ฦ٫͞ΕΔ΂͖ɻ  POST / HTTP/1.1 Host: example.com Content-Length: 18 Content-Length: 30 ஋͕ҟͳΔ
  34. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ‣ ΫϥΠΞϯτ͔Β࣮ࡍͷ8FCΞϓϦέʔγϣϯʹ౸ୡ͢Δ·Ͱͷؒʹ͸ɺ -PBE#BMBODFS౳ͷ)551௨৴Λதܧ͢ΔΑ͏ͳαʔό͕͠͹͠͹ஔ͔ΕΔɻ ‣ Ҏ߱Ͱ͸ศ্ٓʜ ‣ ࣮ࡍͷ8FCΞϓϦέʔγϣϯαʔόΛʮόοΫΤϯυαʔόʯͱݺͿ ‣

    ͦͷલͰ)551௨৴Λதܧ͢ΔΑ͏ͳαʔόΛʮϑϩϯτΤϯυαʔόʯͱݺͿ ‣ ˞͜ͷลͷݺͼํ͸IUUQTQPSUTXJHHFSOFUSFTFBSDIIUUQEFTZODBUUBDLTSFRVFTUTNVHHMJOHSFCPSO͔ΒआΓͨ΋ͷ )551௨৴ͷ࿈࠯  ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό
  35. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ )5513FRVFTU4NVHHMJOHʢ)34 ‣ )5513FRVFTU4NVHHMJOHʢ)34ʣʜ͋ΔϦΫΤετͷॲཧʹؔ༩͢Δɺ ,FFQ"MJWFͳίωΫγϣϯʹΑΓ઀ଓ͞Εͨ)551Λղऍ͢Διϑτ΢ΣΞ ʢPSϋʔυ΢ΣΞʣ͕ͨͪɺҰ؏ੑͳ͘)551ϦΫΤετͷऴ୺Λղऍ͢Δ৔ ߹ʹߦ͑Δɺ͜ͷղऍࠩΛར༻ͨ͠߈ܸͷ͜ͱɻ ‣ ݹ͘͸೥ͷ8BUDIpSFͷ8IJUFQBQFSͳͲͰใࠂ͞Ε͍ͯΔɻ

    ࢀߟ8IJUFQBQFSIUUQTXXXDHJTFDVSJUZDPNMJC)5513FRVFTU4NVHHMJOHQEG ‣ ೥ͷ1PSU4XJHHFSͷൃදʹΑΓվΊͯ஫໨ΛूΊΔΑ͏ʹͳͬͨɻ ࢀߟ1PSU4XJHHFSʹΑΔهࣄIUUQTQPSUTXJHHFSOFUSFTFBSDIIUUQEFTZODBUUBDLT SFRVFTUTNVHHMJOHSFCPSO ‣ !SFHJMFSPʹΑΔ༷ʑͳใࠂ΋ษڧʹͳΔɻ ࢀߟ%&'$0/ͰͷൃදIUUQTXXXZPVUVCFDPNXBUDI WE76J1T.1: 
  36. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$-  ঢ়گઃఆ  ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό

    όοΫΤϯυ αʔό 5SBOTGFS&ODPEJOHΛ ༏ઌ͢ΔͱԾఆ $POUFOU-FOHUIΛ ༏ઌ͢ΔͱԾఆ ͭͷίωΫγϣϯ͕ ࠶ར༻͞ΕΔͱԾఆ
  37. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$-  ΫϥΠΞϯτଆ͔ΒᐆດͳϦΫΤετ͕ૹ৴͞Εͨͱ͢Δ  ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό

    όοΫΤϯυ αʔό POST / HTTP/1.1 Host: example.com Content-Length: 3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n ‣ ·ͣࠨͷྫͷΑ͏ͳϦΫΤετ͕ൃ ߦ͞Εͨͱ͢Δɻ ‣ ͜ͷϦΫΤετ͸ҎԼͷϔομΛ ྆ํؚΜͰ͍Δɻ ‣ $POUFOU-FOHUIϔομ ‣ 5SBOTGFS&ODPEJOHϔομ
  38. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$-  ϑϩϯτΤϯυαʔό͕5SBOTGFS&ODPEJOHϔομΛ༏ઌͨ͠ͱ͢Δͱʜ  POST / HTTP/1.1

    Host: example.com Content-Length: 3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό ‣ ϑϩϯτΤϯυαʔό͕ԾఆͲ͓Γ 5SBOTGFS&ODPEJOHϔομΛ༏ઌ ͨ͠ͱ͢Δͱɺ͜ͷϦΫΤετϘ σΟͷ͢΂͕ͯόοΫΤϯυαʔό ʹ޲͚ͯૹ৴͞ΕΔɻ ‣ ͜Ε͸3'$௨ΓͷڍಈͰ͋Δɻ
  39. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$-  ίωΫγϣϯதʹͭ໨ͷϦΫΤετ͕ૹ৴͞ΕΔ  POST / HTTP/1.1

    Host: example.com Content-Length:3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n όοΫΤϯυαʔόʹ ૹ৴͞ΕΔσʔλ ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό
  40. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$-  όοΫΤϯυαʔό͕$POUFOU-FOHUIϔομΛ༏ઌͨ͠ͱ͢Δͱʜ  POST / HTTP/1.1

    Host: example.com Content-Length:3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n όοΫΤϯυαʔό͕ ॲཧ͢Δൣғ ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό ॲཧ͞Εͣʹ࢒Δൣғ όοΫΤϯυαʔό͸ɺPOST ~ a\r\n·Ͱͷൣғ͕ϦΫΤετͩͱ ࢥͬͯॲཧ͢Δ Ҏ߱͸ॲཧ͞Εͣʹɺ ίωΫγϣϯதʹ࢒Δ
  41. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5&  ΫϥΠΞϯτଆ͔ΒผͷϦΫΤετ͕ૹ৴͞Εͨͱ͢Δ  ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό

    όοΫΤϯυ αʔό GET / HTTP/1.1 Host: example.com ‣ Ұํɺઌड़ͷϦΫΤετͷޙʹɺࠨ ͷྫͷΑ͏ͳʢͳΜͷม఩΋ͳ͍ʣ ϦΫΤετ͕ૹ৴͞Εͨͱ͢Δɻ
  42. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$-  ίωΫγϣϯதʹͭ໨ͷϦΫΤετ͕ૹ৴͞ΕΔ  POST / HTTP/1.1

    Host: example.com Content-Length:3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n GET / HTTP/1.1 ... όοΫΤϯυαʔό͕ ͢Ͱʹॲཧͨ͠ൣғ ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό ॲཧ͞Ε͍ͯͳ͍ൣғ ৽͘͠ૹ৴͞Εͨൣғ ޙଓͷϦΫΤετ͕ ϑϩϯτΤϯυαʔό͔Β ૹ৴͞ΕΔ
  43. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$-  ͭ໨ͷϦΫΤετ͕ॲཧ͞ΕΔ  POST / HTTP/1.1

    Host: example.com Content-Length:3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n GET / HTTP/1.1 ... όοΫΤϯυαʔό͕ ͢Ͱʹॲཧͨ͠ൣғ ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό όοΫΤϯυαʔό͕ ଓ͍ͯॲཧ͢Δൣғ όοΫΤϯυαʔό͸࢒ͬͨ ෦෼͔ΒॲཧΛ࢝ΊΔ
  44. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$-͜͜·ͰͰԿ͕ى͔ͬͨ͜  POST / HTTP/1.1 Host: example.com

    Content-Length: 3 Transfer-Encoding: chunked a\r\n ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό POST / HTTP/1.1 Host: example.com Content-Length: 3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n GET / HTTP/1.1 ... 0123456789\r\n 0\r\n GET / HTTP/1.1 ... ϑϩϯτΤϯυαʔό͕தܧͨ͠ϦΫΤετ όοΫΤϯυαʔό͕ॲཧͨ͠ϦΫΤετ ʺ
  45. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ 5&$-͜͜·ͰͰԿ͕ى͔ͬͨ͜  POST / HTTP/1.1 Host: example.com

    Content-Length: 3 Transfer-Encoding: chunked a\r\n ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό POST / HTTP/1.1 Host: example.com Content-Length: 3 Transfer-Encoding: chunked a\r\n 0123456789\r\n 0\r\n GET / HTTP/1.1 ... 0123456789\r\n 0\r\n GET / HTTP/1.1 ... ϑϩϯτΤϯυαʔό͕தܧͨ͠ϦΫΤετ όοΫΤϯυαʔό͕ॲཧͨ͠ϦΫΤετ ʺ ߈ܸऀ͸ޙଓͷϦΫΤετͷઌ಄ʹ ೚ҙͷόΠτྻΛ෇ՃͰ͖Δʂ
  46. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5&  ঢ়گઃఆ  ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό

    όοΫΤϯυ αʔό $POUFOU-FOHUIΛ ༏ઌ͢ΔͱԾఆ 5SBOTGFS&ODPEJOHΛ ༏ઌ͢ΔͱԾఆ ͭͷίωΫγϣϯ͕ ࠶ར༻͞ΕΔͱԾఆ
  47. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5&  ΫϥΠΞϯτଆ͔ΒᐆດͳϦΫΤετ͕ૹ৴͞Εͨͱ͢Δ  ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό

    όοΫΤϯυ αʔό POST / HTTP/1.1 Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIX ‣ ·ͣࠨͷྫͷΑ͏ͳϦΫΤετ͕ൃ ߦ͞Εͨͱ͢Δɻ ‣ ͜ͷϦΫΤετ͸ҎԼͷϔομΛ ྆ํؚΜͰ͍Δɻ ‣ $POUFOU-FOHUIϔομ ‣ 5SBOTGFS&ODPEJOHϔομ
  48. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5&  ϑϩϯτΤϯυαʔό͕$POUFOU-FOHUIϔομΛ༏ઌͨ͠ͱ͢Δͱʜ  POST / HTTP/1.1

    Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIX ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό ‣ ϑϩϯτΤϯυαʔό͕ԾఆͲ͓Γ $POUFOU-FOHUIϔομΛ༏ઌͨ͠ ͱ͢Δͱɺ͜ͷϦΫΤετϘσΟͷ ͢΂͕ͯόοΫΤϯυαʔόʹ޲͚ ͯૹ৴͞ΕΔɻ ‣ $POUFOU-FOHUIΛ༏ઌ͢Δͷ͸3'$ ҧ൓͕ͩɺݱ࣮ੈքͷΞϓϦέʔγϣϯ Ͱ΋ྫ͕͍͔ͭ͘ใࠂ͞Ε͍ͯΔʢޙ ड़ʣɻ
  49. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5&  ίωΫγϣϯதʹͭ໨ͷϦΫΤετ͕ૹ৴͞ΕΔ  POST / HTTP/1.1

    Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIX ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό όοΫΤϯυαʔόʹ ૹ৴͞ΕΔσʔλ
  50. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5&  όοΫΤϯυαʔό͕5SBOTGFS&ODPEJOHϔομΛ༏ઌͨ͠ͱ͢Δͱʜ  POST / HTTP/1.1

    Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIX ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό όοΫΤϯυαʔό͕ ॲཧ͢Δൣғ ॲཧ͞Εͣʹ࢒Δൣғ όοΫΤϯυαʔό͸ɺPOST ~ 0\r\n·Ͱͷൣғ͕ϦΫΤετͩͱ ࢥͬͯॲཧ͢Δ Ҏ߱͸ॲཧ͞Εͣʹɺ ίωΫγϣϯதʹ࢒Δ
  51. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5&  ΫϥΠΞϯτଆ͔ΒผͷϦΫΤετ͕ૹ৴͞Εͨͱ͢Δ  ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό

    όοΫΤϯυ αʔό GET / HTTP/1.1 Host: example.com ‣ Ұํɺઌड़ͷϦΫΤετͷޙʹɺࠨ ͷྫͷΑ͏ͳʢͳΜͷม఩΋ͳ͍ʣ ϦΫΤετ͕ૹ৴͞Εͨͱ͢Δɻ
  52. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5&  ίωΫγϣϯதʹͭ໨ͷϦΫΤετ͕ૹ৴͞ΕΔ  POST / HTTP/1.1

    Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIXGET / HTTP/1.1 ... ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό όοΫΤϯυαʔό͕ ͢Ͱʹॲཧͨ͠ൣғ ॲཧ͞Ε͍ͯͳ͍ൣғ ৽͘͠ૹ৴͞Εͨൣғ ޙଓͷϦΫΤετ͕ ϑϩϯτΤϯυαʔό͔Β ૹ৴͞ΕΔ
  53. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5&  ͭ໨ͷϦΫΤετ͕ॲཧ͞ΕΔ  POST / HTTP/1.1

    Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIXGET / HTTP/1.1 ... ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό όοΫΤϯυαʔό͕ ͢Ͱʹॲཧͨ͠ൣғ όοΫΤϯυαʔό͕ ଓ͍ͯॲཧ͢Δൣғ όοΫΤϯυαʔό͸࢒ͬͨ ෦෼͔ΒॲཧΛ࢝ΊΔ
  54. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5&͜͜·ͰͰԿ͕ى͔ͬͨ͜  POST / HTTP/1.1 Host: example.com

    Content-Length: 9 Transfer-Encoding: chunked 0\r\n ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό POST / HTTP/1.1 Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIX GET / HTTP/1.1 ... PREFIXGET / HTTP/1.1 ... ϑϩϯτΤϯυαʔό͕தܧͨ͠ϦΫΤετ όοΫΤϯυαʔό͕ॲཧͨ͠ϦΫΤετ ʺ
  55. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ұ؏ੑͷͳ͍ղऍ͕ى͜Δͱ͖ͷ໰୊ $-5&͜͜·ͰͰԿ͕ى͔ͬͨ͜  POST / HTTP/1.1 Host: example.com

    Content-Length: 9 Transfer-Encoding: chunked 0\r\n ΫϥΠΞϯτ ϑϩϯτΤϯυ αʔό όοΫΤϯυ αʔό POST / HTTP/1.1 Host: example.com Content-Length: 9 Transfer-Encoding: chunked 0\r\n PREFIX GET / HTTP/1.1 ... PREFIXGET / HTTP/1.1 ... ϑϩϯτΤϯυαʔό͕தܧͨ͠ϦΫΤετ όοΫΤϯυαʔό͕ॲཧͨ͠ϦΫΤετ ߈ܸऀ͸ࠓճ΋ޙଓͷϦΫΤετͷ ઌ಄ʹ೚ҙͷόΠτྻΛ෇ՃͰ͖Δʂ
  56. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ )34߈ܸͷར༻ઌ ‣ )34੬ऑੑʹΑΓɺҎԼͷΑ͏ͳૢ࡞͕ՄೳʹͳΔͷͰʜ ‣ ޙଓͷϦΫΤετͷϦΫΤετϥΠϯͷ੍ޚɾϔομͷ෇Ճ ‣ ޙଓͷϦΫΤετͷϘσΟͷมߋ ‣

    ౰વɺҎԼͷΑ͏ͳ߈ܸʹར༻Ͱ͖Δɻ ‣ ޙଓͷϦΫΤετͷ%P4 ‣ ࣗ༝౓ͷߴ͍ϦΫΤετͷൃߦ ‣ 8FC$BDIF1PJTPOJOH౳ͷΩϟογϡʹؔ࿈ͨ͠߈ܸʢޙड़ʣ ‣ ·ͨɺ8FCΞϓϦέʔγϣϯݻ༗ͷػೳΛ࢖ͬͨ߈ܸʹ΋ར༻Ͱ͖Δɻ ‣ ϦιʔεΛ౤ߘɾӾཡͰ͖ΔΑ͏ͳػೳ͕͋Δ8FCΞϓϦέʔγϣϯʢFHܝࣔ൘ʣʹ͓͍ͯ ͸ɺଞऀͷϦΫΤετ಺༰ΛϦʔΫͰ͖Δ৔߹͕͋Δɻ ‣ 944੬ऑੑ͕͋Δ৔߹ɺͦΕΛ᠘ϖʔδʹ༠ಋ͢ΔͳͲͷૢ࡞ͳ͠ʹɺผͷϢʔβͷϒϥ΢β্ ͰൃՐͤ͞ΒΕΔ৔߹͕͋Δɻ 
  57. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ )34߈ܸͷରࡦ ‣ )34͸ɺ͋ΔϦΫΤετͷॲཧʹؔ༩͢Δɺ,FFQ"MJWFͳίωΫγϣϯʹΑΓ ઀ଓ͞Εͨ)551Λղऍ͢Διϑτ΢ΣΞʢPSϋʔυ΢ΣΞʣ͕ͨͪɺҰ؏ੑ ͳ͘)551ϦΫΤετͷऴ୺Λղऍ͢Δ৔߹ʹߦ͑Δɺ͜ͷղऍࠩΛར༻ͨ͠ ߈ܸͷ͜ͱɺͩͬͨͷͰɺରࡦ͸ʜ ‣ ํ਑ϑϩϯτΤϯυαʔόͱόοΫΤϯυؒͷ,FFQ"MJWFͳίωΫγϣϯΛࣺͯΔ

    ‣ ຖճίωΫγϣϯΛுΓ௚͢Α͏ʹ͢Δ ‣ )551Λར༻͢Δ ‣ ํ਑)551ϦΫΤετͷऴ୺ͷղऍͷҰ؏ੑΛอͭ ‣ ར༻͢Διϑτ΢ΣΞΛ࠷৽ʹอͭ ‣ ϦΫΤετΛ࠷΋ΫϥΠΞϯτʹ͍ۙҐஔͰਖ਼نԽͯ͠͠·͏ ‣ )551ϦΫΤετͷॲཧʹؔ༩͢Διϑτ΢ΣΞΛ౷Ұ͢Δʢ͜Ε͸ඇݱ࣮తʣ 
  58. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ωϟογϡͷ੍ޚ ‣ ઌ߲ͷΑ͏ͳࣄ৘͔Β΋࡯͞ΕΔΑ͏ʹɺΩϟογϡ͸੍ޚͰ͖Δɻ ‣ ओʹ੍ޚ͍ͨ͜͠ͱ͸ʜ ‣ ԿΛΩϟογϡ͢Δ͔ ‣

    Ωϟογϡ͢ΔͳΒɺ͍ͭ·ͰΩϟογϡ͢Δ͔ ‣ ੍ޚʹ͸ओʹҎԼ͕ར༻͞ΕΔɻ ‣ $BDIF$POUSPMϔομ ‣ &YQJSFTϔομ ‣ Ωϟογϡαʔό΍$%/αʔϏεݻ༗ͷػೳ 
  59. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ $BDIF$POUSPMϔομ ‣ ˞ຊདྷ͸ϦΫΤετɾϨεϙϯεͷ྆ํͷ੍ޚʹ࢖͑Δϔομ͕ͩɺҎ߱Ͱ͸Ϩεϙϯεத ͷ$BDIF$POUSPMϔομʹ͍ͭͯͷΈߟ͑Δɻ ‣ $BDIF$POUSPMϨεϙϯεϔομ͸ɺҎԼͷΑ͏ͳσΟϨΫςΟϒΛࣔ͢͜ͱͰɺͦͷϦ ιʔεΛΩϟογϡ͢ΔଆͷڍಈΛ੍ޚ͢ΔͨΊʹ༻͍ΒΕΔɻ ‣

    NBYBHFTNBYBHFʜఴ͑ΒΕͨύϥϝʔλͱͱ΋ʹɺ༗ޮظݶʢඵʣΛࣔ͢ ‣ OPDBDIFʜΦϦδϯαʔό΁ͷ֬ೝͳ͠Ωϟογϡ͕࠶ར༻͞Εͯ͸ͳΒͳ͍͜ͱΛࣔ͢ ‣ OPTUPSFʜΩϟογϡ͞Εͯ͸ͳΒͳ͍͜ͱΛࣔ͢ ‣ QVCMJDQSJWBUFʜϦιʔε͕ಛఆͷݸਓ޲͚Ͱ͋ΔͰ͸ͳ͍͜ͱΛࣔ͢ ‣ FUD  Cache-Control: directive, directive, ...
  60. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ݻ༗ͷػೳʹΑΔ੍ޚ ‣ Ωϟογϡαʔό΍$%/αʔϏε͸ɺΩϟογϡ੍ޚͷͨΊͷಛผͳ࢓૊ΈΛ ఏڙ͍ͯ͠Δ৔߹͕͋Δɻ ‣ ͦͷΑ͏ͳ࢓૊Έͷྫ ‣ 7BSOJTI΍'BTUMZͰ͸7$-ͱ͍͏%4-ͰΩϟογϡػߏΛ੍ޚͰ͖Δɻ

    ‣ $MPVEqBSFͷΩϟογϡ͸1BHF3VMFͱ͍͏ϧʔϧʹΑΓ੍ޚͰ͖Δɻ ‣ "LBNBJʹ͓͍ͯ΋؅ཧը໘͔ΒΩϟογϡର৅΍ظݶΛ੍ޚͰ͖Δɻ ‣ FUD  sub vcl_recv { if (req.url !~ "^/static") { return(pass); } } 63-͕TUBUJD͔Β ࢝·Βͳ͍৔߹ Ωϟογϡର৅֎ʹ
  61. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ΩϟογϡΛ༻͍ͨඇࣗ໌ͳ߈ܸ ‣ ͜͜·Ͱ͸Ωϟογϡઃఆʹؔ͢Δɺҙਤͤ͵ϛεͷ࿩ͩͬͨɻ ‣ ҰํɺΩϟογϡػೳΛҙਤతʹར༻͢Δ߈ܸ΋ଘࡏ͍ͯ͠Δɻ ‣ 8FC$BDIF1PJTPOJOH ‣

    ޻෉ͯ͠ѱҙͷ͋ΔσʔλΛΩϟογϡͤ͞ɺͦΕΛଞऀʹ഑৴͢Δ߈ܸ ‣ $BDIF1PJTPOJOH%FOJBMPG4FSWJDFʢ$1%P4ʣ ‣ ޻෉ͯ͠ΤϥʔϖʔδΛΩϟογϡͤ͞Δ͜ͱʹΑΓαʔϏεͷ%P4Λى͜͢߈ܸ ‣ 8FC$BDIF%FDFQUJPOʢ8$%ʣ ‣ ຊདྷΩϟογϡ͞Εͳ͍΂͖Ͱ͋ΔϢʔβͷσʔλΛ޻෉ͯ͠Ωϟογϡͤ͞ɺͦ ΕΛ౪ΈݟΔ߈ܸ 
  62. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FC$BDIF1PJTPOJOH ‣ 8FC$BDIF1PJTPOJOHʜѱҙͷ͋ΔίϯςϯπΛʢͳΜͱ͔ͯ͠ʣΩϟογϡ αʔόʹΩϟογϡͤ͞ɺͦΕΛଞऀʹ഑৴͢Δɺͱ͍͏߈ܸɻ ‣ +BWB4DSJQUΛ஫ೖͨ͠ϖʔδΛ഑৴͢Δ͜ͱͰ944߈ܸ͕Ͱ͖Δ ‣ ʢ৔߹ʹΑͬͯ͸ʣϚϧ΢ΣΞͷ഑෍αʔό౳ʹ΋ར༻Ͱ͖Δɻ

     ߈ܸऀ Ωϟογϡ αʔό ΦϦδϯ αʔό ߈ܸର৅ͷϢʔβ ߈ܸϦΫΤετΛૹ৴ ߈ܸऀʹΑΓૢ࡞͞Εͨ ίϯςϯπ͕ฦ٫͞ΕΔ ߈ܸऀʹΑΓૢ࡞͞Εͨ ίϯςϯπ͕Ωϟογϡ͞ΕΔ ߈ܸऀͱಉ͡ ϦιʔεΛཁٻ ߈ܸऀʹΑΓૢ࡞͞Εͨ ίϯςϯπ͕ฦ٫͞ΕΔ
  63. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FC$BDIF1PJTPOJOH ‣ ѱҙͷ͋Δίϯςϯπͷૠೖ͸ʁ ‣ Ωϟογϡʹ͸Ωʔʢ˺ΩϟογϡΛอ؅৔ॴ͔Β୳͢ͱ͖ʹ࢖ΘΕΔ৘ใʣ͕͋Δɻ ‣ 3FqFDUFE944੬ऑੑ͸ϒϥ΢β͔Βൃߦ͞ΕΔϦΫΤετ͕ى఺ͱͳΔͨΊɺ੍໿͕ ݫ͍͕͠ɺ߈ܸऀ͸ࣗ෼ͷखݩ͔ΒͰ͋Ε͹ɺࣗ༝ʹϦΫΤετ͕ૹ৴Ͱ͖Δɻ

    ‣ Ωϟογϡ͞ΕΔϖʔδ΁ͷϦΫΤετΛߦ͍ɺΩϟογϡΩʔͰ͸ͳ͍෦෼ʹΑΓ 3FqFDUFE944੬ऑੑ΍ɺ౎߹ͷྑ͍ϦΫΤετͷมԽ͕Ҿ͖ىͤ͜Ε͹ɺΩϟογϡ ܦ༝ͰଞऀΛ߈ܸͰ͖Δ͜ͱʹͳΔʂ ‣ ࢀߟจݙ ‣ 1SBDUJDBM8FC$BDIF1PJTPOJOH IUUQTQPSUTXJHHFSOFUSFTFBSDIQSBDUJDBMXFCDBDIFQPJTPOJOH ‣ 8FC$BDIF&OUBOHMFNFOU/PWFM1BUIXBZTUP1PJTPOJOH IUUQTQPSUTXJHHFSOFUSFTFBSDIXFCDBDIFFOUBOHMFNFOU 
  64. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FC$BDIF%FDFQUJPO  ߈ܸྫͷঢ়گઃఆ  ߈ܸର৅ͷϢʔβ Ωϟογϡ αʔό ΦϦδϯ

    αʔό NZQBHFͱNZQBHFGPPDTT͕ ಉ͘͡ϚΠϖʔδΛฦ͢ͱԾఆ͢Δ ύε͕ DTTͷܗΛ͍ͯ͠ΔϦιʔεΛ ໰౴ແ༻ͰΩϟογϡ͢ΔͱԾఆ͢Δ
  65. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FC$BDIF%FDFQUJPO  ߈ܸର৅ͷϢʔβ͔ΒΈͨϦιʔεΛΩϟογϡͤ͞Δ  ߈ܸର৅ͷϢʔβ Ωϟογϡ αʔό ΦϦδϯ

    αʔό ༠ಋ͞ΕͯNZQBHFGPPDTT ʹΞΫηε Ωϟογϡ͕ͳ͍ͷͰ ΦϦδϯαʔόʹ໰͍߹Θͤ NZQBHFGPPDTT ʢத਎͸NZQBHFʣΛฦ٫  DTTܗࣜͷϦιʔεͳͷͰ Ծఆ௨ΓΩϟογϡ͢Δ Ϩεϙϯε͕ಧ͘ ߈ܸऀ
  66. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FC$BDIF%FDFQUJPO  Ωϟογϡͤͨ͞ϦιʔεΛϦʔΫ͢Δ  ߈ܸର৅ͷϢʔβ Ωϟογϡ αʔό ΦϦδϯ

    αʔό ༠ಋ͞ΕͯNZQBHFGPPDTT ʹΞΫηε Ωϟογϡ͕ͳ͍ͷͰ ΦϦδϯαʔόʹ໰͍߹Θͤ NZQBHFGPPDTT ʢத਎͸NZQBHFʣΛฦ٫  DTTܗࣜͷϦιʔεͳͷͰ Ծఆ௨ΓΩϟογϡ͢Δ Ϩεϙϯε͕ಧ͘ ߈ܸऀ NZQBHFGPPDTT ʹΞΫηε Ωϟογϡ͔Βɺ߈ܸର৅ͷϢʔβ͔Βݟͨ NZQBHFGPPDTTNZQBHFͷத਎͕ฦΔ
  67. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FC$BDIF%FDFQUJPO ‣ 8FC$BDIF%FDFQUJPOʢ8$%ʣ߈ܸ ‣ ͋Δਓ1͕ΞΫηεͰ͖ΔϦιʔε3͕͋Δͱ͢Δɻ ‣ ·ͨɺ3Λࢦ͢63-Ͱ͋ͬͯɺ͔ͭΩϟογϡαʔό͕ΩϟογϡΛͯ͠͠·͏Α͏ ͳ63-͕ଘࡏ͢Δ৔߹Λߟ͑Δɻ

    ‣ ͜ͷͱ͖ɺਓ1Λɺͦͷ63-ʹ༠ಋ͢Δ͜ͱͰɺ3͕Ωϟογϡ͞ΕΔɻ ‣ ߈ܸऀ͸ޙ͔Βͦͷ63-ʹΞΫηε͢Δ͜ͱͰɺຊདྷ߈ܸऀ͕3ʹΞΫηεͰ͖ͳ͍ ৔߹Ͱ͋ͬͯ΋ɺΩϟογϡ͞Εͨ3ΛಘΔ͜ͱ͕Ͱ͖ͯ͠·͏ɻ ‣ ࢀߟจݙ ‣ 8FC$BDIF%FDFQUJPO"UUBDLʢ(JM ʣ IUUQTXXXCMBDLIBUDPNEPDTVTXFEOFTEBZVT(JM8FC$BDIF%FDFQUJPO"UUBDLXQQEG ‣ $BDIFEBOE$POGVTFE8FC$BDIF%FDFQUJPOJOUIF8JMEʢ.JSIFJEBSJFUBMʣ IUUQTXXXVTFOJYPSHDPOGFSFODFVTFOJYTFDVSJUZQSFTFOUBUJPONJSIFJEBSJ 
  68. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ͜ΕΒͷ໰୊Λආ͚ΔͨΊʹ ‣ ΦϦδϯαʔό͔Β$BDIF$POUSPMϔομΛద੾ʹૹग़͠Α͏ɻ ‣ ద੾ʹOPTUPSF౳ͷσΟϨΫςΟϒΛૹग़͠Α͏ɻ ‣ Կ͕ద੾͔͸ঢ়گʹΑΔͷͰʢSFDBQ'BTUMZ͸OPTUPSFΛແࢹ͢Δʣɺదٓ3'$ ΍Ωϟογϡαʔό$%/αʔϏεͷ࢓༷ΛಡΈɺ͔֬ΊΔඞཁ͕͋Δɻ

    ‣ ΋ͪΖΜɺΩϟογϡͯ͠Α͍΋ͷ͸ੵۃతʹΩϟογϡ͍ͯ͘͠΂͖ɻ ‣ Ωϟογϡαʔό$%/αʔϏεͱΦϦδϯαʔόͷҰ؏ੑΛอͱ͏ɻ ‣ $BDIF$POUSPMϔομͰͷઃఆͱɺιϑτ΢ΣΞɾαʔϏεݻ༗ͷઃఆ͕৯͍ҧ͏Α͏ ͳ৔໘ΛɺͰ͖Δ͚ͩ࡞Βͳ͍͜ͱ͕େ੾Ͱ͋Δɻ ‣ ಛʹ1BUI$POGVTJPOʹ͸஫ҙ͢Δඞཁ͕͋Δɻ 
  69. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ϨεϙϯεϘσΟͷੜ੒ ‣ ϨεϙϯεϘσΟ͸༷ʑͳܗͰੜ੒͞ΕΔ  <ul> {% for item

    in items %} <li>{{ item.name }}</li> <p>{{ item.description }}</p> {% endfor %} </ul> ϧʔϓͷ։࢝ ϧʔϓͷऴྃ ม਺஋ͷల։ +JOKBςϯϓϨʔτ <?php $q = $_GET['q']; echo htmlspecialchars($q, ENT_QUOTES, 'UTF-8'); ?> 1)1εΫϦϓτ (&5ύϥϝʔλΛ Τεέʔϓͯ͠ग़ྗ
  70. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ςϯϓϨʔτΤϯδϯͷࠞ༻ ‣ ςϯϓϨʔτΤϯδϯ͸͠͹͠͹ݻ༗ͷه๏Λ࣋ͭɻ ‣ ςϯϓϨʔτΤϯδϯ͕ෳ਺༻͍ΒΕΔ৔߹ɺͦΕΒͷؒͷه๏ࠩʹΑΓɺΑ͖ ͤ͵੬ऑੑ͕ੜ·Εͯ͠·͏৔߹͕͋Δɻ ‣ ৄ͘͠͸ԋशΛࢀরͷ͜ͱɻ

    ‣ αʔόαΠυͰͷ)5.-ੜ੒ͱΫϥΠΞϯταΠυͰͷʢͳΜΒ͔ͷςϯϓϨʔτݴ ޠΛ༻͍ͨʣ)5.-ੜ੒͕ࠞ༻͞ΕΔέʔε͕୅දతɻ  8FCϒϥ΢β 8FCΞϓϦέʔγϣϯ {{ ... }}͸ม਺ల։༻ ͷه๏ͩͱࢥ͍ͬͯΔ {{ ... }}͸ͨͩͷ จࣈྻͩͱࢥ͍ͬͯΔ
  71. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ &EHF4JEF*ODMVEFTʢ&4*ʣ ‣ &EHF4JEF*ODMVEFTʢ&4*ʣʜ9.-ϕʔεͷϚʔΫΞοϓݴޠ ‣ <esi:include>౳ͷλάʹΑΓɺҎԼ͕දݱͰ͖Δɻ ‣ αϒϦιʔεͷಈతͳऔಘɾల։ ‣

    ؆୯ͳม਺ૢ࡞ ‣ 7BSOJTI 'BTUMZ ౳ͷ༷ʑͳιϑτ΢ΣΞ͕&4*ͷॲཧʹରԠ͍ͯ͠Δɻ  <body> <h1>Foobar</h1> <esi:include src="/a?q=$(QUERY_STRING{param1})" /> <esi:include src="/b?q=$(HTTP_COOKIE{'TEST'})" /> </body> &4*ॲཧܥ͕͜ͷ ෦෼Λల։͢Δ
  72. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ରࡦ )5.-ੜ੒ॲཧͷ࢓༷ࠩΛར༻ͨ͠߈ܸ ‣ )5.-ͷੜ੒ॲཧ͸͋ΒΏΔ৔໘ͰߦͳΘΕΔɻ ‣ ͦΕΒॲཧܥͷؒʹ͸࢓༷͕ࠩ͋Δ৔߹͕͋Δɻ ‣ ಛघͳҙຯΛ࣋ͭจࣈͷछྨ

    ‣ ॲཧܥ͕࣋ͭػೳ ‣ )5.-ͷੜ੒ʹࢀՃ͢Δॲཧܥಉ࢜͸ʜ ‣ લఏͱͯ͠ɺͰ͖Δ͚ͩݮΒ͓ͯ͘͠ͱΑ͍ɻ ‣ &4*ͳͲ͸ɺ࢖Θͳͯ͘ࡁΉͷͰ͋Ε͹ɺແޮԽ͓ͯ͘͠ɻ ‣ Ͳ͏ͯ͠΋ෳ਺Λͭͳ͛Δඞཁ͕͋Δ৔߹ʹ͸ɺ࢓༷ࠩΛ͏·͘Ϋογϣϯͯ͠ɺҰ؏ ੑΛ࣋ͨͤͯ΍Δඞཁ͕͋Δɻ 
  73. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ Ұ؏ੑΛอͪͳ͕Βͭͳ͛Δ ‣ ҎԼͷͭͷ߈ܸྫ͸ɺͲΕ΋ιϑτ΢ΣΞؒͷҰ؏ੑͷͳ͕͞ট͍ͨ໰୊Ͱ͋ Δͱଊ͑Δ͜ͱ͕Ͱ͖Δɻ ‣ )5513FRVFTU4NVHHMJOH ‣

    $POUFOU-FOHUI5SBOTGFS&ODPEJOHϔομͷෆద੾ͳऔΓѻ͍ʹΑΓൃੜ͢ ΔɺதܧαʔόͱΞϓϦέʔγϣϯαʔόؒͷෆ੔߹Λ༻͍ͨ߈ܸ ‣ $BDIFʹؔ࿈ͨ͠߈ܸ ‣ 8FC$BDIF1PJTPOJOH 8FC$BDIF%FDFQUJPO $1%P4ͳͲ ‣ ϨεϙϯεϘσΟͷੜ੒ʹؔΘΔॲཧܥͷ࢓༷ࠩΛར༻ͨ͠߈ܸ ‣ 443 $43ͷෆద੾ͳࠞ༻΍&4**OKFDUJPO߈ܸͳͲ 
  74. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ Ұ؏ੑΛอͪͳ͕Βͭͳ͛Δ ‣ 8FCΞϓϦέʔγϣϯͷߏஙʹඞཁͳίϯϙʔωϯτ͕૿͖͑ͯͨࠓɺͦΕΒ ΛҰ؏ੑΛอͪͳ͕Βͭͳ͛Δͱ͍͏ͷ͸ɺඇৗʹେ੾ͳ؍఺Ͱ͋Δɻ ‣ ྫ͑͹ɺҎԼͷΑ͏ͳ৔߹ʹ͸໰୊͕ൃੜͯ͠͠·͏ɻ ‣

    ࢓༷ͷؒʹҰ؏ੑ͕ͳ͍ͷʹɺͦΕͷࠩ෼ΛΫογϣϯͤͣʹͭͳ͛ͯ͠·ͬͨͱ͖ ‣ ࣮૷ͷؒʹҰ؏ੑ͕ͳ͍ͷʹɺͦΕʹؾ͕෇͔ͣʹͭͳ͛ͯ͠·ͬͨͱ͖ ‣ ֤ίϯϙʔωϯτΛઃܭ͢Δɾͭ͘Δଆͷਓʹ໰୊͕͋ΔΘ͚Ͱ͸͋Δͷ͕ͩʜ ‣ 8FCΞϓϦέʔγϣϯ։ൃऀͱͯ͠͸ɺҎԼͷ఺ʹཹҙ͠Α͏ɻ ‣ ࣗ෼ͷ࢖͓͏ͱ͍ͯ͠Δίϯϙʔωϯτ܈ʹɺ໰୊ʹͳΓͦ͏ͳʮࠩʯ͕ͳ͍͔ɻ ‣ ࣗ෼ͷ࢖༻͢Δίϯϙʔωϯτͷ࣮૷ʹط஌ͷ໰୊͕ͳ͍͔ ‣ ηΩϡϦςΟٕज़ऀͱͯ͠͸ɺͦ͏͍͏໰୊Λૣظʹൃݟͯ͠ɺੈͷத͔ΒηΩϡΞͰ ͳ͍΋ͷΛݮΒ͍͚ͯ͠ΔͱΑ͍ 
  75. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ αΠυνϟωϧ߈ܸ ‣ αΠυνϟωϧ ‣ ॲཧͷ݁Ռൃੜͨ͠ʮ෭࣍తͳӨڹͷ͋ΒΘΕʯ͕؍ଌͰ͖Δܦ࿏ͷ͜ͱɻ ‣ ʮ෭࣍తͳӨڹͷ͋ΒΘΕʯͷྫ ‣

    ॲཧͷফඅిྗͷมԽ ‣ ॲཧͷ࣮ߦ࣌ؒͷಛੑ ‣ αΠυνϟωϧ߈ܸʜ͋Δॲཧʹର͢ΔαΠυνϟωϧΛ؍ଌ͢Δ͜ͱͰɺͦ ͷॲཧʹؔΘΔ৘ใΛϦʔΫ͢Δ߈ܸͷ͜ͱɻ  ೖྗ ग़ྗ ॲཧ ෭࣍తͳӨڹͷ͋ΒΘΕ
  76. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ ΦϥΫϧʹ஫໨͢Δ ‣ αΠυνϟωϧ͸͠͹͠͹ΦϥΫϧͱͯ͠ѻ͏͜ͱ͕Ͱ͖Δ ‣ ΦϥΫϧʜ໰͍Λ౤͛ΔͱɺͦΕʹ౴͑ͯ͘ΕΔ΋ͷ ‣ தͰ͸ͲΜͳ͜ͱ͕ߦͳΘΕΔ͔͕ɺ໰Λ౤͛Δଆʹ։ࣔ͞Ε͍ͯΔඞཁ͸ͳ͍ ‣

    ಛʹ8FCʹ͓͚ΔαΠυνϟωϧ߈ܸͷྖҬͰ͸ɺड़ޠ1Λ౤͛Δͱɺൿີͷ৘ใE ʹରͯ͠1 E ͕ਅِ͔͔൑ఆ͢Δ໰୊ͷιϧόͷ͜ͱΛࢦ͕ͪ͠  ΫΤϦ ৘ใ ΦϥΫϧ ΫΤϦͷ݁Ռ
  77. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ "70SBDMF ‣ 8JOEPXT%FGFOEFS͕ߦ͏ɺϑΝΠϧͷ ෦෼తͳධՁͱͦΕʹجͮ͘ѱੑݕ஌Λ ΦϥΫϧԽͯ͠ར༻͢ΔαΠυνϟωϧ ߈ܸͷ͜ͱɻ ‣ ࢯ͸ଞͷΞϯν΢Πϧειϑτ΢ΣΞ

    ΍ɺͦͷଞҰൠͷ"VEJUPSzʹରͯ͠ ΋ɺಉछͷΦϥΫϧʢ"VEJUPS#BTFE 0SBDMFʣ͕ߏ੒Ͱ͖ΔՄೳੑʹ͍ͭͯ΋ ݴٴ͍ͯ͠Δɻ ‣ DG944"VEJUPSΛ༻͍ͨ944FBSDI  IUUQTUXJUUFSDPNUOLTUBUVT T
  78. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ #MJOE3FHFY*OKFDUJPO"UUBDL  ‣ ҎԼͷ৚͕݅੒Γཱͭͱ͖ʹʜ ‣ ೚ҙʹ༩͑Δ͜ͱͷͰ͖Δਖ਼نදݱʹΑ Γɺ͋Δେ੾ͳ஋͕૸ࠪ͞ΕΔ ‣

    ਖ਼نදݱΤϯδϯ͕3F%P4߈ܸ଱ੑͷ ͳ͍΋ͷͰ͋Δ ‣ ॲཧ࣌ؒΛαΠυνϟωϧͱͯ͠ɺͦͷ ஋ΛϦʔΫ͢Δ͜ͱ͕Ͱ͖Δͱ͍͏߈ܸ IUUQTEJBSZTIJGUKTJOGPCMJOESFHVMBSFYQSFTTJPOJOKFDUJPO
  79. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ 8FCϒϥ΢β಺ͷαΠυνϟωϧΛ༻͍ͨ߈ܸ ‣ 94-FBL ‣ 8FCϒϥ΢β಺ͷαΠυνϟωϧͷ͜ͱɻ ‣ ͜ΕΛ༻͍ͨ߈ܸ͸94-FBL"UUBDLͱݺ͹ΕΔɻ ‣

    944FBSDI"UUBDL ‣ ৘ใ૸ࠪΛ͢ΔػೳͷڍಈΛ94-FBLʹΑΓಡΈ ग़͢͜ͱͰɺΦϥΫϧΛߏ੒͠ɺͦΕʹΑΓ৘ใͷ ෮ݩΛ໨ࢦ͢߈ܸͷ͜ͱɻ ‣ ຊߨٛͰ͸ৄ͘͠આ໌͠ͳ͍͕ɺࡢ೥ͷηΩϡ ϦςΟɾΩϟϯϓશࠃେձͰ͸͜ͷลΛऔΓ ѻͬͨͷͰɺͦͷࢿྉΛݟͯΈΔͱΑ͍ɻ  IUUQTTQFBLFSEFDLDPNMNU@TXBMMPXBUUBDLTBOEEFGFOTFTJOXFCCSPXTFST
  80. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ Ͳ͏ରࡦ͍ͯ͘͠΂͖ʁ ‣ 8FCͷྖҬʹ͓͍ͯ΋αΠυνϟωϧ߈ܸ͸ແࢹͰ͖ͳ͍ɻ ‣ αʔόαΠυͷαΠυνϟωϧΛ༻͍ͨ߈ܸ ‣ දݱྗͷߴ͍ΫΤϦݴޠΛड͚औΓɺͦΕͰ৘ใ಺Λ૸ࠪ͢Δͱ͖͸ɺΘ͔ͣͳڍ ಈ͕ࠩ໰୊ʹͳΔ৔߹͕͋ΔͷͰɺ஫ҙΛ෷͓͏ɻ

    ‣ ૸ࠪʹݶΒͣɺେ੾ͳσʔλͷॲཧͰ͸ɺ ࠷ྑcฏۉc࠷ѱ ܭࢉྔͷࠩΛҙࣝ͠Α͏ɻ ‣ 8FCϒϥ΢β಺ͷαΠυνϟωϧΛ༻͍ͨ߈ܸ ‣ ͦ΋ͦ΋େ੾ͳ৘ใ͕8FCϒϥ΢βʹಧ͔ͳ͍Α͏ʹɺ$PPLJFͷSameSite ଐ ੑΛݫ͠໨ʹӡ༻Ͱ͖ΔͱΑ͍ɻ ‣ X-Frame-Options ϔομ΍$41ͷframe-ancestors σΟϨΫςΟϒɺCross- Origin-Resource-Policy ϔομɺCross-Origin-Opener-Policy ϔο μɺrel=noopenerଐੑͳͲʹΑΓɺ͞Βʹ৘ใ࿙Εग़͢ܦ࿏Λ௵ͤΔɻ 
  81. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ ͍·ͷʮ8FCηΩϡϦςΟʯͱ͸  αʔόαΠυ 8FCγεςϜ ΫϥΠΞϯταΠυ 8FCγεςϜ ‣

    ٞ࿦ͷൣғΛ໌֬ʹ͢ΔͨΊʹɺҎޙ͸ʮ8FCηΩϡϦςΟʯͱ͍͏ྖҬΛɺ ҎԼͷྖҬʹ෼͚ͯߟ͑Δɻ ‣ ΫϥΠΞϯταΠυ8FCγεςϜͷηΩϡϦςΟ ‣ αʔόαΠυ8FCγεςϜͷηΩϡϦςΟ
  82. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ ͍·ͷʮ8FCηΩϡϦςΟʯͱ͸  αʔόαΠυ 8FCγεςϜ ΫϥΠΞϯταΠυ 8FCγεςϜ ‣

    ͜ͷηΩϡϦςΟΛҎԼͷ̏؍఺͔Βߟ͑Α͏ ‣ ηΩϡΞʹͭ͘Δ ‣ ηΩϡΞʹͭͳ͛Δ ‣ ηΩϡΞʹ͏͔͢͝
  83. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ ͍·ͷʮ8FCηΩϡϦςΟʯͱ͸  αʔόαΠυ 8FCγεςϜ ΫϥΠΞϯταΠυ 8FCγεςϜ ;

    ‣ ͪ͜ΒΛֶͿͨΊͷૉࡐ΋ݱࡏ४උதʜ ‣ ϦϦʔεͰ͖ͨΒ5XJUUFS౳ͰҊ಺͠·͢ɻ ‣ $IFDLJUPVUIUUQTUXJUUFSDPNMNU@TXBMMPX
  84. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ Ұ؏ੑΛอͪͳ͕Βͭͳ͛Δ ‣ ҎԼͷͭͷ߈ܸྫ͸ɺͲΕ΋ιϑτ΢ΣΞؒͷҰ؏ੑͷͳ͕͞ট͍ͨ໰୊Ͱ͋ Δͱଊ͑Δ͜ͱ͕Ͱ͖Δɻ ‣ )5513FRVFTU4NVHHMJOH ‣

    $POUFOU-FOHUI5SBOTGFS&ODPEJOHϔομͷෆద੾ͳऔΓѻ͍ʹΑΓൃੜ͢ ΔɺதܧαʔόͱΞϓϦέʔγϣϯαʔόؒͷෆ੔߹Λ༻͍ͨ߈ܸ ‣ $BDIFʹؔ࿈ͨ͠߈ܸ ‣ 8FC$BDIF1PJTPOJOH 8FC$BDIF%FDFQUJPO $1%P4ͳͲ ‣ ϨεϙϯεϘσΟͷੜ੒ʹؔΘΔॲཧܥͷ࢓༷ࠩΛར༻ͨ͠߈ܸ ‣ 443 $43ͷෆద੾ͳࠞ༻΍&4**OKFDUJPO߈ܸͳͲ 
  85. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ Ұ؏ੑΛอͪͳ͕Βͭͳ͛Δ ‣ 8FCΞϓϦέʔγϣϯͷߏஙʹඞཁͳίϯϙʔωϯτ͕૿͖͑ͯͨࠓɺͦΕΒ ΛҰ؏ੑΛอͪͳ͕Βͭͳ͛Δͱ͍͏ͷ͸ɺඇৗʹେ੾ͳ؍఺Ͱ͋Δɻ ‣ ྫ͑͹ɺҎԼͷΑ͏ͳ৔߹ʹ͸໰୊͕ൃੜͯ͠͠·͏ɻ ‣

    ࢓༷ͷؒʹҰ؏ੑ͕ͳ͍ͷʹɺͦΕͷࠩ෼ΛΫογϣϯͤͣʹͭͳ͛ͯ͠·ͬͨͱ͖ ‣ ࣮૷ͷؒʹҰ؏ੑ͕ͳ͍ͷʹɺͦΕʹؾ͕෇͔ͣʹͭͳ͛ͯ͠·ͬͨͱ͖ ‣ ֤ίϯϙʔωϯτΛઃܭ͢Δɾͭ͘Δଆͷਓʹ໰୊͕͋ΔΘ͚Ͱ͸͋Δͷ͕ͩʜ ‣ 8FCΞϓϦέʔγϣϯ։ൃऀͱͯ͠͸ɺҎԼͷ఺ʹཹҙ͠Α͏ɻ ‣ ࣗ෼ͷ࢖͓͏ͱ͍ͯ͠Δίϯϙʔωϯτ܈ʹɺ໰୊ʹͳΓͦ͏ͳʮࠩʯ͕ͳ͍͔ɻ ‣ ࣗ෼ͷ࢖༻͢Δίϯϙʔωϯτͷ࣮૷ʹط஌ͷ໰୊͕ͳ͍͔ ‣ ηΩϡϦςΟٕज़ऀͱͯ͠͸ɺͦ͏͍͏໰୊Λૣظʹൃݟͯ͠ɺੈͷத͔ΒηΩϡΞͰ ͳ͍΋ͷΛݮΒ͍͚ͯ͠ΔͱΑ͍ 
  86. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ αΠυνϟωϧ߈ܸͷجૅ ‣ αΠυνϟωϧ ‣ ॲཧͷ݁Ռൃੜͨ͠ʮ෭࣍తͳӨڹͷ͋ΒΘΕʯ͕؍ଌͰ͖Δܦ࿏ͷ͜ͱɻ ‣ ʮ෭࣍తͳӨڹͷ͋ΒΘΕʯͷྫ

    ‣ ॲཧͷফඅిྗͷมԽ ‣ ॲཧͷ࣮ߦ࣌ؒͷಛੑ ‣ αΠυνϟωϧ߈ܸʜ͋Δॲཧʹର͢ΔαΠυνϟωϧΛ؍ଌ͢Δ͜ͱͰɺͦ ͷॲཧʹؔΘΔ৘ใΛϦʔΫ͢Δ߈ܸͷ͜ͱɻ  ೖྗ ओͨΔग़ྗ ॲཧ ෭࣍తͳӨڹͷ͋ΒΘΕ
  87. ˜TIJGUKTJOGP ϚΫϩͳࢹ఺͔Βଊ͑Δ8FCηΩϡϦςΟ খ·ͱΊ αΠυνϟωϧ߈ܸͷجૅ ‣ 8FCͷྖҬʹ͓͍ͯ΋αΠυνϟωϧ߈ܸ͸ແࢹͰ͖ͳ͍ɻ ‣ αʔόαΠυͷαΠυνϟωϧΛ༻͍ͨ߈ܸ ‣ දݱྗͷߴ͍ΫΤϦݴޠΛड͚औΓɺͦΕͰ৘ใ಺Λ૸ࠪ͢Δͱ͖͸ɺΘ͔ͣͳڍ

    ಈ͕ࠩ໰୊ʹͳΔ৔߹͕͋ΔͷͰɺ஫ҙΛ෷͓͏ɻ ‣ ૸ࠪʹݶΒͣɺେ੾ͳσʔλͷॲཧͰ͸ɺ ࠷ྑcฏۉc࠷ѱ ܭࢉྔͷࠩΛҙࣝ͠Α͏ɻ ‣ 8FCϒϥ΢β಺ͷαΠυνϟωϧΛ༻͍ͨ߈ܸ ‣ ͦ΋ͦ΋େ੾ͳ৘ใ͕8FCϒϥ΢βʹಧ͔ͳ͍Α͏ʹɺ$PPLJFͷSameSite ଐ ੑΛݫ͠໨ʹӡ༻Ͱ͖ΔͱΑ͍ɻ ‣ X-Frame-Options ϔομ΍$41ͷframe-ancestors σΟϨΫςΟϒɺCross- Origin-Resource-Policy ϔομɺCross-Origin-Opener-Policy ϔο μɺrel=noopenerଐੑͳͲʹΑΓɺ͞Βʹ৘ใ࿙Εग़͢ܦ࿏Λ௵ͤΔɻ