Upgrade to Pro — share decks privately, control downloads, hide ads and more …

実践エッジユースケース

 実践エッジユースケース

AWS Dev Day 2023 Tokyo
2023-06-22
Yusuke Wada
Developer Advocate @ Cloudflare

Yusuke Wada

June 22, 2023
Tweet

More Decks by Yusuke Wada

Other Decks in Programming

Transcript

  1. "84%FW%BZ5PLZP:VTVLF8BEB ΦϦδϯͱΤοδ w ΦϦδϯجຊͱͳΔαʔόʔ w ΤοδΦϦδϯͷίϯςϯπΛϢʔβʔͷۙ͘Ͱ഑৴͢Δ w ΦϦδϯ͕͋Δύλʔϯ Ϧόʔε ϓϩΩγύλʔϯ

    w Τοδ͚ͩͰશ͕ͯ׬݁ϑϧελοΫύλʔϯ ┌───────────┐ ┌───────┐ ┌───────────┐ │ Users │ │ Edge │ │ Origins │ └─────┬─────┘ └───┬───┘ └─────┬─────┘ │ Network │ CDN │ │<───────────────>│<───────────────>│ └─────┴─────┘ └───┴───┘ └─────┴─────┘ 
  2. "84%FW%BZ5PLZP:VTVLF8BEB )POP w ΤοδͰಈ͘ w খͯ͘͞γϯϓϧͰ଎͍8FCϑϨʔϜϫʔΫ w ؆୯͚ͩͲԞ͕ਂ͍ w ͲͷΤοδͰ΋ಈ͘

    w )POPͷ࣮૷ͰશͯͷϓϥοτϑΥʔϜʹରԠͰ͖Δ w ࠓճ͸ϓϥοτϑΥʔϜʹґଘͨ͘͠ͳ͍ͷͰ࠷ద 
  3. "84%FW%BZ5PLZP:VTVLF8BEB )POPͷಛ௃ w 6MUSBGBTU🚀5IFSPVUFS3FH&YQ3PVUFSJTSFBMMZGBTU/PUVTJOHMJOFBSMPPQT'BTU w -JHIUXFJHIU🪶5IFIPOPUJOZQSFTFUJTVOEFSL#)POPIBT[FSPEFQFOEFODJFTBOEVTFT POMZUIF8FC4UBOEBSE"1* w .VMUJSVOUJNF🌍8PSLTPO$MPVEGMBSF8PSLFST 'BTUMZ$PNQVUF!&EHF

    %FOP #VO -BHPO  "84-BNCEB PS/PEFKT5IFTBNFDPEFSVOTPOBMMQMBUGPSNT w #BUUFSJFT*ODMVEFE🔋)POPIBTCVJMUJONJEEMFXBSF DVTUPNNJEEMFXBSF BOEUIJSEQBSUZ NJEEMFXBSF#BUUFSJFTJODMVEFE w %FMJHIUGVM%9🛠4VQFSDMFBO"1*T'JSTUDMBTT5ZQF4DSJQUTVQQPSU/PX XFWFHPU5ZQFT IUUQTIPOPEFW 
  4. "84%FW%BZ5PLZP:VTVLF8BEB $MPVEGMBSF8PSLFSTͷଞͷϑϨʔϜϫʔΫϧʔλʔͱͷൺֱ Hono x 402,820 ops/sec ±4.78% (80 runs sampled)

    itty-router x 212,598 ops/sec ±3.11% (87 runs sampled) sunder x 297,036 ops/sec ±4.76% (77 runs sampled) worktop x 197,345 ops/sec ±2.40% (88 runs sampled) Fastest is Hono ✨ Done in 28.06s. 
  5. "84%FW%BZ5PLZP:VTVLF8BEB -JOFBS3PVUFS w #Z!VTVBMPNBɺϧʔτͷొ࿥ΛؚΊͯ଎͍ 
 • GET /very/deeply/nested/route/hello/there ----------------------------------------------------- -----------------------------

    RegExpRouter 34.25 µs/iter (26.29 µs … 670.17 µs) 34.58 µs 49.13 µs 56.5 µs TrieRouter 9.05 µs/iter (8.91 µs … 9.2 µs) 9.09 µs 9.2 µs 9.2 µs LinearRouter 1.6 µs/iter (1.53 µs … 1.75 µs) 1.61 µs 1.75 µs 1.75 µs MedleyRouter 4.43 µs/iter (4.33 µs … 4.54 µs) 4.45 µs 4.54 µs 4.54 µs FindMyWay 62.36 µs/iter (46.25 µs … 1.69 ms) 61.79 µs 78.67 µs 87.42 µs KoaTreeRouter 3.69 µs/iter (3.53 µs … 3.9 µs) 3.72 µs 3.9 µs 3.9 µs TrekRouter 5.79 µs/iter (5.64 µs … 5.93 µs) 5.83 µs 5.93 µs 5.93 µs summary for GET /very/deeply/nested/route/hello/there LinearRouter 2.31x faster than KoaTreeRouter 2.77x faster than MedleyRouter 3.63x faster than TrekRouter 5.67x faster than TrieRouter 21.46x faster than RegExpRouter 39.08x faster than FindMyWay IUUQTHJUIVCDPNIPOPKTIPOPQVMM 
  6. "84%FW%BZ5PLZP:VTVLF8BEB 1BUUFSO3PVUFSͷΈΛ࢖͏ͱ,# &YQSFTT͸,# $ npx wrangler dev --minify ./src/index.ts ⛅

    wrangler 2.20.0 -------------------- ⬣ Listening at http://0.0.0.0:8787 - http://127.0.0.1:8787 - http://192.168.128.165:8787 Total Upload: 11.47 KiB / gzip: 4.34 KiB 
  7. "84%FW%BZ5PLZP:VTVLF8BEB ͭͷϧʔλʔ w 3FH&YQ3PVUFS w 5SJF3PVUFS w 4NBSU3PVUFS w -JOFBS3PVUFS

    w 1BUUFSO3PVUFS 4NBSU3PVUFS 3FH&YQ3PVUFSΛ༏ઌ͢Δ͕αϙʔτ͠ͳ͍ύε͕͋Ε͹5SJF3PVUFSΛ࢖͏ 
  8. "84%FW%BZ5PLZP:VTVLF8BEB ͲͷϓϦηοτΛ࢖͑͹͍͍͔ʁ w AIPOPA w ΄ͱΜͲͷϢʔεέʔεʹ͓͢͢Ί w %FOPɺ#VOɺ/PEFKTͰߏங͞Εͨৗறܕͷαʔόʔʹ࠷ద w $MPVEGMBSF8PSLFSTɺ%FOP%FQMPZɺ-BHPOͳͲͷ؀ڥͰ΋ར༻ՄೳʢWΞΠιϨʔτΛར༻ʣ

    w ىಈޙͷύϑΥʔϚϯε͕ߴ͍ w AIPOPRVJDLA w ϦΫΤετ͝ͱʹΞϓϦέʔγϣϯ͕ॳظԽ͞ΕΔ؀ڥ޲͚ w 'BTUMZ$PNQVUF!&EHFͳͲͰਪ঑ w "84-BNCEBͷίʔϧυελʔτʹ΋ద͍ͯ͠Δ w AIPOPUJOZA w Ϧιʔε͕ݶΒΕ͍ͯΔ؀ڥ޲͚ w ࠷খͷϧʔλʔύοέʔδ 
  9. "84%FW%BZ5PLZP:VTVLF8BEB +BWB4DSJQUͳΒͲ͜Ͱ΋ಈ͘ w $MPVEGMBSF8PSLFST w 'BTUMZ$PNQVUF!&EHF w %FOP w #VO

    w -BHPO w /FYUKT!7FSDFM w /FYUKT!/PEFKT w "84-BNCEB w -BNCEB!&EHF w /PEFKT 
  10. "84%FW%BZ5PLZP:VTVLF8BEB ϏϧτΠϯɾϛυϧ΢ΣΞ w #BTJD"VUIFOUJDBUJPO w #FBSFS"VUIFOUJDBUJPO w $BDIF w $PNQSFTT

    w $PPLJF w $034 w &5BH w IUNM w +49 w +85"VUIFOUJDBUJPO w -PHHFS w 1SFUUZ+40/ &5BHϛυϧ΢ΣΞͱϩΨʔΛશͯͷύεʹదԠ͢Δ 
  11. "84%FW%BZ5PLZP:VTVLF8BEB SEQBSUZɾϛυϧ΢ΣΞ w 'JSFCBTF"VUI w (SBQI2-4FSWFS w 2XJL$JUZ w 4FOUSZ

    w U31$4FSWFS w 5ZQF#PY7BMJEBUPS w ;PE7BMJEBUPS 4FOUSZϛυϧ΢ΣΞΛ࢖͏ 
  12. "84%FW%BZ5PLZP:VTVLF8BEB Τοδ׆༻ͷϢʔεέʔεͱ࣮૷ w ࣮૷ʹ͸)POPΛ࢖༻ͲͷϓϥοτϑΥʔϜͰ΋ϩδοΫ͸ಉ͡ w ࠓճ͸ΦϦδϯ͕͋ΔϦόʔεϓϩΩγΛத৺ʹ w ΦϦδϯΛ׆͔͢ w ϑϧελοΫͩͱయܕతͳΞϓϦέʔγϣϯߏஙͷ࿩ʹͳΔ

    w ΦϦδϯ͸υϝΠϯͷ࣮૷ʹूத͢Δ w ແବͳΞΫηε͔ΒɺΦϦδϯ͔ΒΛԕ͚͟Δ w $PEFPWFSDPOGJHVSBUJPOઃఆΑΓίʔυ w ؅ཧը໘ɺ7$-Ͱ΍͍ͬͯ͜ͱΛ'VODUJPOͰ΍Δ 
  13. "84%FW%BZ5PLZP:VTVLF8BEB Ϩεϙϯεϔομͷ௥Ճ࡟আ w A91PXFSFE#ZA w A93FTQPOTF5JNFA w ηΩϡϦςΟʹؔ܎͢Δϔομ - Content-Security-Policy:

    A powerful allow-list of what can happen on your page which mitigates many attacks - Cross-Origin-Opener-Policy: Helps process-isolate your page - Cross-Origin-Resource-Policy: Blocks others from loading your resources cross-origin - Origin-Agent-Cluster: Changes process isolation to be origin-based - Referrer-Policy: Controls the Referer header - Strict-Transport-Security: Tells browsers to prefer HTTPS - X-Content-Type-Options: Avoids MIME sniffing - X-DNS-Prefetch-Control: Controls DNS prefetching - X-Download-Options: Forces downloads to be saved (Internet Explorer only) - X-Frame-Options: Legacy header that mitigates clickjacking attacks - X-Permitted-Cross-Domain-Policies: Controls cross-domain behavior for Adobe products, like Acrobat - X-Powered-By: Info about the web server. Removed because it could be used in simple attacks - X-XSS-Protection: Legacy header that tries to mitigate XSS attacks, but makes things worse, so Helmet disables it 
  14. "84%FW%BZ5PLZP:VTVLF8BEB $034 w $SPTT0SJHJO3FTPVSDF4IBSJOH w αʔόʔଆͷ࣮૷ CORS: Cross-Origin Resource Sharing

    1. ҟͳΔΦϦδϯؒ௨৴ΛՄೳʹ͢Δ 2. ϒϥ΢βͷಉҰΦϦδϯϙϦγʔ੍໿Λ؇࿨͢Δ 3. CORS͸αʔόʔଆͰઃఆ͠ରԠ͢Δ 4. ϦΫΤετ͸ڐՄ͞ΕͨΦϦδϯ͔ΒͷΈૹ৴͢Δ 5. αΠτؒεΫϦϓτ߈ܸ͔Βอޢ͢Δ 
  15. "84%FW%BZ5PLZP:VTVLF8BEB ϗοτϦϯΫېࢭ4JHOFE3FRVFTUฤ w ༗ޮظݶ෇͖ͷ63-Λੜ੒ɺݕূ͢Δ w ੜ੒ଆ  ੜ੒ͱݕূͰγʔΫϨοτΩʔΛڞ༗͢Δɻ  63-ύεͱ༗ޮظݶΛσʔλͱ͠ɺγʔΫϨοτΩʔͰΩʔΛੜ੒͢Δɻ

     63-ʹΩʔͱ༗ޮظݶΛΫΤϦύϥϝʔλͱͯ͠௥Ճ͢Δɻ w ݕূଆ  63-ΫΤϦύϥϝʔλ͔ΒΩʔͱ༗ޮظݶΛऔΓग़͢ɻ  ΩʔΛγʔΫϨοτΩʔΛݩʹݕূ͢Δɻ  ༗ޮظݶΛݕূ͢Δɻ  ༗ޮͰ͋Ε͹ɺϓϩΩγ͢Δɻ