Qiita Conference 2025 Autumn

Null-Sensei๏ผˆ@GOROman๏ผ‰

AIๆ™‚ไปฃใฎ็”Ÿๅญ˜ๆˆฆ็•ฅใ€œใƒŸใƒ‹ๅ››้ง†ใ‚’่ฒทใฃใฆๆ”น้€ ใ—ใฆใŸใ‚‰ใ‚ตใƒณใƒ•ใƒฉใƒณใ‚ทใ‚นใ‚ณใฎOpenAI DevDayใซๅ‚ๅŠ ใงใใŸ่ฉฑใ€œ

1
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 1 year has passed since last update.

Content-Security-Policyใจใฏ

Posted at

ใ‚ณใƒณใƒ†ใƒณใƒ„ใ‚ปใ‚ญใƒฅใƒชใƒ†ใ‚ฃใƒใƒชใ‚ทใƒผ (CSP) ใฏใ€ใ‚ฏใƒญใ‚นใ‚ตใ‚คใƒˆใ‚นใ‚ฏใƒชใƒ—ใƒ†ใ‚ฃใƒณใ‚ฐ (Cross-site_scripting) ใ‚„ใƒ‡ใƒผใ‚ฟใ‚คใƒณใ‚ธใ‚งใ‚ฏใ‚ทใƒงใƒณๆ”ปๆ’ƒใชใฉใฎใ‚ˆใ†ใชใ€็‰นๅฎšใฎ็จฎ้กžใฎๆ”ปๆ’ƒใ‚’ๆคœ็Ÿฅใ—ใ€ๅฝฑ้Ÿฟใ‚’่ปฝๆธ›ใ™ใ‚‹ใŸใ‚ใซ่ฟฝๅŠ ใงใใ‚‹ใ‚ปใ‚ญใƒฅใƒชใƒ†ใ‚ฃใƒฌใ‚คใƒคใƒผใงใ™ใ€‚ใ“ใ‚Œใ‚‰ใฎๆ”ปๆ’ƒใฏใƒ‡ใƒผใ‚ฟใฎ็ชƒๅ–ใ‹ใ‚‰ใ‚ตใ‚คใƒˆใฎๆ”นใ–ใ‚“ใ€ใƒžใƒซใ‚ฆใ‚งใ‚ขใฎๆ‹กๆ•ฃใซ่‡ณใ‚‹ใพใงใ€ๆง˜ใ€…ใช็›ฎ็š„ใซ็”จใ„ใ‚‰ใ‚Œใพใ™ใ€‚

  • ็‰นๅฎšใฎ็จฎ้กžใฎๆ”ปๆ’ƒใ‚’ๆคœ็Ÿฅใ—ใ€ๅฝฑ้Ÿฟใ‚’่ปฝๆธ›ใ™ใ‚‹ใŸใ‚ใซ่ฟฝๅŠ ใงใใ‚‹ใ‚ปใ‚ญใƒฅใƒชใƒ†ใ‚ฃใƒฌใ‚คใƒคใƒผ

CSP ใฏๅฎŒๅ…จใชๅพŒๆ–นไบ’ๆ›ๆ€งใ‚’ไฟใฃใฆ่จญ่จˆใ•ใ‚Œใฆใ„ใพใ™๏ผˆใŸใ ใ—ใ€ CSP 2 ใซใคใ„ใฆใฏๅพŒๆ–นไบ’ๆ›ๆ€งใŒใชใ„็‚นใ‚‚ใ‚ใ‚Šใ€ๆ˜Ž็คบ็š„ใซ่จ˜่ฟฐใ•ใ‚Œใฆใ„ใพใ™ใ€‚่ฉณ็ดฐใฏใ“ใกใ‚‰ใฎ 1.1 ็ซ ใ‚’ๅ‚็…งใ—ใฆใใ ใ•ใ„๏ผ‰ใ€‚ CSP ใซๅฏพๅฟœใ—ใฆใ„ใชใ„ใƒ–ใƒฉใ‚ฆใ‚ถใƒผใฏ CSP ใ‚’็„ก่ฆ–ใ—ใ€้€šๅธธ้€šใ‚ŠๆฉŸ่ƒฝใ—ใพใ™ใ€‚CSP ใŒ่ฟฝๅŠ ใ™ใ‚‹ใ‚ˆใ†ใชใ•ใ‚‰ใชใ‚‹ๅˆถ้™ใฏใชใใ€ๆจ™ๆบ–ใฎๅŒไธ€ใ‚ชใƒชใ‚ธใƒณใƒใƒชใ‚ทใƒผใฎไฟ่ญทใฎใฟใŒ้ฉ็”จใ•ใ‚Œใพใ™ใ€‚

  • CSP ใซๅฏพๅฟœใ—ใฆใ„ใชใ„ใƒ–ใƒฉใ‚ฆใ‚ถใƒผใฏ CSP ใ‚’็„ก่ฆ–ใ—ใ€้€šๅธธ้€šใ‚ŠๆฉŸ่ƒฝใซใชใ‚‹

CSP ใ‚’ๆœ‰ๅŠนใซใ™ใ‚‹ใซใฏใ€ใ‚ฆใ‚งใƒ–ใ‚ตใƒผใƒใƒผใ‹ใ‚‰ Content-Security-Policy HTTP ใƒ˜ใƒƒใƒ€ใƒผใ‚’่ฟ”ใ™ใ‚ˆใ†ใซ่จญๅฎšใ™ใ‚‹ๅฟ…่ฆใŒใ‚ใ‚Šใพใ™๏ผˆX-Content-Security-Policy ใƒ˜ใƒƒใƒ€ใƒผใซ้–ขใ™ใ‚‹่จ˜่ฟฐใŒๆ™‚ใ€…ใ‚ใ‚Šใพใ™ใŒใ€ใ“ใ‚Œใฏๅคใ„ใƒใƒผใ‚ธใƒงใƒณใฎใ‚‚ใฎใงใ‚ใ‚Šใ€ไปŠๆ—ฅใ“ใฎใƒ˜ใƒƒใƒ€ใƒผใ‚’ๆŒ‡ๅฎšใ™ใ‚‹ๅฟ…่ฆใฏใ‚ใ‚Šใพใ›ใ‚“๏ผ‰ใ€‚

  • ใ“ใฎใƒ˜ใƒƒใƒ€ใƒผใ‚’ๆŒ‡ๅฎšใ™ใ‚‹ๅฟ…่ฆใฏใ‚ใ‚Šใพใ›ใ‚“
  • WEBใ‚ตใƒผใƒใƒผใซ้–ข้€ฃใ™ใ‚‹

ใ‚ณใƒณใƒ†ใƒณใƒ„ใƒปใ‚ปใ‚ญใƒฅใƒชใƒ†ใ‚ฃใƒปใƒใƒชใ‚ทใƒผใƒปใƒ˜ใƒƒใƒ€ใƒผใ‚’ไฝฟ็”จใ™ใ‚‹ใจใ€ๅพ“ๆฅญๅ“กใฎใ‹ใ‚ใ‚Šใซใƒชใ‚ฏใ‚จใ‚นใƒˆๅฏ่ƒฝใชใƒชใ‚ฝใƒผใ‚นใ‚’้–‹็™บ่€…ใŒๅˆถๅพกใงใใ‚‹ใฎใงใ€ใ‚ณใƒณใƒ†ใƒณใƒ„ใƒปใ‚คใƒณใ‚ธใ‚งใ‚ฏใ‚ทใƒงใƒณใฎใƒชใ‚นใ‚ฏใŒ่ปฝๆธ›ใ•ใ‚Œใพใ™ใ€‚

ใ‚ณใƒณใƒ†ใƒณใƒ„ใƒปใ‚ปใ‚ญใƒฅใƒชใƒ†ใ‚ฃใƒปใƒใƒชใ‚ทใƒผใจใฏใ€Webใ‚ขใƒ—ใƒชใ‚ฑใƒผใ‚ทใƒงใƒณใฎใ‚ฏใƒฉใ‚คใ‚ขใƒณใƒˆๅดใƒชใ‚ฝใƒผใ‚น็”จใซJavaScriptใ€CSSใ€ใ‚คใƒกใƒผใ‚ธใชใฉใฎใ‚ฝใƒผใ‚นใƒปใƒ›ใƒฏใ‚คใƒˆใƒชใ‚นใƒˆใ‚’ไฝœๆˆใงใใ‚‹ใ€ใƒ–ใƒฉใ‚ฆใ‚ถๅดใฎใƒกใ‚ซใƒ‹ใ‚บใƒ ใงใ™ใ€‚ใ‚ณใƒณใƒ†ใƒณใƒ„ใƒปใ‚ปใ‚ญใƒฅใƒชใƒ†ใ‚ฃใƒปใƒใƒชใ‚ทใƒผใฏใ€ใใฎใ‚ˆใ†ใชใ‚ฝใƒผใ‚นใ‹ใ‚‰ใฎใƒชใ‚ฝใƒผใ‚นใฎใฟใ‚’ๅฎŸ่กŒใพใŸใฏใƒฌใƒณใƒ€ใƒชใƒณใ‚ฐใ™ใ‚‹ใ‚ˆใ†ใซใ€็‰นๅˆฅใชHTTPใƒ˜ใƒƒใƒ€ใƒผใ‚’ไฝฟ็”จใ—ใฆใƒ–ใƒฉใ‚ฆใ‚ถใซๆŒ‡็คบใ—ใพใ™ใ€‚

  • ใ‚ฝใƒผใ‚นใ‹ใ‚‰ใฎใƒชใ‚ฝใƒผใ‚นใฎใฟใ‚’ๅฎŸ่กŒใพใŸใฏใƒฌใƒณใƒ€ใƒชใƒณใ‚ฐใ™ใ‚‹ใ‚ˆใ†ใซใ€็‰นๅˆฅใชHTTPใƒ˜ใƒƒใƒ€ใƒผใ‚’ไฝฟ็”จใ—ใฆใƒ–ใƒฉใ‚ฆใ‚ถใซๆŒ‡็คบ

index.htmlใซ่จ˜่ผ‰ใ•ใ‚Œใฆใ„ใ‚‹ใ™ในใฆใฎๅค–้ƒจใƒชใ‚ฝใƒผใ‚นใฎใ†ใกใ€CSPใซ้•ๅใ—ใฆใ„ใชใ„ใƒชใ‚ฝใƒผใ‚นใฎใฟ่ชญใฟ่พผใฟใจๅฎŸ่กŒใŒ่กŒใ‚ใ‚Œใพใ™ใ€‚

ไธŠใฎ็”ปๅƒใฎไพ‹ใงใฏใ€img-src โ€˜selfโ€™ใจๆŒ‡ๅฎšใ•ใ‚Œใฆใ„ใ‚‹ใŸใ‚ใ€ๅŒไธ€ใ‚ชใƒชใ‚ธใƒณใ‹ใ‚‰ใฎ็”ปๅƒใƒชใ‚ฝใƒผใ‚นใฎใฟ่จฑๅฏใ•ใ‚Œใ€https://bbb.com/BBB.jpg ใฎ่ชญใฟ่พผใฟใฏๆ‹’ๅฆใ•ใ‚Œใพใ™ใ€‚

ใพใŸใ€script-src nonce-xxxxใจๆŒ‡ๅฎšใ•ใ‚Œใฆใ„ใ‚‹ใŸใ‚ใ€nonceๅ€ค๏ผˆโ€ปnonceใฎ่ฉณ็ดฐใฏๅพŒ่ฟฐ๏ผ‰ใŒไธ€่‡ดใ™ใ‚‹ccc.jsใฏใ‚นใ‚ฏใƒชใƒ—ใƒˆใŒๅฎŸ่กŒใ•ใ‚Œใพใ™ใŒใ€ddd.js ใฏnonceๅ€คใŒใชใCSP้•ๅใจใชใ‚‹ใŸใ‚ๅฎŸ่กŒใ•ใ‚Œใพใ›ใ‚“ใ€‚
โ€ปไปฎใซinlineใงใ‚นใ‚ฏใƒชใƒ—ใƒˆใŒ่จ˜่ผ‰ใ•ใ‚Œใฆใ„ใฆใ‚‚ใ€CSP้•ๅใฎๅ ดๅˆใฏๅฎŸ่กŒใฏใ•ใ‚Œใพใ›ใ‚“ใ€‚

Webใ‚ตใƒผใƒใƒผใฏใ€ใ‚จใƒณใƒ‰ใƒปใƒฆใƒผใ‚ถใƒผใฎWebใ‚ขใƒ—ใƒชใ‚ฑใƒผใ‚ทใƒงใƒณใŒใ‚นใ‚ฟใ‚คใƒซใ‚ทใƒผใƒˆใ‚„ใ‚คใƒกใƒผใ‚ธใชใฉใ‚’ใƒญใƒผใƒ‰ใงใใ‚‹ใƒ‰ใƒกใ‚คใƒณใฎใƒชใ‚นใƒˆใ‚’ๆŠŠๆกใ—ใฆใ„ใชใ„ใŸใ‚ใ€ใ‚ณใƒณใƒ†ใƒณใƒ„ใƒปใ‚ปใ‚ญใƒฅใƒชใƒ†ใ‚ฃใƒปใƒใƒชใ‚ทใƒผใ‚’ๅฎŸ่ฃ…ใ™ใ‚‹ใฎใฏไธๅฏ่ƒฝใงใ™ใ€‚Webใ‚ตใƒผใƒใƒผใฏใ€ใ‚ขใƒ—ใƒชใ‚ฑใƒผใ‚ทใƒงใƒณใŒใƒ—ใƒฉใ‚ฐใ‚คใƒณใ‚„ใƒกใƒ‡ใ‚ฃใ‚ขใชใฉใ‚’ไฝฟ็”จใ™ใ‚‹ใ‹ใฉใ†ใ‹ใ‚„ใ€ใ“ใ‚Œใ‚‰ใ‚’ใƒญใƒผใƒ‰ใงใใ‚‹ใ‹ใฉใ†ใ‹ใ‚‚ๆŠŠๆกใ—ใฆใ„ใพใ›ใ‚“ใ€‚

ใ‚ชใƒฉใ‚ฏใƒซ็คพใงใฏใ€ใ‚ณใƒณใƒ†ใƒณใƒ„ใƒปใ‚ปใ‚ญใƒฅใƒชใƒ†ใ‚ฃใƒปใƒใƒชใ‚ทใƒผใƒปใƒ˜ใƒƒใƒ€ใƒผใ‚’ไฝฟ็”จใ—ใฆใ€ใ‚ขใƒ—ใƒชใ‚ฑใƒผใ‚ทใƒงใƒณ็‰นๆ€งใซๅŸบใฅใใƒใƒชใ‚ทใƒผใ‚’ๅฎš็พฉใŠใ‚ˆใณๅฎŸ่ฃ…ใ™ใ‚‹ใ“ใจใ‚’ใŠ่–ฆใ‚ใ—ใฆใ„ใพใ™ใ€‚

ใ‚ณใƒณใƒ†ใƒณใƒ„ใƒปใ‚ปใ‚ญใƒฅใƒชใƒ†ใ‚ฃใƒปใƒใƒชใ‚ทใƒผใƒปใƒซใƒผใƒซใฎไฝฟ็”จไพ‹ใ‚’ๆฌกใซ็คบใ—ใพใ™:

ไพ‹: ใƒซใƒผใƒซ1

Content-Security-Policy: default-src 'self'

ใ“ใ‚Œใฏๅˆถ้™็š„ใชใƒซใƒผใƒซใงใ‚ใ‚Šใ€ๆฌกใฎใ‚ˆใ†ใชใ‚ขใƒ—ใƒชใ‚ฑใƒผใ‚ทใƒงใƒณใงๆฉŸ่ƒฝใ—ใพใ™:
ใ™ในใฆใฎใƒชใ‚ฝใƒผใ‚นใŒใ€ๆŒ‡ๅฎšใ—ใŸใƒšใƒผใ‚ธใฎๅŒใ˜ใƒ‰ใƒกใ‚คใƒณใงใƒ›ใ‚นใƒˆใ•ใ‚Œใพใ™ใ€‚
ใ‚นใ‚ฏใƒชใƒ—ใƒˆใŠใ‚ˆใณใ‚นใ‚ฟใ‚คใƒซใƒปใƒชใ‚ฝใƒผใ‚นใซๅฏพใ™ใ‚‹ใ‚คใƒณใƒฉใ‚คใƒณใพใŸใฏ่ฉ•ไพกใŒใ‚ใ‚Šใพใ›ใ‚“ใ€‚

ไพ‹: ใƒซใƒผใƒซ2

Content-Security-Policy: default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';

ใ“ใฎใƒใƒชใ‚ทใƒผใฎๅ†…ๅฎน:
ใ‚ชใƒ–ใ‚ธใ‚งใ‚ฏใƒˆใ€ใƒ•ใƒฌใƒผใƒ ใ€ใƒกใƒ‡ใ‚ฃใ‚ขใชใฉใฎใƒชใ‚ฝใƒผใ‚นใฎใƒญใƒผใƒ‰ใ‚’่จฑๅฏใ—ใพใ›ใ‚“ใ€‚
ๅŒใ˜่ตท็‚นใ‹ใ‚‰ใฎใ‚คใƒกใƒผใ‚ธใ€ใ‚นใ‚ฏใƒชใƒ—ใƒˆใ€AJAXใŠใ‚ˆใณCSSใ‚’่จฑๅฏใ—ใพใ™ใ€‚

ไพ‹: ใƒซใƒผใƒซ3

Content-Security-Policy: frame-ancestors self;

ๆ„Ÿๆƒณ

่ชฌๆ˜Žใธใฎ็†่งฃใŒ้›ฃใ—ใ„ใ€‚
ใ“ใ‚Œใฏๅคใ„ใƒใƒผใ‚ธใƒงใƒณใฎใ‚‚ใฎใงใ‚ใ‚Šใ€ไปŠๆ—ฅใ“ใฎใƒ˜ใƒƒใƒ€ใƒผใ‚’ๆŒ‡ๅฎšใ™ใ‚‹ๅฟ…่ฆใฏใ‚ใ‚Šใพใ›ใ‚“ใจๆ›ธใ„ใฆใ‚ใ‚Šๅฟ…่ฆใชใฎใ‹ๅฟ…่ฆใ˜ใ‚ƒใชใ„ใฎใ‹ใ‚ใ‹ใ‚‰ใชใ‹ใฃใŸใ€‚

ใฉใ†่จ€ใ†ๅˆ†้‡Žใ‚’็Ÿฅใฃใฆใ„ใ‚Œใฐ็†่งฃใงใใ‚‹ใฎใ‹๏ผŸ

1
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up

@masatom86650860's pickup articles

masatom86650860

@masatom86650860

ใ‚ณใƒ„ใ‚ณใƒ„

Today's trending articles

ใ€Œ็”ŸๆˆAI้–‹็™บใฎ็ใƒ—ใƒฌใƒผๅฅฝใƒ—ใƒฌใƒผๅคง่ณž๏ผ๏ผˆ็ใƒ—ใƒฌใƒผๅคšใ‚๏ผ‰ใ€
yushibats

ใ€ใ“ใ‚Œ1ๆœฌใงใ‚ใ‹ใ‚‹ใ€‘ Difyใ‚’โ€œใพใ‚‹ใฃใจ็†่งฃใ™ใ‚‹โ€ - ๅŸบๆœฌ่ฆ็ด ใ‹ใ‚‰ๅฎŸ่ฃ…ใพใง-

Linked from these articles

Comments

No comments

Let's comment your feelings that are more than good

Qiita Conference 2025 Autumn will be held!: 11/5(Wed) - 11/7(Fri)

Qiita Conference is Qiita's largest tech conference, dedicated to engineers in the age of AI!

Keynote Speaker

piacere, Tsuyoshi Ushio, Esteban Suarez, Takuto Wada, seya, MinoDriven, Toshihiro Ichitani, Karaage, Yoshimasa Iwase, Matz, Minorun, Null-Sensei

View event details

Qiita Advent Calendar is held!

Qiita Advent Calendar is an article posting event where you post articles by filling a calendar ๐ŸŽ…

Some calendars come with gifts and some gifts are drawn from all calendars ๐Ÿ‘€

Please tie the article to your calendar and let's enjoy Christmas together!

Being held Article posting campaign

1
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

Login to continue?

Login or Sign up with social account

Login or Sign up with your email address