{"id":1511,"date":"2013-01-11T00:36:32","date_gmt":"2013-01-10T15:36:32","guid":{"rendered":"http:\/\/www.techscore.com\/blog\/?p=1511"},"modified":"2018-11-14T16:33:57","modified_gmt":"2018-11-14T07:33:57","slug":"rails3%e3%81%aeprotect_from_forgery%e3%81%af%e3%83%88%e3%83%bc%e3%82%af%e3%83%b3%e3%81%ae%e6%a4%9c%e8%a8%bcng%e3%81%ae%e5%a0%b4%e5%90%88%e3%81%abreset_session%e3%81%99%e3%82%8b","status":"publish","type":"post","link":"https:\/\/www.techscore.com\/blog\/2013\/01\/11\/rails3%e3%81%aeprotect_from_forgery%e3%81%af%e3%83%88%e3%83%bc%e3%82%af%e3%83%b3%e3%81%ae%e6%a4%9c%e8%a8%bcng%e3%81%ae%e5%a0%b4%e5%90%88%e3%81%abreset_session%e3%81%99%e3%82%8b\/","title":{"rendered":"Rails3\u306eprotect_from_forgery\u306f\u30c8\u30fc\u30af\u30f3\u306e\u691c\u8a3cNG\u306e\u5834\u5408\u306breset_session\u3059\u308b"},"content":{"rendered":"<p>\u3053\u3093\u306b\u3061\u306f\u3001\u9234\u6728\u3067\u3059\u3002<\/p>\n<p>CSRF \u5bfe\u7b56\u3067\u4f7f\u7528\u3059\u308b protect_from_forgery \u3067\u3059\u304c\u3001Rails3 \u304b\u3089\u306f\u30c8\u30fc\u30af\u30f3\u306e\u691c\u8a3c NG \u306e\u5834\u5408\u306b reset_session \u3059\u308b\u3088\u3046\u306b\u52d5\u4f5c\u304c\u5909\u66f4\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n<p>\u4eca\u307e\u3067\u306f\u30c8\u30fc\u30af\u30f3\u306e\u691c\u8a3c\u3067 NG \u3060\u3063\u305f\u5834\u5408\u306b InvalidAuthenticityToken \u304c raise \u3055\u308c\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f reset_session \u3055\u308c\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3057\u305f\u3002<\/p>\n<p>&nbsp;<\/p>\n<h2>protect_from_forgery \u306e\u52d5\u4f5c<\/h2>\n<p>protect_from_forgery \u306f\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u306b\u66f8\u3044\u3066\u304a\u304f\u3053\u3068\u3067\u3001\u30ea\u30af\u30a8\u30b9\u30c8\u3068\u30bb\u30c3\u30b7\u30e7\u30f3\u306b\u6301\u305f\u305b\u305f\u30c8\u30fc\u30af\u30f3\u304c\u7b49\u3057\u3044\u3053\u3068\u3092\u691c\u8a3c\u3057\u3066\u304f\u308c\u307e\u3059\u3002<\/p>\n<pre class=\"lang:ruby decode:true\">class ApplicationController &lt; ActionController::Base\r\n\r\n  protect_from_forgery\r\n\r\nend<\/pre>\n<p>\u30c8\u30fc\u30af\u30f3\u306e\u691c\u8a3c\u3067 NG \u3068\u306a\u3063\u305f\u5834\u5408\u306e\u52d5\u4f5c\u3067\u3059\u304c\u3001 Rails2 \u3068 Rails3 \u3067\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u7570\u306a\u308a\u307e\u3059\u3002<\/p>\n<ul>\n<li>Rails2 ... InvalidAuthenticityToken \u304c raise \u3055\u308c\u308b\u3002<\/li>\n<li>Rails3 ... reset_session \u304c\u5b9f\u884c\u3055\u308c\u308b\u3002<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h2>InvalidAuthenticityToken \u3092 raise \u3059\u308b\u3088\u3046\u306b\u623b\u3059<\/h2>\n<p>\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u3092\u8ffd\u3044\u304b\u3051\u305f\u3068\u3053\u308d\u3001\u30c8\u30fc\u30af\u30f3\u306e\u691c\u8a3c\u304c NG \u306e\u5834\u5408\u306e\u51e6\u7406\u3092\u884c\u306a\u3063\u3066\u3044\u308b\u5834\u6240\u304c\u898b\u3064\u304b\u308a\u307e\u3057\u305f\u3002<\/p>\n<p><a href=\"https:\/\/github.com\/rails\/rails\/blob\/3-2-stable\/actionpack\/lib\/action_controller\/metal\/request_forgery_protection.rb#L85\">lib\/action_controller\/metal\/request_forgery_protection.rb<\/a> \u3067\u5b9a\u7fa9\u3055\u308c\u3066\u3044\u308b handle_unverified_request \u3067\u3059\u3002<\/p>\n<pre class=\"lang:ruby decode:true\">      # This is the method that defines the application behavior when a request is found to be unverified.\r\n      # By default, \\Rails resets the session when it finds an unverified request.\r\n      def handle_unverified_request\r\n        reset_session\r\n      end<\/pre>\n<p>\u30b3\u30e1\u30f3\u30c8\u306b\u66f8\u304b\u308c\u3066\u3044\u307e\u3059\u304c\u3001handle_unverified_request \u306f\u30c8\u30fc\u30af\u30f3\u306e\u691c\u8a3c\u304c NG \u3060\u3063\u305f\u5834\u5408\u306e\u6319\u52d5\u3092\u6c7a\u3081\u308b\u30e1\u30bd\u30c3\u30c9\u3067\u3042\u308a\u3001\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u30ea\u30bb\u30c3\u30c8\u3057\u307e\u3059\u3002<\/p>\n<p>\u4ee5\u524d\u306e\u3088\u3046\u306b InvalidAuthenticityToken \u3092 raise \u3059\u308b\u3088\u3046\u306b\u623b\u3057\u305f\u3044\u5834\u5408\u306f\u3001ApplicationController \u306a\u3069\u3067 handle_unverified_request \u3092\u4e0a\u66f8\u304d\u3059\u308c\u3070 OK \u3067\u3059\u3002<\/p>\n<pre class=\"lang:ruby decode:true\">class ApplicationController &lt; ActionController::Base\r\n\r\n  protect_from_forgery\r\n\r\n  protected\r\n\r\n  def handle_unverified_request\r\n    raise ActionController::InvalidAuthenticityToken\r\n  end\r\n\r\nend<\/pre>\n<p>\u3053\u308c\u3067\u4ee5\u524d\u306e\u3088\u3046\u306b\u3001\u30c8\u30fc\u30af\u30f3\u306e\u691c\u8a3c\u304c NG \u306e\u5834\u5408\u306b InvalidAuthentyicityToken \u304c raise \u3055\u308c\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3057\u305f\u3002<\/p>\n<p>&nbsp;<\/p>\n<h2>\u3042\u3068\u304c\u304d<\/h2>\n<p>protect_from_forgery \u306e\u52d5\u4f5c\u304c\u5909\u308f\u3063\u3066\u3044\u308b\u3053\u3068\u306b\u6c17\u4ed8\u3044\u305f\u6642\u306b\u3001\u3068\u3093\u3067\u3082\u306a\u3044\u52d8\u9055\u3044\u3092\u3057\u3066\u3057\u307e\u3044\u307e\u3057\u305f\u3002<\/p>\n<p>\u300c\u30ed\u30b0\u30a4\u30f3\u4e0d\u8981\u306a\u30da\u30fc\u30b8\u3067\u306f reset_session \u3057\u3066\u3082 CSRF \u3067\u304d\u3066\u3057\u307e\u3046\u3058\u3083\u306a\u3044\u304b\uff01\u300d\u3068\u3002<\/p>\n<p>\u3053\u308c\u306f\u5358\u306a\u308b\u52d8\u9055\u3044\u3067\u3001\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u3044\u306a\u3044\u306e\u3067\u3042\u308c\u3070 CSRF \u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002<\/p>\n<p>\u4f8b\u3048\u3070\u3001\u30b7\u30e7\u30c3\u30d4\u30f3\u30b0\u30b5\u30a4\u30c8\u306b\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u3044\u308b\u3068\u3059\u308b\u3068\u3001<\/p>\n<ul>\n<li>Cookie \u306b\u30ed\u30b0\u30a4\u30f3\u60c5\u5831\u304c\u4fdd\u6301\u3055\u308c\u3066\u3044\u308b\u3002<\/li>\n<li>\u30b7\u30e7\u30c3\u30d4\u30f3\u30b0\u30b5\u30a4\u30c8\u306e\u30da\u30fc\u30b8\u3092\u95b2\u89a7\u3059\u308b\u305f\u3073\u306b Cookie \u304c\u9001\u4fe1\u3055\u308c\u308b\uff08Cookie \u306b\u306f\u653b\u6483\u30b5\u30a4\u30c8\u306b\u306f\u63a8\u6e2c\u56f0\u96e3\u306a\u30bb\u30c3\u30b7\u30e7\u30f3 ID \u304c\u542b\u307e\u308c\u308b\uff09\u3002<\/li>\n<li>\u653b\u6483\u30b5\u30a4\u30c8\u306f\u30da\u30fc\u30b8\u304c\u8868\u793a\u3055\u308c\u305f\u6642\u306b\u3001\u30d0\u30ec\u306a\u3044\u3088\u3046\u306b\u30b7\u30e7\u30c3\u30d4\u30f3\u30b0\u30b5\u30a4\u30c8\u306e\u6ce8\u6587\u78ba\u5b9a\u30da\u30fc\u30b8\u306b POST \u3059\u308b\u3002<\/li>\n<li>\u653b\u6483\u30b5\u30a4\u30c8\u304c\u7528\u610f\u3057\u305f\u300c\u6ce8\u6587\u3059\u308b\u300d\u3068\u3044\u3046\u60c5\u5831\u3068\u3068\u3082\u306b\u3001\u30d6\u30e9\u30a6\u30b6\u304b\u3089\u306f Cookie \u3082\u9001\u4fe1\u3055\u308c\u308b\u306e\u3067\u3001\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u3044\u308b\u300c\u3042\u306a\u305f\u300d\u304c\u6ce8\u6587\u3092\u78ba\u5b9a\u3057\u305f\u3053\u3068\u306b\u306a\u308b\u3002<\/li>\n<\/ul>\n<p>\u3068\u3044\u3046\u3082\u306e\u304c CSRF \u3067\u3059\u3002<\/p>\n<p>\u3064\u307e\u308a\u3001\u653b\u6483\u30b5\u30a4\u30c8\u304c\u7528\u610f\u3057\u305f\u300c\u6ce8\u6587\u3059\u308b\u300d\u3068\u3044\u3046\u60c5\u5831\u3068\u3001\u30b7\u30e7\u30c3\u30d4\u30f3\u30b0\u30b5\u30a4\u30c8\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u305f\u3073\u306b\u30d6\u30e9\u30a6\u30b6\u304b\u3089\u81ea\u52d5\u9001\u4fe1\u3055\u308c\u308b\u300c\u3042\u306a\u305f\u300d\u3092\u7279\u5b9a\u3059\u308b\u60c5\u5831\u306e\u7d44\u307f\u5408\u308f\u305b\u3067\u3001\u300c\u3042\u306a\u305f\u300d\u304c\u6ce8\u6587\u3057\u305f\u3053\u3068\u306b\u306a\u308b\u3002<\/p>\n<p>\u3053\u308c\u304c CSRF \u3067\u3059\u3002<\/p>\n<p>\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u3044\u306a\u3051\u308c\u3070\u3001\u30d6\u30e9\u30a6\u30b6\u304b\u3089\u81ea\u52d5\u9001\u4fe1\u3055\u308c\u308b\u300c\u3042\u306a\u305f\u300d\u3092\u7279\u5b9a\u3059\u308b\u60c5\u5831\u306f\u7121\u3044\u306e\u3067\u3001CSRF \u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002<\/p>\n<p>CSRF \u3092\u7406\u89e3\u3057\u3066\u3044\u308b\u3068\u601d\u3063\u3066\u3044\u305f\u3082\u306e\u306e\u3001\u304d\u3061\u3093\u3068\u7406\u89e3\u3067\u304d\u3066\u3044\u306a\u304b\u3063\u305f\u306e\u3067\u52d8\u9055\u3044\u3057\u3066\u3057\u307e\u3044\u307e\u3057\u305f\u3002<\/p>\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u95a2\u4fc2\u306e\u8a71\u306f\u3001\u300c\u805e\u3044\u305f\u3053\u3068\u304c\u3042\u308b\u300d\u3067\u306f\u4e0d\u5341\u5206\u3001\u300c\u3060\u3044\u305f\u3044\u7406\u89e3\u3057\u3066\u3044\u308b\u300d\u3067\u3082\u4e0d\u5341\u5206\u3001\u3068\u3044\u3046\u3053\u3068\u3092\u8eab\u306b\u3057\u307f\u305f\u51fa\u6765\u4e8b\u3067\u3057\u305f\u3002<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u3053\u3093\u306b\u3061\u306f\u3001\u9234\u6728\u3067\u3059\u3002<\/p>\n<p>CSRF \u5bfe\u7b56\u3067\u4f7f\u7528\u3059\u308b protect_from_forgery \u3067\u3059\u304c\u3001Rails3 \u304b\u3089\u306f\u30c8\u30fc\u30af\u30f3\u306e\u691c\u8a3c NG \u306e\u5834\u5408\u306b reset_session \u3059\u308b\u3088\u3046\u306b\u52d5\u4f5c\u304c\u5909\u66f4\u3055\u308c\u307e\u3057\u305f\u3002<br \/><a href=\"https:\/\/www.techscore.com\/blog\/2013\/01\/11\/rails3%e3%81%aeprotect_from_forgery%e3%81%af%e3%83%88%e3%83%bc%e3%82%af%e3%83%b3%e3%81%ae%e6%a4%9c%e8%a8%bcng%e3%81%ae%e5%a0%b4%e5%90%88%e3%81%abreset_session%e3%81%99%e3%82%8b\/\">\u7d9a\u304d\u3092\u8aad\u3080...<\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[18],"tags":[74,22,75],"_links":{"self":[{"href":"https:\/\/www.techscore.com\/blog\/wp-json\/wp\/v2\/posts\/1511"}],"collection":[{"href":"https:\/\/www.techscore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.techscore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.techscore.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.techscore.com\/blog\/wp-json\/wp\/v2\/comments?post=1511"}],"version-history":[{"count":1,"href":"https:\/\/www.techscore.com\/blog\/wp-json\/wp\/v2\/posts\/1511\/revisions"}],"predecessor-version":[{"id":17980,"href":"https:\/\/www.techscore.com\/blog\/wp-json\/wp\/v2\/posts\/1511\/revisions\/17980"}],"wp:attachment":[{"href":"https:\/\/www.techscore.com\/blog\/wp-json\/wp\/v2\/media?parent=1511"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.techscore.com\/blog\/wp-json\/wp\/v2\/categories?post=1511"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.techscore.com\/blog\/wp-json\/wp\/v2\/tags?post=1511"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}