{"id":5960,"date":"2020-02-26T02:20:11","date_gmt":"2020-02-25T17:20:11","guid":{"rendered":"https:\/\/blog.capilano-fw.com\/?p=5960"},"modified":"2020-02-26T02:25:05","modified_gmt":"2020-02-25T17:25:05","slug":"express%e3%81%a7csrf%e5%af%be%e7%ad%96%e3%82%92%e3%81%99%e3%82%8b","status":"publish","type":"post","link":"https:\/\/blog.capilano-fw.com\/?p=5960","title":{"rendered":"Express\u3067CSRF\u5bfe\u7b56\u3092\u3059\u308b"},"content":{"rendered":"

\u3055\u3066\u3055\u3066\u3001\u307e\u3060\u307e\u3060Express<\/code>\u306b\u95a2\u308f\u308b\u8a18\u4e8b\u3092\u7d9a\u3051\u3066\u6295\u7a3f\u3057\u3066\u3044\u307e\u3059\u304c\u3001\u3084\u306f\u308a\u3068\u3044\u3046\u304b\u3044\u3064\u3082\u300c\u30de\u30b8\u30ab\u30eb\u300d\u3068\u307e\u3067\u8a55\u4fa1\u3055\u308c\u305fLaravel<\/code>\u3068\u306e\u6bd4\u8f03\u3092\u5fc3\u306e\u3069\u3053\u304b\u3067\u3084\u3063\u3066\u3044\u308b\u81ea\u5206\u304c\u3044\u305f\u308a\u3057\u307e\u3059\uff08\u7b11\uff09<\/p>\n

\u305d\u3057\u3066\u3001\u3053\u306e\u9593\u3082\u300c\u3042\u3001\u305d\u3046\u3044\u3048\u3070\u3042\u306e\u6a5f\u80fd\u304cExpress<\/code>\u306b\u3082\u307b\u3057\u3044\u306a\u301c\u300d\u306a\u3093\u3066\u3044\u3046\u601d\u3063\u3066\u3057\u307e\u3044\u307e\u3057\u305f\u3002<\/p>\n

\u305d\u306e\u6a5f\u80fd\u306f\u3068\u3044\u3046\u3068\u30fb\u30fb\u30fb<\/p>\n

CSRF\uff08\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30ea\u30af\u30a8\u30b9\u30c8\u30d5\u30a9\u30fc\u30b8\u30a7\u30ea\uff09\u5bfe\u7b56<\/strong><\/p>\n

\u3067\u3059\u3002<\/p>\n

\u203b\u3082\u3057\u3001\u307e\u3060CSRF<\/code>\u3092\u805e\u3044\u305f\u3053\u3068\u304c\u306a\u3044\u4eba\u306f\u30b9\u30c8\u30fc\u30ea\u30fc\u4ed5\u7acb\u3066\u3067\u7d39\u4ecb\u3057\u3066\u3044\u307e\u3059\u306e\u3067\u3001\u305c\u3072\u4ee5\u4e0b\u306e\u8a18\u4e8b\u3092\u3054\u89a7\u304f\u3060\u3055\u3044\u3002\uff08\u6642\u9593\u304c\u7121\u3044\u65b9\u306f\u3001\u3068\u306b\u304b\u304f\u300c\u306a\u308a\u304b\u308f\u308a\u5bfe\u7b56\u300d\u3068\u8003\u3048\u3066\u304a\u3044\u3066\u304f\u3060\u3055\u3044\uff09<\/p>\n

\u3010\u53c2\u8003\u8a18\u4e8b\u3011CSRF\uff08\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30fb\u30ea\u30af\u30a8\u30b9\u30c8\u30fb\u30d5\u30a9\u30fc\u30b8\u30a7\u30ea\uff09\u653b\u6483\u3092\u3067\u304d\u308b\u3060\u3051\u5206\u304b\u308a\u3084\u3059\u304f\u89e3\u8aac<\/a><\/p>\n

\u305d\u3053\u3067\uff01<\/p>\n

\u4eca\u56de\u306fExpress<\/code>\u306bCSRF<\/code>\u5bfe\u7b56\u3092\u65bd\u3057\u3066\u3088\u308a\u30bb\u30ad\u30e5\u30a2\u306a\u30a6\u30a7\u30d6\u30b5\u30a4\u30c8\u306b\u3057\u3066\u307f\u305f\u3044\u3068\u601d\u3044\u307e\u3059\u3002<\/p>\n

\u305c\u3072\u7686\u3055\u3093\u306e\u304a\u5f79\u306b\u7acb\u3066\u308b\u3068\u5b09\u3057\u3044\u3067\u3059\ud83d\ude0a\u2728<\/p>\n

\"\"<\/p>\n

\u958b\u767a\u74b0\u5883\uff1a<\/strong> Node 8\u3001Express 4.1<\/p>\n

\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b<\/h1>\n

\u4eca\u56de\u306fCSRF<\/code>\u5bfe\u7b56\u306b\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u4f7f\u3044\u307e\u3059\u306e\u3067\u3001\u4ee5\u4e0b\u306e\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u304a\u3044\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n

npm i --save express-session<\/strong><\/pre>\n
\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u8aad\u307f\u8fbc\u3080<\/h1>\n
\u6b21\u306b\u3001\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u305f\u30d1\u30c3\u30b1\u30fc\u30b8\u3068crypto<\/code>\uff08\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u306f\u4e0d\u8981\uff09\u3092app.js<\/code>\u3067\u8aad\u307f\u8fbc\u3093\u3067\u4f7f\u3048\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/p>\n
const session = require('express-session');\r\nconst crypto = require('crypto');<\/strong><\/pre>\n
\u30df\u30c9\u30eb\u30a6\u30a7\u30a2\u3092\u8a2d\u5b9a\u3059\u308b<\/h1>\n
\u540c\u3058\u304f\u30bb\u30c3\u30b7\u30e7\u30f3\u30c7\u30fc\u30bf\u304c\u4f7f\u3048\u308b\u3088\u3046\u306b\u3059\u308b\u305f\u3081\u3001\u307e\u305f\u3001\u9001\u4fe1\u3055\u308c\u3066\u304f\u308bPOST<\/code>\u30c7\u30fc\u30bf\u3092\u53d6\u5f97\u3067\u304d\u308b\u3088\u3046\u306b\u3059\u308b\u305f\u3081\u306b\u4ee5\u4e0b\u306e\u30df\u30c9\u30eb\u30a6\u30a7\u30a2\u3092\u8ffd\u52a0\u3057\u307e\u3059\u3002<\/p>\n
\/\/ \u30bb\u30c3\u30b7\u30e7\u30f3\u306e\u8a2d\u5b9a\r\napp.use(session({\r\n  secret: 'YOUR-SECRET-STRING',\r\n  resave: true,\r\n  saveUninitialized: true\r\n}));<\/strong>\r\n\r\n\/\/ POST\u30c7\u30fc\u30bf\u306e\u53d6\u5f97\r\napp.use(express.json());\r\napp.use(express.urlencoded({ extended: true }));<\/strong><\/pre>\n
CSRF\u5bfe\u7b56\u306e\u30df\u30c9\u30eb\u30a6\u30a7\u30a2\u3092\u3064\u304f\u308b<\/h1>\n
\u3067\u306f\u3001\u672c\u984c\u306eCSRF<\/code>\u653b\u6483\u3092\u9632\u3050\u30df\u30c9\u30eb\u30a6\u30a7\u30a2\u3067\u3059\u3002<\/p>\n
app.use((req, res, next) => {\r\n\r\n  const method = req.method;\r\n\r\n  if(method === 'GET') {\r\n\r\n    const csrfToken = crypto.randomBytes(20).toString('hex');\r\n    req.session.csrfToken = csrfToken;\r\n    res.locals = {\r\n      csrfToken: csrfToken,\r\n      csrfField: '<input type=\"hidden\" name=\"_token\" value=\"'+ csrfToken +'\">'\r\n    };\r\n\r\n  } else if(['POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {\r\n\r\n    if(req.body._token !== req.session.csrfToken) {\r\n\r\n      return res.status(419).send('Page Expired');\r\n\r\n    }\r\n\r\n  }\r\n\r\n  next();\r\n\r\n});<\/strong><\/pre>\n
\u3053\u306e\u4e2d\u3067\u3084\u3063\u3066\u3044\u308b\u306e\u306f\u3001\u307e\u305a\u30a2\u30af\u30bb\u30b9\u3055\u308c\u305f\u30e1\u30bd\u30c3\u30c9\u304cGET<\/code>\u306e\u6642\u306bCSRF<\/code>\u30c8\u30fc\u30af\u30f3\uff08\u30ef\u30f3\u30bf\u30a4\u30e0\u30d1\u30b9\u30ef\u30fc\u30c9\uff09\u3092\u4f5c\u3063\u3066\u30bb\u30c3\u30b7\u30e7\u30f3\u306b\u683c\u7d0d\u3001\u3055\u3089\u306bres.locals<\/code>\u306b\u3082\u683c\u7d0d\u3057\u3066\u3001\u3069\u306e\u30d3\u30e5\u30fc\u304b\u3089\u3067\u3082CSRF<\/code>\u306e\u60c5\u5831\u304c\u53d6\u5f97\u3067\u304d\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/p>\n
\uff08\u3064\u307e\u308a\u3001\u30c7\u30fc\u30bf\u9001\u4fe1\u5f8c\u306b\u30d3\u30e5\u30fc\u3067\u8a2d\u5b9a\u3057\u305f\u30c8\u30fc\u30af\u30f3\u3068\u30bb\u30c3\u30b7\u30e7\u30f3\u5185\u306e\u30c8\u30fc\u30af\u30f3\u304c\u4e00\u81f4\u3059\u308c\u3070\u6b63\u3057\u3044\u9001\u4fe1\u3068\u3057\u3066\u51e6\u7406\u3055\u308c\u308b\u308f\u3051\u3067\u3059\uff09<\/p>\n
\u305d\u3057\u3066\u3001\u9001\u4fe1\u30e1\u30bd\u30c3\u30c9\u304c\u4ee5\u4e0b\u306e\u3046\u3061\u306e\u3044\u3065\u308c\u304b\u306e\u5834\u5408\u306b\u3001\u30c8\u30fc\u30af\u30f3\u3092\u30c1\u30a7\u30c3\u30af\u3057\u3001\u9593\u9055\u3063\u3066\u3044\u305f\u3089\u51e6\u7406\u3092\u30b9\u30c8\u30c3\u30d7\u3057\u307e\u3059\u3002<\/p>\n