{"id":1530,"date":"2020-07-10T10:18:46","date_gmt":"2020-07-10T01:18:46","guid":{"rendered":"https:\/\/curecode.jp\/tech\/?p=1530"},"modified":"2020-07-08T01:56:07","modified_gmt":"2020-07-07T16:56:07","slug":"laravel-csrf-check-except-with-specified-referer-uri","status":"publish","type":"post","link":"https:\/\/curecode.jp\/tech\/laravel-csrf-check-except-with-specified-referer-uri\/","title":{"rendered":"[Laravel] \u7279\u5b9a\u30b5\u30a4\u30c8 (URI)\u304b\u3089\u306e\u30a2\u30af\u30bb\u30b9\u306e\u307fCSRF \u30c1\u30a7\u30c3\u30af\u3092\u9664\u5916\u3057\u305f\u3044"},"content":{"rendered":"

Laravel \u306e CSRF \u5bfe\u7b56\u6a5f\u80fd<\/h3>\n

\n Laravel \u306b\u306f CSRF(\u30af\u30ed\u30b9\u30fb\u30b5\u30a4\u30c8\u30fb\u30ea\u30af\u30a8\u30b9\u30c8\u30fb\u30d5\u30a9\u30fc\u30b8\u30a7\u30ea)\u5bfe\u7b56\u306e\u6a5f\u80fd\u304c\u5099\u308f\u3063\u3066\u3044\u307e\u3059\u3002\n<\/p>\n

\r\n
\r\n    @csrf\r\n    ...\r\n<\/form>\r\n<\/code><\/pre>\n
\n\u8a73\u3057\u304f\u306f CSRF\u4fdd\u8b77 6.x Laravel<\/a>  \u3092\u898b\u3066\u304f\u3060\u3055\u3044\u3002\n<\/p>\n
\u7279\u5b9a\u30b5\u30a4\u30c8\u304b\u3089\u306e\u30a2\u30af\u30bb\u30b9\u3092\u9664\u5916\u3057\u305f\u3044<\/h3>\n
\n  \u3057\u304b\u3057\u3001\u30b7\u30b9\u30c6\u30e0\u9023\u643a\u306a\u3069\u306e\u90fd\u5408\u3067\u3001\u7279\u5b9a\u30b5\u30a4\u30c8(URL)\u304b\u3089\u306e\u30a2\u30af\u30bb\u30b9\u306b\u3064\u3044\u3066\u306f CSRF \u306e\u30c1\u30a7\u30c3\u30af\u3092\u3057\u306a\u3044\u3088\u3046\u306b\u3057\u305f\u3044\u5834\u5408\u304c\u3042\u308a\u307e\u3059\u3002\n<\/p>\n
\n  \u4e0a\u8a18\u306e CSRF\u4fdd\u8b77 6.x Laravel (URI\u306e\u9664\u5916)<\/a> \u306e\u4f8b\u3092\u898b\u308b\u3068 VerifyCsrfToken \u30df\u30c9\u30eb\u30a6\u30a7\u30a2\u306b\n<\/p>\n
\n
\r\nclass VerifyCsrfToken extends Middleware\r\n{\r\n    \/**\r\n     * CSRF\u30d0\u30ea\u30c7\u30fc\u30b7\u30e7\u30f3\u304b\u3089\u9664\u5916\u3059\u308bURI\r\n     *\r\n     * @var array\r\n     *\/\r\n    protected $except = [\r\n        'stripe\/*',\r\n        'http:\/\/example.com\/foo\/bar',\r\n        'http:\/\/example.com\/foo\/*',\r\n    ];\r\n}\r\n<\/pre>\n<\/blockquote>\n
\n  \u3068\u66f8\u304f\u4f8b\u304c\u8f09\u3063\u3066\u3044\u308b\u306e\u3067\u3001\u3053\u3053\u306b\u30ea\u30d5\u30a1\u30e9\u30fc\u3068\u3057\u3066\u9664\u5916\u3057\u305f\u3044\u30b5\u30a4\u30c8\u3092\u8a18\u8f09\u3059\u308c\u3070\u826f\u3055\u305d\u3046\u306b\u601d\u3048\u307e\u3059\u3002\u3068\u3053\u308d\u304c\u3046\u307e\u304f\u3044\u304d\u307e\u305b\u3093\u3002\n<\/p>\n
\n  \u306a\u305c\u306a\u3089 $except<\/code> \u3067\u6307\u5b9a\u3059\u308b\u9664\u5916\u3059\u308bURI \u3068\u306f\u3001POST\u5148\u306e URL \u306e\uff08\u53c2\u7167\u3055\u308c\u308b\u5074\u306e\uff09\u3067\u3042\u308a\u3001\u53c2\u7167\u5143\u306e URL \u3067\u306f\u306a\u3044\u304b\u3089\u3067\u3059\u3002\n<\/p>\n
\u30ea\u30d5\u30a1\u30e9\u30fc\u3092\u53c2\u7167\u3057\u3066 $except \u3092\u5909\u66f4\u3059\u308b<\/h3>\n
\n  \u3067\u306f\u3001\u30ea\u30d5\u30a1\u30e9\u30fc\u306e URL \u3092\u4f7f\u3046\u65b9\u6cd5\u306f\u306a\u3044\u306e\u304b\u3068\u3044\u3046\u3068\u3001VerifyCsrfToken \u30df\u30c9\u30eb\u30a6\u30a7\u30a2\u3067 handle \u3092\u30aa\u30fc\u30d0\u30fc\u30e9\u30a4\u30c9\u3059\u308c\u3070\u53ef\u80fd\u3067\u3059\u3002\n<\/p>\n
\r\nnamespace App\\Http\\Middleware;\r\n\r\nuse Closure;\r\n\r\nclass VerifyCsrfToken extends Middleware\r\n    ...\r\n\r\n    \/**\r\n     * \u7279\u5b9a\u306e\u30ea\u30d5\u30a1\u30e9\u30fc\u306e\u5834\u5408\u306b\u3001\u7279\u5b9a\u30da\u30fc\u30b8\u306e CSRF \u30c1\u30a7\u30c3\u30af\u3092\u8fc2\u56de\u3059\u308b\u305f\u3081\u306b handle \u3092\u30aa\u30fc\u30d0\u30fc\u30e9\u30a4\u30c9\u3059\u308b\r\n     *\/\r\n    public function handle($request, Closure $next)\r\n    {\r\n        \/\/ \u30ea\u30af\u30a8\u30b9\u30c8\u304c\u7279\u5b9a URI \u304b\u3089\u59cb\u307e\u308b\u3082\u306e\u3067\u3042\u308c\u3070\r\n        if (\\Str::startsWith($request->headers->get('referer'), 'https:\/\/example.net\/')) {\r\n            \/\/ \u3044\u304f\u3064\u304b\u306e\u753b\u9762\u3067\u306f CSRF \u30c1\u30a7\u30c3\u30af\u3092\u3057\u306a\u3044\u3088\u3046\u306b\u3059\u308b (\u914d\u5217\u3078\u306e\u8ffd\u52a0)\r\n            $this->except = array_merge($this->except, ['\/posts', '\/comments']);\r\n        }\r\n        return parent::handle($request, $next);\r\n    }\r\n<\/code><\/pre>\n
\n  \u3053\u308c\u3067 https:\/\/example.net\/ \u304b\u3089\u59cb\u307e\u308b URI \u304c\u30ea\u30d5\u30a1\u30e9\u30fc\u306b\u30bb\u30c3\u30c8\u3055\u308c\u3066\u3044\u308b\u3068\u304d\u306f\u3001\/posts \u3068 \/comments \u306b\u3064\u3044\u3066\u306f CSRF \u30c1\u30a7\u30c3\u30af\u306e\u9664\u5916\u5bfe\u8c61\u3068\u3059\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002\n<\/p>\n
http \u2192 https \u3067\u306f\u30ea\u30d5\u30a1\u30e9\u30fc\u304c\u53d6\u308c\u306a\u3044\u306e\u3067\u6ce8\u610f<\/h3>\n
\n  \u901a\u5e38\u3001 Web \u30d6\u30e9\u30a6\u30b6\u306f\u3001http \u306e URL \u304b\u3089 https \u306e URL \u306b\u9077\u79fb\u3059\u308b\u3068\u304d\u306f\u306b\u30ea\u30d5\u30a1\u30e9\u30fc\u3092\u9001\u51fa\u3057\u307e\u305b\u3093\u3002\n<\/p>\n
\n  \u3053\u308c\u306f Laravel \u306b\u9650\u3063\u305f\u8a71\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u30ea\u30d5\u30a1\u30e9\u30fc\u3092\u4f7f\u3063\u305f\u51e6\u7406\u3092\u3059\u308b\u3068\u304d\u306b\u306f\u6ce8\u610f\u304c\u5fc5\u8981\u3067\u3059\u3002\u7279\u306b\u958b\u767a\u3084\u30c6\u30b9\u30c8\u3067 http \u306e\u30ed\u30fc\u30ab\u30eb\u74b0\u5883\u304b\u3089 https \u306e\u30b5\u30a4\u30c8\u306b POST \u3057\u3066\u3082\u30ea\u30d5\u30a1\u30e9\u30fc\u304c\u53d6\u308c\u307e\u305b\u3093\u306e\u3067\u6c17\u3092\u3064\u3051\u3066\u304f\u3060\u3055\u3044\u3002\n<\/p>\n
\u53c2\u8003<\/h3>\n