victim.com\/member\/modify\/42<\/em> \uc8fc\uc18c\uc5d0 \uc811\uadfc\ud558\uac8c \ub429\ub2c8\ub2e4.
\ud574\ub2f9 \ud398\uc774\uc9c0\uac00 \uc815\uc0c1\uc801\uc73c\ub85c load\ub418\uba74 onload \uc774\ubca4\ud2b8 \ud578\ub4e4\ub7ec\ub97c, load\uc5d0 \uc2e4\ud328\ud558\uba74 onerror \uc774\ubca4\ud2b8 \ud578\ub4e4\ub7ec\ub97c \uc2e4\ud589\ud558\uac8c \ub429\ub2c8\ub2e4.
A\uc640 B\uac00 \ud574\ub2f9 \ud398\uc774\uc9c0\uc5d0 \uc811\uadfc\ud588\uc744 \ub54c A\ub294 onload \uc774\ubca4\ud2b8 \ud578\ub4e4\ub7ec\ub97c, B\ub294 onerror \uc774\ubca4\ud2b8 \ud578\ub4e4\ub7ec\ub97c \uc2e4\ud589\ud558\uac8c \ub418\uaca0\uad70\uc694.
\uac01\uac01\uc5d0\ub294 \uc790\uc2e0\uc758 IP\uc8fc\uc18c, \ub9ac\ud37c\ub7ec, \uc720\uc800\uc5d0\uc774\uc804\ud2b8, \uc811\uc18d \uc2dc\uac04 \ub4f1\uc744 \ub85c\uac70\uc5d0 \uc804\ub2ec\ud558\ub294 \ucf54\ub4dc\uac00 \uc120\uc5b8\ub418\uc5b4 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n\uc774\uc81c \uacf5\uaca9\uc790\ub294 \uc790\uc2e0\uc758 \uc6f9\uc0ac\uc774\ud2b8\uc5d0 \uc811\uc18d\ud55c \uc775\uba85\uc758 \uc0ac\uc6a9\uc790\uac00 victim.com\uc758 A\uc0ac\uc6a9\uc790\uc778\uc9c0 \uc5ec\ubd80\ub97c \uc2dd\ubcc4\ud560 \uc218 \uc788\uac8c \ub418\uc5c8\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
\ubcc4\ub85c \ud06c\ub9ac\ud2f0\uceec\ud558\uc9c0 \uc54a\ub2e4\uace0 \uc0dd\uac01\ud558\ub098\uc694?
\uadf8\ub7fc \ub2e4\ub978 \uc608\uc2dc\ub97c \ub4e4\uc5b4\ubd05\uc2dc\ub2e4.<\/p>\n\n\n\n
SNS\ub97c \ube44\ub86f\ud55c \ub9ce\uc740 \uc6f9\uc11c\ube44\uc2a4\uc5d0\uc11c\ub294 \uc720\ub8cc \uad11\uace0 \uae30\ub2a5\uc744 \uc81c\uacf5\ud558\uace0 \uc788\uc73c\uba70, \uac1c\uc911\uc5d0\ub294 \ud2b9\uc815 \uc0ac\uc6a9\uc790\uad70\uc744 \uc9c0\ubaa9\ud574\uc11c \uad11\uace0\ub97c \ud560 \uc218 \uc788\ub294 \uae30\ub2a5\uc744 \uc81c\uacf5\ud558\uae30\ub3c4 \ud569\ub2c8\ub2e4.
20\ub300, \ub0a8\uc131, \uc11c\uc6b8\uac70\uc8fc, \uad00\uc2ec\uc0ac\ub294 \uc2a4\ud3ec\uce20 \ub4f1\uc73c\ub85c \ud0c0\uac9f\ud305\uc774 \uac00\ub2a5\ud558\uc8e0.<\/p>\n\n\n\n
\uacf5\uaca9\uc790\ub294 \uad11\uace0\ub97c \ud558\ub098 \ub0c5\ub2c8\ub2e4.
20\ub300\uac00 \ubcfc \uc218 \uc788\ub294 \uad11\uace0\ub97c\uc694.
30\ub300, 40\ub300\uac00 \ubcfc \uc218 \uc788\ub294 \uad11\uace0\ub3c4 \ud558\ub098\uc529 \ub0b4\uba74 \uc88b\uaca0\ub124\uc694.
\ub9c8\ucc2c\uac00\uc9c0\ub85c \uac01\uac01\uc758 \uac8c\uc2dc\ubb3c\uc5d0 \uc811\uadfc\ud588\uc744 \ub54c \uc751\ub2f5\uc774 \ubcc0\ud588\ub294\uc9c0\ub97c \ud655\uc778\ud574\ubd05\ub2c8\ub2e4.
\uc774\ubc88\uc5d0\ub294 \uc790\uc2e0\uc758 \uc6f9\uc0ac\uc774\ud2b8\uc5d0 \uc811\uc18d\ud55c(\uc989 IP\uc8fc\uc18c\ub97c \uc54c \uc218 \uc788\ub294) \uc775\uba85\uc758 \uc0ac\uc6a9\uc790\uc758 \ub098\uc774\ub97c, \uc131\ubcc4\uc744, \uc0ac\ub294 \uc9c0\uc5ed\uc744, \uad00\uc2ec\uc0ac\ub97c \uc54c\uc544\ub0bc \uc218 \uc788\uac8c \ub418\uc5c8\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
\ud55c \uac1c\uc758 \uacf5\uaca9\uae30\ubc95\ucc98\ub7fc \uc124\uba85\ud588\uc9c0\ub9cc, \uc0ac\uc2e4 \uacf5\uaca9\ud558\ub294 \ubc29\ubc95\uc774 \ubb34\uc218\ud788 \ub9ce\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
\uba3c\uc800 \uc2dc\uac04 \uae30\ubc18\uc785\ub2c8\ub2e4.
\uac00\uc7a5 \uc27d\uac8c \ub5a0\uc62c\ub9b4 \uc218 \uc788\ub294 \ubc29\ubc95\uc740 victim.com\/member\/modify\/42<\/em> \uc5d0 \uc811\uadfc\ud588\uc744 \ub54c \uc751\ub2f5\uc5d0 \uac78\ub9ac\ub294 \uc2dc\uac04\uc744 \uc7ac\ub294 \ubc29\ubc95\uc785\ub2c8\ub2e4.
\uc218\uc815 \ud398\uc774\uc9c0\uc640 404 \uc5d0\ub7ec \ud398\uc774\uc9c0\ub294 response\uc758 \uae38\uc774\uac00 \ub2e4\ub97c \uac83\uc774\uba70, \ub2f9\uc5f0\ud788 \uc751\ub2f5 \uc2dc\uac04\ub3c4 \ub2ec\ub77c\uc9c8 \uac83 \uc785\ub2c8\ub2e4.
\ud558\uc9c0\ub9cc \uadf8\ub798\ubd24\uc790 \uc218kb\uc77c \ud14c\uace0, \uc774\uac74 \uc880 \uad6c\ub824 \ubcf4\uc774\uc8e0.
\uc870\uae08 \ub2e4\ub974\uac8c \uac00\ubd05\uc2dc\ub2e4.
\uacf5\uaca9\uc790\ub294 victim.com \uc5d0\uc11c \uac8c\uc2dc\ubb3c\uc744 \uc791\uc131\ud569\ub2c8\ub2e4.
\uadf8 \uac8c\uc2dc\ubb3c\uc744 \uc77d\uc744 \uc218 \uc788\ub294 \uc0ac\ub78c\uc740 A\uc0ac\uc6a9\uc790 \ud55c \uba85\uc73c\ub85c \uc124\uc815\ud569\ub2c8\ub2e4.
\uac8c\uc2dc\ubb3c\uc758 \ub0b4\uc6a9\uc740 \uc544\uc8fc\uc544\uc8fc \uae41\ub2c8\ub2e4. \uc218mb\ub2e8\uc704\ub85c\uc694.
\uc774\ubc88\uc5d0\ub294 \uc751\ub2f5\uc2dc\uac04\uc774 \uc720\uc758\ubbf8\ud558\uac8c \ucc28\uc774\uac00 \ub0a0 \uac83\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n\ud639\uc740 \uc751\ub2f5\ucf54\ub4dc\ub97c \uc0ac\uc6a9\ud560 \uc218\ub3c4 \uc788\uc2b5\ub2c8\ub2e4.
\uc704\uc758 \uc608\uc2dc\uc5d0\uc11c \ub2e4\ub8e8\uc5c8\uc9c0\ub9cc img \ud0dc\uadf8\uc758 \uacbd\uc6b0\uc5d0 \uc751\ub2f5\ucf54\ub4dc\uac00 404\uba74 onerror \uc774\ubca4\ud2b8 \ud578\ub4e4\ub7ec\uac00, 200\uc774\uba74 onload \uc774\ubca4\ud2b8 \ud578\ub4e4\ub7ec\uac00 \ud2b8\ub9ac\uac70\ub429\ub2c8\ub2e4.
\uad8c\ud55c\uc774 \uc5c6\uc744 \uacbd\uc6b0\uc5d0 404 \ucf54\ub4dc\ub97c \uc751\ub2f5\ud558\ub294 \uc11c\ube44\uc2a4\uc5d0\uc11c\ub294 \uacf5\uaca9\uc774 \uc544\uc8fc \uc26c\uc6cc\uc9c0\uaca0\uc8e0.<\/p>\n\n\n\n
\uc7ac\ubbf8\uc788\ub294 \uacf5\uaca9\ubc29\ubc95\uc744 \ud55c \uac00\uc9c0 \ub354 \uc18c\uac1c\ud558\uba74, anchor\ub77c\ub294 \uae30\ub2a5\uc774 \uc788\uc2b5\ub2c8\ub2e4.
#foo<\/em> \uc5d0 \uc811\uc18d\ud588\uc744 \ub54c id\uac00 foo<\/em>\uc778 \uac1d\uccb4\uc5d0 focus\uac00 \ub418\uc8e0.
\uad8c\ud55c\uc774 \uc788\uc744\ub54c\ub9cc load\ub418\ub294 \uac1d\uccb4\uac00 \uc874\uc7ac\ud560 \uacbd\uc6b0\uc5d0 iframe\uc73c\ub85c \ud574\ub2f9 \ud398\uc774\uc9c0\ub97c \ubd88\ub7ec\uc62c \ub54c \ud574\ub2f9 id\uc758 anchor\ub97c \ucd94\uac00\ud558\uba74,
focus\uac00 \ubc14\ub00c\uba70 onblur \uc774\ubca4\ud2b8 \ud578\ub4e4\ub7ec\uac00 \ud2b8\ub9ac\uac70\ub429\ub2c8\ub2e4.
<iframe src=”victim.com\/member\/modify\/42#username<\/em>“><\/iframe> \uac19\uc740 \ubc29\uc2dd\uc774\uc8e0.<\/p>\n\n\n\n\uadf8 \uc678\uc5d0\ub3c4 \ub9ce\uc740 \uacf5\uaca9 \ubc29\ubc95\uc774 \uc874\uc7ac\ud558\uba70, \uc6f9 \uc11c\ube44\uc2a4\uc758 \uad6c\uc870\uc5d0 \ub530\ub77c\uc11c \ub9de\ucda4\ud615\uc73c\ub85c \uc0c8\ub85c\uc6b4 \uacf5\uaca9 \ubc29\ubc95\uc774 \ub098\uc62c \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
Chrome 80<\/h2>\n\n\n\n
Samesite=Lax \ub85c \uae30\ubcf8\uac12\uc774 \ubcc0\uacbd\ub418\uba70 \uc774\ub7ec\ud55c \ubc29\uc2dd\uc758 \uacf5\uaca9\uc740 \ub300\ubd80\ubd84 \ub9c9\ud78c \uac83\uc73c\ub85c \ubcf4\uc785\ub2c8\ub2e4.
\ud558\uc9c0\ub9cc \ud06c\ub86c\uc5d0\uc11c\ub294 \uc131\ub2a5 \uc800\ud558\ub97c \uc774\uc720\ub85c \ud328\uce58\ub418\uc9c0 \uc54a\uc740 known-issue\uac00 \uc874\uc7ac\ud558\uba70, \uc774\ub294 Samesite=Lax\ub97c \uc6b0\ud68c\ud558\ub294 \uc5f4\uc1e0\uac00 \ub420 \uc218 \uc788\ub2e4\uace0 \ubcf4\uace0 \uc9c0\uc18d\ud574\uc11c \uc5f0\uad6c\ub97c \uc9c4\ud589 \uc911\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n
\ub9c8\ubb34\ub9ac<\/h2>\n\n\n\n
Privacy\uac00 \uc810\uc810 \uc911\uc694\ud55c \ud654\ub450\uac00 \ub418\uba70 \uc0ac\uc6a9\uc790\uc758 \uc544\uc774\ub514 \ud328\uc2a4\uc6cc\ub4dc \ub4f1 \uc9c1\uc811\uc801\uc778 \uac1c\uc778\uc815\ubcf4\ub97c \ub118\uc5b4 \uc5ec\ub7ec \uc815\ubcf4\ub97c \uacb0\ud569\ud574\uc11c \uc0ac\uc6a9\uc790\ub97c \uc2dd\ubcc4\ud560 \uc218 \uc788\ub294 \uacbd\uc6b0<\/strong> \ud639\uc740 \ub2e4\ub978 \uc0ac\uc6a9\uc790\uc640 \uad6c\ubcc4\ub418\uc5b4 \ud2b9\uc815\uc778\uc744 \ucc3e\uc744 \uc218 \uc788\ub294 \uacbd\uc6b0<\/strong> \ub610\ud55c \uac1c\uc778\uc815\ubcf4\ub85c \ucde8\uae09\ub418\uba70, \ubcf4\ud638\uc758 \ub300\uc0c1\uc774 \ub429\ub2c8\ub2e4.
\uae30\uc874\uc758 \uacf5\uaca9\ubc29\uc2dd\ub4e4\uacfc \ubc29\ud5a5\uc774 \ub2ec\ub77c \uc0dd\uc18c\ud558\uc9c0\ub9cc, privacy \uad00\uc810\uc5d0\uc11c \uc911\uc694\ud55c \uc774\uc288\uac00 \ub420 \uc218 \uc788\uc73c\ub2c8 \ub9ce\uc740 \uc5f0\uad6c\uc790\ub4e4\uc758 \uad00\uc2ec\uc774 \ud544\uc694\ud55c \ubd84\uc57c\uc785\ub2c8\ub2e4.<\/p>\n","protected":false},"excerpt":{"rendered":"\uc11c\ubb38 \uc57d 2\uac1c\uc6d4 \uc804 \ud06c\ub86c 80\ubc84\uc804\uc774 \ub9b4\ub9ac\uc988 \ub418\uc5c8\uc2b5\ub2c8\ub2e4.\uc5ec\ub7ec \ubcc0\uacbd\uc774 \uc788\uc5c8\uc9c0\ub9cc \uac00\uc7a5 \uc911\uc694\ud55c \ud328\uce58\ub294 \uc5ed\uc2dc \ucfe0\ud0a4\uc758 Samesite \uc635\uc158\uc758 \uae30\ubcf8\uac12\uc774 Lax\ub85c \ubcc0\uacbd\ub41c \uac83\uc774\uc5c8\uc8e0.\uadf8\ub7f0\ub370 80\ubc84\uc804\uc774 \ub9b4\ub9ac\uc988\ub418\uae30 \uc804\uae4c\uc9c0, \ub2e4\uc2dc \ub9d0\ud574 Samesite=Lax\uac00 \ub418\uae30 \uc804\uae4c\uc9c0 \uc140 \uc218 \uc5c6\uc744 \uc815\ub3c4\ub85c \ub9ce\uc740, \uc6b0\ub9ac\uac00 \uc544\ub294 \ub300\ubd80\ubd84\uc758 \uc6f9\uc0ac\uc774\ud2b8\uc5d0 \ud2b9\uc815 \uc885\ub958\uc758 \ucde8\uc57d\uc810\uc774 \uc874\uc7ac\ud588\uc2b5\ub2c8\ub2e4.\uacfc\uc5f0 \uc5b4\ub5a4 \ucde8\uc57d\uc810\uc774 \uc874\uc7ac\ud588\ub294\uc9c0 \uc54c\uc544\ubcf4\uace0, \uadf8\ub807\ub2e4\uba74 Samesite=Lax \uac00 \uc774 \ucde8\uc57d\uc810\uc73c\ub85c\ubd80\ud130 \uc548\uc804\ud574\uc9c0\ub294 \uc644\ubcbd\ud55c \ub300\uc548\uc778\uc9c0 \uace0\ubbfc\ud574\ubd05\uc2dc\ub2e4. https:\/\/blog.chromium.org\/2020\/04\/temporarily-rolling-back-samesite.htmlCOVID-19\ub54c\ubb38\uc5d0 \ud574\ub2f9 \uc870\uce58\uac00 rollback \ub418\uc5c8\uc2b5\ub2c8\ub2e4.\uc774\uac83\uc740 \ud604\uc7ac \ub9ac\uc5bc\uc6d4\ub4dc\uc5d0 \uc874\uc7ac\ud558\ub294 \uc704\ud611\uc774\uba70, \uc6f9\uc0ac\uc774\ud2b8\uc5d0\uc11c \ubcc4\ub3c4\ub85c Samesite=Lax \uc635\uc158\uc744 \uc8fc\uc9c0 \uc54a\uc558\uc744 \uacbd\uc6b0\uc5d0 \uc774 \ucde8\uc57d\uc810\uc774 \uc874\uc7ac\ud560 \ud655\ub960\uc774 \uadf9\ub3c4\ub85c \ub192\uc2b5\ub2c8\ub2e4. \ubcf8\ubb38 \ud68c\uc6d0\uac00\uc785\uc744 \ubc1b\uac70\ub098, OAuth\ub97c \uc0ac\uc6a9\ud574\uc11c \uc0ac\uc6a9\uc790\uc5d0\uac8c \uad8c\ud55c\uc744 \ubd80\uc5ec\ud558\ub294 \uc6f9\uc0ac\uc774\ud2b8\uac00 \ub9ce\uc2b5\ub2c8\ub2e4.\uadf8\ub9ac\uace0 \uac01 \uc0ac\uc6a9\uc790\ub294 \uc11c\ub85c \ub2e4\ub978 \uad8c\ud55c\uc744 \uac00\uc9c0\uace0 \uc788\uc73c\uba70, \uc774 \uad8c\ud55c\uc758 \uc885\ub958\ub294 \uc544\uc8fc \ub2e4\uc591\ud569\ub2c8\ub2e4.\uc608\ub97c \ub4e4\uc5b4 A \uc0ac\uc6a9\uc790\uc758 \ud68c\uc6d0\uc815\ubcf4 \uc218\uc815 \ud398\uc774\uc9c0\uc5d0 \uc811\uadfc\ud560 \uc218 \uc788\ub294 \ud68c\uc6d0\uc740 A \uc0ac\uc6a9\uc790\ubc16\uc5d0 \uc5c6\uc744 \uac83 \uc785\ub2c8\ub2e4.B \uadf8\ub8f9\uc758 \uac8c\uc2dc\ubb3c\uc744 \uc5f4\ub78c\ud560 \uc218 \uc788\ub294 \ud68c\uc6d0\uc740 B \uadf8\ub8f9\uc758 \uad6c\uc131\uc6d0\ub4e4\ubfd0\uc774\uaca0\uc8e0.\uc131\uc778 \ucee8\ud150\uce20\uc5d0 \uc811\uadfc\ud560 \uc218 \uc788\ub294 \ud68c\uc6d0\uc740 \ubbf8\uc131\ub144\uc790\uac00 \uc544\ub2cc, \uc131\uc778\uc778\uc99d\uc774 \ub41c \ud68c\uc6d0\ub4e4\uc77c \uac83 \uc785\ub2c8\ub2e4. \uadf8\ub7f0\ub370 \uad8c\ud55c\uc774 \uc874\uc7ac\ud560 \ub54c\uc640 \uc874\uc7ac\ud558\uc9c0 \uc54a\uc744 \ub54c \uc11c\ub85c \uc751\ub2f5(Response)\uc774 \ub2e4\ub974\ub2e4\uba74 \uc5b4\ub5a8\uae4c\uc694?\uc751\ub2f5\uc774 \ub2e4\ub974\ub2e4 \ub294 \uad11\ub300\ud55c \ud45c\ud604\uc785\ub2c8\ub2e4.\uc751\ub2f5 \uc2dc\uac04\uc774 \ub2e4\ub97c \uc218\ub3c4 \uc788\uace0, \uc751\ub2f5\uc758 \uc0c1\ud0dc \ucf54\ub4dc\uac00 \ub2e4\ub97c \uc218\ub3c4 \uc788\uc73c\uba70, \uc751\ub2f5\uc758 \uae38\uc774\uac00 \ub2e4\ub97c \uc218\ub3c4 \uc788\uc2b5\ub2c8\ub2e4. \uc5ec\uae30 \ucde8\uc57d\ud55c \uc6f9\uc0ac\uc774\ud2b8 victim.com\uc774 \uc788\uace0 \uadf8 \uc0ac\uc774\ud2b8\uc758 \ud68c\uc6d0\uc778 A\uc640 B\uac00 \uc788\uc2b5\ub2c8\ub2e4.A\uc758 \ud68c\uc6d0\uc815\ubcf4 \uc218\uc815 \ud398\uc774\uc9c0\uac00 victim.com\/member\/modify\/42 \ub77c\uace0 \uac00\uc815\ud569\uc2dc\ub2e4.A\ub294 \ud574\ub2f9 \ud398\uc774\uc9c0\uc5d0 \uc811\uadfc\ud560 \uad8c\ud55c\uc774 \uc788\uc2b5\ub2c8\ub2e4.B\ub294 \uadf8\ub807\uc9c0 \uc54a\uc8e0.\uc6b0\ub9ac\ub294 \uc774\ub7f0 \uacbd\uc6b0\uc5d0 \uc81c\ub300\ub85c \uc811\uadfc \ud1b5\uc81c\uac00 \ub418\uace0 \uc788\ub2e4\uace0 \ud45c\ud604\ud569\ub2c8\ub2e4.\ud558\uc9c0\ub9cc \ub450 \ud68c\uc6d0\uc774 \uacf5\uaca9\uc790\uc758 \uc6f9\uc0ac\uc774\ud2b8 attacker.com\uc5d0 \uc811\uc18d\ud588\uc744 \ub54c \uc0c1\ud669\uc774 \ub2ec\ub77c\uc9d1\ub2c8\ub2e4. attacker.com\uc5d0 \uc811\uc18d\ud558\uba74 client\ub294 \ubbf8\ub9ac \uc791\uc131\ub41c \uc2a4\ud06c\ub9bd\ud2b8\uc5d0 \uc758\ud574\uc11c img \ud0dc\uadf8\ub97c \ud1b5\ud574 victim.com\/member\/modify\/42 \uc8fc\uc18c\uc5d0 \uc811\uadfc\ud558\uac8c \ub429\ub2c8\ub2e4.\ud574\ub2f9 \ud398\uc774\uc9c0\uac00 \uc815\uc0c1\uc801\uc73c\ub85c load\ub418\uba74 onload \uc774\ubca4\ud2b8 \ud578\ub4e4\ub7ec\ub97c, load\uc5d0 \uc2e4\ud328\ud558\uba74 onerror \uc774\ubca4\ud2b8 \ud578\ub4e4\ub7ec\ub97c \uc2e4\ud589\ud558\uac8c \ub429\ub2c8\ub2e4.A\uc640 B\uac00 \ud574\ub2f9 \ud398\uc774\uc9c0\uc5d0 \uc811\uadfc\ud588\uc744 \ub54c A\ub294 onload \uc774\ubca4\ud2b8 \ud578\ub4e4\ub7ec\ub97c, B\ub294 onerror \uc774\ubca4\ud2b8 \ud578\ub4e4\ub7ec\ub97c \uc2e4\ud589\ud558\uac8c \ub418\uaca0\uad70\uc694.\uac01\uac01\uc5d0\ub294 \uc790\uc2e0\uc758 IP\uc8fc\uc18c, \ub9ac\ud37c\ub7ec, \uc720\uc800\uc5d0\uc774\uc804\ud2b8, \uc811\uc18d \uc2dc\uac04 \ub4f1\uc744 \ub85c\uac70\uc5d0 \uc804\ub2ec\ud558\ub294 \ucf54\ub4dc\uac00 \uc120\uc5b8\ub418\uc5b4 \uc788\uc2b5\ub2c8\ub2e4. \uc774\uc81c \uacf5\uaca9\uc790\ub294 \uc790\uc2e0\uc758 \uc6f9\uc0ac\uc774\ud2b8\uc5d0 \uc811\uc18d\ud55c \uc775\uba85\uc758 \uc0ac\uc6a9\uc790\uac00 victim.com\uc758 A\uc0ac\uc6a9\uc790\uc778\uc9c0 \uc5ec\ubd80\ub97c \uc2dd\ubcc4\ud560 \uc218 \uc788\uac8c \ub418\uc5c8\uc2b5\ub2c8\ub2e4. \ubcc4\ub85c \ud06c\ub9ac\ud2f0\uceec\ud558\uc9c0 \uc54a\ub2e4\uace0 \uc0dd\uac01\ud558\ub098\uc694?\uadf8\ub7fc \ub2e4\ub978 \uc608\uc2dc\ub97c \ub4e4\uc5b4\ubd05\uc2dc\ub2e4. SNS\ub97c \ube44\ub86f\ud55c \ub9ce\uc740 \uc6f9\uc11c\ube44\uc2a4\uc5d0\uc11c\ub294 \uc720\ub8cc \uad11\uace0 \uae30\ub2a5\uc744 \uc81c\uacf5\ud558\uace0 \uc788\uc73c\uba70, \uac1c\uc911\uc5d0\ub294 \ud2b9\uc815 \uc0ac\uc6a9\uc790\uad70\uc744 \uc9c0\ubaa9\ud574\uc11c \uad11\uace0\ub97c \ud560 \uc218 \uc788\ub294 \uae30\ub2a5\uc744 \uc81c\uacf5\ud558\uae30\ub3c4 \ud569\ub2c8\ub2e4.20\ub300, \ub0a8\uc131, \uc11c\uc6b8\uac70\uc8fc, \uad00\uc2ec\uc0ac\ub294 \uc2a4\ud3ec\uce20 \ub4f1\uc73c\ub85c \ud0c0\uac9f\ud305\uc774 \uac00\ub2a5\ud558\uc8e0. \uacf5\uaca9\uc790\ub294 \uad11\uace0\ub97c \ud558\ub098 \ub0c5\ub2c8\ub2e4.20\ub300\uac00 \ubcfc \uc218 \uc788\ub294 \uad11\uace0\ub97c\uc694.30\ub300, 40\ub300\uac00 \ubcfc \uc218 \uc788\ub294 \uad11\uace0\ub3c4 \ud558\ub098\uc529 \ub0b4\uba74 \uc88b\uaca0\ub124\uc694.\ub9c8\ucc2c\uac00\uc9c0\ub85c \uac01\uac01\uc758 \uac8c\uc2dc\ubb3c\uc5d0 \uc811\uadfc\ud588\uc744 \ub54c \uc751\ub2f5\uc774 \ubcc0\ud588\ub294\uc9c0\ub97c \ud655\uc778\ud574\ubd05\ub2c8\ub2e4.\uc774\ubc88\uc5d0\ub294 \uc790\uc2e0\uc758 \uc6f9\uc0ac\uc774\ud2b8\uc5d0 \uc811\uc18d\ud55c(\uc989 IP\uc8fc\uc18c\ub97c \uc54c \uc218 \uc788\ub294) \uc775\uba85\uc758 \uc0ac\uc6a9\uc790\uc758 \ub098\uc774\ub97c, \uc131\ubcc4\uc744, \uc0ac\ub294 \uc9c0\uc5ed\uc744, \uad00\uc2ec\uc0ac\ub97c \uc54c\uc544\ub0bc \uc218 \uc788\uac8c \ub418\uc5c8\uc2b5\ub2c8\ub2e4. \ud55c \uac1c\uc758 \uacf5\uaca9\uae30\ubc95\ucc98\ub7fc \uc124\uba85\ud588\uc9c0\ub9cc, \uc0ac\uc2e4 \uacf5\uaca9\ud558\ub294 \ubc29\ubc95\uc774 \ubb34\uc218\ud788 \ub9ce\uc2b5\ub2c8\ub2e4. \uba3c\uc800 \uc2dc\uac04 \uae30\ubc18\uc785\ub2c8\ub2e4.\uac00\uc7a5 \uc27d\uac8c \ub5a0\uc62c\ub9b4 \uc218 \uc788\ub294 \ubc29\ubc95\uc740 victim.com\/member\/modify\/42 \uc5d0 \uc811\uadfc\ud588\uc744 \ub54c \uc751\ub2f5\uc5d0 \uac78\ub9ac\ub294 \uc2dc\uac04\uc744 \uc7ac\ub294 \ubc29\ubc95\uc785\ub2c8\ub2e4.\uc218\uc815 \ud398\uc774\uc9c0\uc640 404 \uc5d0\ub7ec \ud398\uc774\uc9c0\ub294 response\uc758 \uae38\uc774\uac00 \ub2e4\ub97c \uac83\uc774\uba70, \ub2f9\uc5f0\ud788 \uc751\ub2f5 \uc2dc\uac04\ub3c4 \ub2ec\ub77c\uc9c8 \uac83 \uc785\ub2c8\ub2e4.\ud558\uc9c0\ub9cc \uadf8\ub798\ubd24\uc790 \uc218kb\uc77c \ud14c\uace0, \uc774\uac74 \uc880 \uad6c\ub824 \ubcf4\uc774\uc8e0.\uc870\uae08 \ub2e4\ub974\uac8c \uac00\ubd05\uc2dc\ub2e4.\uacf5\uaca9\uc790\ub294 victim.com \uc5d0\uc11c \uac8c\uc2dc\ubb3c\uc744 \uc791\uc131\ud569\ub2c8\ub2e4.\uadf8 \uac8c\uc2dc\ubb3c\uc744 \uc77d\uc744 \uc218 \uc788\ub294 \uc0ac\ub78c\uc740 A\uc0ac\uc6a9\uc790 \ud55c \uba85\uc73c\ub85c \uc124\uc815\ud569\ub2c8\ub2e4.\uac8c\uc2dc\ubb3c\uc758 \ub0b4\uc6a9\uc740 \uc544\uc8fc\uc544\uc8fc \uae41\ub2c8\ub2e4. \uc218mb\ub2e8\uc704\ub85c\uc694.\uc774\ubc88\uc5d0\ub294 \uc751\ub2f5\uc2dc\uac04\uc774 \uc720\uc758\ubbf8\ud558\uac8c \ucc28\uc774\uac00 \ub0a0 \uac83\uc785\ub2c8\ub2e4. \ud639\uc740 \uc751\ub2f5\ucf54\ub4dc\ub97c \uc0ac\uc6a9\ud560 \uc218\ub3c4 \uc788\uc2b5\ub2c8\ub2e4.\uc704\uc758 \uc608\uc2dc\uc5d0\uc11c \ub2e4\ub8e8\uc5c8\uc9c0\ub9cc img \ud0dc\uadf8\uc758 \uacbd\uc6b0\uc5d0 \uc751\ub2f5\ucf54\ub4dc\uac00 404\uba74 onerror \uc774\ubca4\ud2b8 \ud578\ub4e4\ub7ec\uac00, 200\uc774\uba74 onload \uc774\ubca4\ud2b8 \ud578\ub4e4\ub7ec\uac00 \ud2b8\ub9ac\uac70\ub429\ub2c8\ub2e4.\uad8c\ud55c\uc774 \uc5c6\uc744 \uacbd\uc6b0\uc5d0 404 \ucf54\ub4dc\ub97c \uc751\ub2f5\ud558\ub294 \uc11c\ube44\uc2a4\uc5d0\uc11c\ub294 \uacf5\uaca9\uc774 \uc544\uc8fc \uc26c\uc6cc\uc9c0\uaca0\uc8e0. \uc7ac\ubbf8\uc788\ub294 \uacf5\uaca9\ubc29\ubc95\uc744 \ud55c \uac00\uc9c0 \ub354 \uc18c\uac1c\ud558\uba74, anchor\ub77c\ub294 \uae30\ub2a5\uc774 \uc788\uc2b5\ub2c8\ub2e4.#foo \uc5d0 \uc811\uc18d\ud588\uc744 \ub54c id\uac00 foo\uc778 \uac1d\uccb4\uc5d0 focus\uac00 \ub418\uc8e0.\uad8c\ud55c\uc774 \uc788\uc744\ub54c\ub9cc load\ub418\ub294 \uac1d\uccb4\uac00 \uc874\uc7ac\ud560 \uacbd\uc6b0\uc5d0 iframe\uc73c\ub85c \ud574\ub2f9 \ud398\uc774\uc9c0\ub97c \ubd88\ub7ec\uc62c \ub54c \ud574\ub2f9 id\uc758 anchor\ub97c \ucd94\uac00\ud558\uba74,focus\uac00 \ubc14\ub00c\uba70 onblur \uc774\ubca4\ud2b8 \ud578\ub4e4\ub7ec\uac00 \ud2b8\ub9ac\uac70\ub429\ub2c8\ub2e4.<iframe src=”victim.com\/member\/modify\/42#username“><\/iframe> \uac19\uc740 \ubc29\uc2dd\uc774\uc8e0. \uadf8 \uc678\uc5d0\ub3c4 \ub9ce\uc740 \uacf5\uaca9 \ubc29\ubc95\uc774 \uc874\uc7ac\ud558\uba70, \uc6f9 \uc11c\ube44\uc2a4\uc758 \uad6c\uc870\uc5d0 \ub530\ub77c\uc11c \ub9de\ucda4\ud615\uc73c\ub85c \uc0c8\ub85c\uc6b4 \uacf5\uaca9 \ubc29\ubc95\uc774 \ub098\uc62c \uc218 \uc788\uc2b5\ub2c8\ub2e4. Chrome 80 Samesite=Lax \ub85c \uae30\ubcf8\uac12\uc774 \ubcc0\uacbd\ub418\uba70 \uc774\ub7ec\ud55c \ubc29\uc2dd\uc758 \uacf5\uaca9\uc740 \ub300\ubd80\ubd84 \ub9c9\ud78c \uac83\uc73c\ub85c \ubcf4\uc785\ub2c8\ub2e4.\ud558\uc9c0\ub9cc \ud06c\ub86c\uc5d0\uc11c\ub294 \uc131\ub2a5 \uc800\ud558\ub97c \uc774\uc720\ub85c \ud328\uce58\ub418\uc9c0 \uc54a\uc740 known-issue\uac00 \uc874\uc7ac\ud558\uba70, \uc774\ub294 Samesite=Lax\ub97c \uc6b0\ud68c\ud558\ub294 \uc5f4\uc1e0\uac00 \ub420 \uc218 \uc788\ub2e4\uace0 \ubcf4\uace0 \uc9c0\uc18d\ud574\uc11c \uc5f0\uad6c\ub97c \uc9c4\ud589 \uc911\uc785\ub2c8\ub2e4. \ub9c8\ubb34\ub9ac Privacy\uac00 \uc810\uc810 \uc911\uc694\ud55c \ud654\ub450\uac00 \ub418\uba70 \uc0ac\uc6a9\uc790\uc758 \uc544\uc774\ub514 \ud328\uc2a4\uc6cc\ub4dc \ub4f1 \uc9c1\uc811\uc801\uc778 \uac1c\uc778\uc815\ubcf4\ub97c \ub118\uc5b4 \uc5ec\ub7ec \uc815\ubcf4\ub97c \uacb0\ud569\ud574\uc11c \uc0ac\uc6a9\uc790\ub97c \uc2dd\ubcc4\ud560 \uc218 \uc788\ub294 \uacbd\uc6b0 \ud639\uc740 \ub2e4\ub978 \uc0ac\uc6a9\uc790\uc640 \uad6c\ubcc4\ub418\uc5b4 \ud2b9\uc815\uc778\uc744 \ucc3e\uc744 \uc218 \uc788\ub294 \uacbd\uc6b0 \ub610\ud55c \uac1c\uc778\uc815\ubcf4\ub85c \ucde8\uae09\ub418\uba70, \ubcf4\ud638\uc758 \ub300\uc0c1\uc774 \ub429\ub2c8\ub2e4.\uae30\uc874\uc758 \uacf5\uaca9\ubc29\uc2dd\ub4e4\uacfc \ubc29\ud5a5\uc774 \ub2ec\ub77c \uc0dd\uc18c\ud558\uc9c0\ub9cc, privacy \uad00\uc810\uc5d0\uc11c \uc911\uc694\ud55c \uc774\uc288\uac00 \ub420 \uc218 \uc788\uc73c\ub2c8 \ub9ce\uc740 \uc5f0\uad6c\uc790\ub4e4\uc758 \uad00\uc2ec\uc774 \ud544\uc694\ud55c \ubd84\uc57c\uc785\ub2c8\ub2e4.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[4],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/posts\/407"}],"collection":[{"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/comments?post=407"}],"version-history":[{"count":21,"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/posts\/407\/revisions"}],"predecessor-version":[{"id":428,"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/posts\/407\/revisions\/428"}],"wp:attachment":[{"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/media?parent=407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/categories?post=407"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/tags?post=407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}