Chrome ibweretsa chitetezo ku kufalitsa ma cookie a chipani chachitatu ndi zizindikiritso zobisika

Google представила zosintha zachinsinsi zomwe zikubwera mu Chrome. Gawo loyamba la zosinthazo likukhudzana ndi kasamalidwe ka Cookie ndikuthandizira mawonekedwe a SameSite. Kuyambira ndi kutulutsidwa kwa Chrome 76, yomwe ikuyembekezeka mu Julayi, padzakhala adamulowetsa mbendera ya "same-site-by-default-cookies", yomwe, pakalibe mawonekedwe a SameSite pamutu wa Set-Cookie, idzasintha kukhala "SameSite=Lax", kuletsa kutumiza ma Cookies kuti alowe kuchokera kuchitatu. -masamba aphwando (koma masamba azithabe kuchotsa zoletsazo pokhazikitsa Cookie ku SameSite=Palibe).

Chitani Chimodzimodzi amakulolani kufotokozera zochitika zomwe ndizovomerezeka kutumiza cookie pamene pempho lalandiridwa kuchokera kutsamba lachitatu. Pakadali pano, msakatuli amatumiza cookie ku pempho lililonse kutsamba lomwe lili ndi ma cookie, ngakhale tsamba lina litatsegulidwa koyambirira, ndipo pempholo limapangidwa mwanjira ina ndikutsitsa chithunzi kapena kudzera pa iframe. Manetiweki otsatsa amagwiritsa ntchito izi kutsata kayendedwe ka ogwiritsa ntchito pakati pamasamba, ndi
owukira bungwe Kuukira kwa CSRF (pamene chida choyendetsedwa ndi wowukira chitsegulidwa, pempho limabisidwa patsamba lake kupita patsamba lina pomwe wogwiritsa ntchito pano amatsimikiziridwa, ndipo msakatuli wa wogwiritsayo amakhazikitsa ma cookie agawo pazopempha zotere). Kumbali ina, kuthekera kotumiza ma cookie kumasamba a chipani chachitatu kumagwiritsidwa ntchito kuyika ma widget m'masamba, mwachitsanzo, kuphatikiza ndi YuoTube kapena Facebook.

Ndi mawonekedwe a SameSit, mutha kuwongolera machitidwe a ma cookie ndikungolola ma cookie kuti atumizidwe motsatira zopempha zochokera patsamba lomwe lidalandira cookie poyambirira. SameSite imatha kutenga zinthu zitatu "Zolimba", "Lax", ndi "Palibe". Mumodeti 'yokhwima', ma cookie samatumizidwa pamtundu uliwonse wa pempho la masamba, kuphatikiza maulalo onse obwera kuchokera kumasamba akunja. Mumodeti ya 'Lax', ziletso zomasuka zimagwira ntchito ndipo kutumizira ma cookie kumangoletsedwa pamagawo ang'onoang'ono, monga kupempha chithunzi kapena kutsitsa zomwe zili kudzera pa iframe. Kusiyana pakati pa "Strict" ndi "Lax" kumatsikira pakuletsa ma Cookies mukadina ulalo.

Pakati pa zosintha zina zomwe zikubwera, ikukonzekeranso kuyika chiletso cholimba chomwe chimaletsa kukonza ma Cookies a chipani chachitatu pazofunsira zomwe si za HTTPS (ndi SameSite=Palibe mawonekedwe, Ma cookie amatha kukhazikitsidwa munjira Yotetezedwa). Kuphatikiza apo, ntchito ikukonzekera kuti iteteze ku kugwiritsidwa ntchito kwa zizindikiritso zobisika ("zolemba zala msakatuli"), kuphatikiza njira zopangira zizindikiritso zochokera kuzinthu zina, monga. chophimba chophimba, mndandanda wamitundu yothandizidwa ya MIME, zosankha zamutu zamutu (HTTP / 2 и HTTPS), kusanthula kwakhazikitsidwa mapulagini ndi mafonti, kupezeka kwa ma API ena a Webusaiti okhudzana ndi makadi amakanema Mawonekedwe kupereka ndi WebGL ndi Canvas, kusokoneza ndi CSS, kusanthula kwa magwiridwe antchito ndi mbewa и kiyibodi.

Komanso mu Chrome zidzawonjezedwa chitetezo ku nkhanza zomwe zimagwirizanitsidwa ndi vuto lobwerera patsamba loyambirira mutasinthira patsamba lina. Tikukamba za chizolowezi chowononga mbiri yoyenda ndi njira zingapo zolozeranso zokha kapena kuwonjezera zolemba zabodza m'mbiri yosakatula (kudzera pa pushState), chifukwa chake wosuta sangathe kugwiritsa ntchito batani la "Back" kubwerera ku choyambirira. tsamba pambuyo pa kusintha mwangozi kapena kukakamizidwa kutumiza kumalo a scammers kapena tizilombo. Kuti muteteze ku zolakwika zotere, Chrome mu batani lakumbuyo idzalumpha zolemba zokhudzana ndi kutumiza ndi kusokoneza mbiri ya maulendo, kusiya masamba okha omwe amatsegulidwa ndi zochita za ogwiritsa ntchito.

Source: opennet.ru