I-Chrome iya kuzisa ukhuseleko ekuhanjisweni kweekuki zomntu wesithathu kunye nokuchonga okufihliweyo

uphando thaca utshintsho oluzayo lwabucala kwiChrome. Inxalenye yokuqala yeenguqu ixhalabele ukuphatha i-Cookie kunye nenkxaso ye-SameSite uphawu. Ukuqala ngokukhululwa kweChrome 76, ekulindeleke ngoJulayi, kuya kubakho yenziwe yasebenza "isayithi efanayo-nge-default-cookies" iflegi, ethi, xa ingekho uphawu lweSameSite kwiSet-Cookie header, iya kuhlala kwixabiso "SameSite=Lax", ithintela ukuthunyelwa kweeKuki ezifakwe kwisithathu. -iindawo zeqela (kodwa iisayithi ziseza kukwazi ukususa uthintelo ngokumisela ngokucacileyo i-Cookie kwi-SameSite=None).

Nikela I-SameSite ikuvumela ukuba uchaze iimeko apho kwamkelekile ukuthumela icookie xa isicelo sifunyenwe kwindawo yomntu wesithathu. Okwangoku, i-browser ithumela i-cookie nakwesiphi na isicelo kwisayithi ene-cookie iseti, nokuba enye isayithi ivuliwe ekuqaleni, kwaye isicelo senziwa ngokungathanga ngqo ngokulayisha umfanekiso okanye nge-iframe. Uthungelwano lwentengiso lusebenzisa olu phawu ukulandelela iintshukumo zabasebenzisi phakathi kweesayithi, kunye
abahlaseli umbutho Uhlaselo lweCSRF (xa isixhobo esilawulwa ngumhlaseli sivulwa, isicelo siyafihlwa kumaphepha aso ukuya kwesinye isayithi apho umsebenzisi wangoku angqinisiswe, kwaye isikhangeli somsebenzisi siseta iseshoni yeekuki kwisicelo esinjalo). Ngakolunye uhlangothi, ukukwazi ukuthumela ikhukhi kwiindawo zangaphandle zisetyenziselwa ukufaka amawijethi kumaphepha, umzekelo, ukudibanisa neYuoTube okanye i-Facebook.

Ngophawu lweSameSit, unokulawula indlela yokwenza icookie kwaye uvumele iikuki ukuba zithunyelwe ngokuphendula izicelo ezisuka kwindawo ebifumene icookie ekuqaleni. ISameSite inokuthatha amaxabiso amathathu "Strict", "Lax", kunye "None". Kwimo 'engqongqo', iikuki azithunyelwa kulo naluphi na uhlobo lwesicelo sesayithi, kuquka onke amakhonkco angenayo asuka kwisayithi yangaphandle. Kwimo ye-'Lax', izithintelo eziyekelelwe ngakumbi ziyasebenza kwaye ukuhanjiswa kweekuki kuvaliwe kuphela kwii-sub-site subrequests, ezifana nokucela umfanekiso okanye ukukhuphela umxholo nge-iframe. Umahluko phakathi kwe "Strict" kunye ne "Lax" yehla ekuvaleni iiKuki xa ucofa ikhonkco.

Phakathi kolunye utshintsho oluzayo, kukwacwangcisiwe ukusebenzisa isithintelo esinzima esithintela ukusetyenzwa kweeKuki zomntu wesithathu kwizicelo ezingezizo eze-HTTPS (kunye neSameSite=Akukho phawu, iiCookies zinokusetwa kuphela kwimo eKhuselekileyo). Ukongezelela, umsebenzi ucetywayo ukukhusela ekusebenziseni ukuchongwa okufihliweyo ("i-browser fingerprinting"), kubandakanywa neendlela zokuvelisa iimpawu ezisekelwe kwidatha engathanga ngqo, njenge. isisombululo sesikrini, uluhlu lweentlobo ezixhaswayo ze-MIME, iinketho ezikhankanyiweyo zeheader (HTTP / 2 ΠΈ HTTPS), uhlalutyo olusekiweyo iiplagi kunye neefonti, ukufumaneka kweWeb APIs ezithile kumakhadi evidiyo Iimbonakalo Ukubonelela ngeWebGL kunye neCanvas, ukukhohlisa ngeCSS, uhlalutyo lweempawu zokusebenza kunye impuku ΠΈ ikhibhodi.

Kwakhona kwiChrome ziya kongezwa ukukhuselwa kuxhatshazo olunxulunyaniswa nobunzima bokubuyela kwiphepha lokuqala emva kokutshintshela kwesinye isiza. Sithetha malunga nesenzo sokulahla imbali yokukhangela ngothotho lohlengahlengiso oluzenzekelayo okanye ngokufakela ukongeza amangeno angeyonyani kwimbali yokukhangela (nge-pushState), ngenxa yoko umsebenzisi akanakukwazi ukusebenzisa iqhosha elithi "Buyela" ukubuyela kwimvelaphi. iphepha emva kotshintsho ngempazamo okanye ukuthunyelwa ngenkani kwindawo yabaqhatha okanye izinambuzane . Ukukhusela kwezo zenziso, iChrome kwisiphathi seqhosha lokuNgena iya kutsiba amangeno anxulumene nogqithiso oluzenzekelayo kunye noqhaqho lwembali yondwendwelo, ishiya kuphela amaphepha avula ngezenzo zomsebenzisi ezicacileyo.

umthombo: opennet.ru

Yongeza izimvo