I-Chrome manje isizoba nesivikelo kumakhukhi wenkampani yangaphandle kanye nokuhlonza okufihliwe

Google kwethulwe izinguquko ezizayo ku-Chrome ezihloselwe ukuthuthukisa ubumfihlo. Ingxenye yokuqala yezinguquko iphathelene nokuphathwa kwe-Cookie nokusekelwa kwesibaluli se-SameSite. Kusukela ngokukhishwa kwe-Chrome 76, okulindeleke ngoJulayi, kuzoba khona yenziwe yasebenza ifulegi elithi “same-site-by-default-cookies”, okuthi, uma ingekho isibaluli se-SameSite kusihloko se-Set-Cookie, ngokuzenzakalelayo izosetha inani elithi “SameSite=Lax”, ikhawulele ukuthunyelwa kwamakhukhi ukuze afakwe amasayithi ezinkampani zangaphandle (kodwa amasayithi asazokwazi ukukhansela umkhawulo ngokubeka ngokusobala inani SameSite=None lapho usetha Ikhukhi).

Isibaluli Okufanayo ikuvumela ukuthi uchaze izimo lapho kuvunyelwe khona ukuthumela i-Cookie uma isicelo sitholwa esizeni esivela eceleni. Okwamanje, isiphequluli sithumela i-Cookie kunoma yisiphi isicelo kusayithi lapho i-Cookie isethelwe khona, ngisho noma enye isayithi ivuliwe ekuqaleni, futhi isicelo senziwa ngokungaqondile ngokulayisha isithombe noma nge-iframe. Amanethiwekhi okukhangisa asebenzisa lesi sici ukulandelela ukunyakaza komsebenzisi phakathi kwamasayithi, kanye
abahlaseli benhlangano Ukuhlaselwa kwe-CSRF (uma insiza elawulwa umhlaseli ivulwa, isicelo sithunyelwa ngokuyimfihlo sisuka emakhasini ayo siye kwenye isayithi lapho umsebenzisi wamanje egunyazwe khona, futhi isiphequluli somsebenzisi sisetha iseshini Amakhukhi ngesicelo esinjalo). Ngakolunye uhlangothi, ikhono lokuthumela amakhukhi kumasayithi ezinkampani zangaphandle lisetshenziselwa ukufaka amawijethi emakhasini, isibonelo, ukuhlanganiswa ne-YuoTube noma i-Facebook.

Usebenzisa isibaluli se-SameSit, ungakwazi ukulawula ukuziphatha kwe-Cookie futhi uvumele Amakhukhi ukuthi athunyelwe kuphela ngempendulo yezicelo eziqalwe kusayithi lapho i-Cookie yamukelwa khona ekuqaleni. I-SameSite ingathatha amanani amathathu "Strict", "Lax" kanye "None". Ngemodi 'Eqinile', Amakhukhi awathunyelwa kunoma yiluphi uhlobo lwezicelo zesizindalwazi, okuhlanganisa zonke izixhumanisi ezingenayo ezivela kumasayithi angaphandle. Kumodi ye-'Lax', imikhawulo ekhululeke kakhudlwana isetshenziswa futhi ukudluliswa kwe-Cookie kuvinjiwe kuphela ezicelweni ezingaphansi zamasayithi ahlukene, njengesicelo sesithombe noma ukulayisha okuqukethwe nge-iframe. Umehluko phakathi kokuthi “Strict” kanye “Ne-Lax” wehlela ekuvimbeni Amakhukhi lapho ulandela isixhumanisi.

Phakathi kwezinye izinguquko ezizayo, kuphinde kuhlelwe ukuthi kusetshenziswe umkhawulo oqinile ovimbela ukucutshungulwa Kwamakhukhi ezinkampani zangaphandle ngezicelo ngaphandle kwe-HTTPS (ngesibaluli se-SameSite=None, Amakhukhi angasethwa kuphela kumodi Evikelekile). Ngaphezu kwalokho, kuhlelwe ukwenza umsebenzi wokuvikela ekusetshenzisweni kokuhlonza okufihliwe (“izigxivizo zeminwe zesiphequluli”), okuhlanganisa nezindlela zokukhiqiza izihlonzi ezisekelwe kudatha engaqondile, njengokuthi ukulungiswa kwesikrini, uhlu lwezinhlobo ezisekelwayo ze-MIME, imingcele ethile kumaheda (I-HTTP / 2 и I-HTTPS), ukuhlaziya okufakiwe ama-plugins namafonti, ukutholakala kwama-Web API athile, aqondene namakhadi evidiyo izici ukuhlinzeka kusetshenziswa i-WebGL neCanvas, ukukhwabanisa nge-CSS, ukuhlaziya izici zokusebenza nazo igundane и ikhibhodi.

Futhi ku-Chrome zizongezwa ukuvikelwa ekuhlukunyezweni okuhlobene nobunzima bokubuyela ekhasini lokuqala ngemva kokuthuthela kwenye isayithi. Sikhuluma ngomkhuba wokuhlanganisa umlando wokuzulazula ngochungechunge lokuqondisa kabusha okuzenzakalelayo noma ngokufaka ngokuzenzisa okufakiwe okungelona iqiniso emlandweni wokuphequlula (nge-pushState), ngenxa yalokho umsebenzisi angakwazi ukusebenzisa inkinobho ethi “Back” ukuze abuyele ku- ikhasi langempela ngemuva kwenguquko ngephutha noma ukudlulisela phambili ngempoqo kusayithi labakhwabanisi noma ababhubhisi . Ukuze uvikele ekunukubezeni okunjalo, i-Chrome kusibambi senkinobho Yasemuva izokweqa amarekhodi ahlotshaniswa nokudlulisela phambili okuzenzakalelayo kanye nokukhohliswa komlando wokuphequlula, ishiye kuphela amakhasi avuliwe ngenxa yezenzo zomsebenzisi ezisobala.

Source: opennet.ru