TripletaiL Japanese Web Application Framework
セッションを利用しCSRFを防いでみましょう。
以下を前提条件とします。
test
user
pass
#!/usr/local/bin/perl
use strict;
use warnings;
use Tripletail qw(tl.ini);
$TL->startCgi(
-Session => 'Session',
-DB => 'DB',
-main => \&main,
);
sub main
{
$TL->dispatch($CGI->get('Command'), default => 'Top');
}
sub DoTop
{
&DispTop;
}
sub DoWrite
{
my $form = $CGI->clone;
$TL->location($form->set(Command => 'WriteAfter')->toLink);
}
sub DoWriteAfter
{
&DispWriteAfter;
}
sub DispWriteAfter
{
my $t = $TL->newTemplate('write_after.html', 'utf8');
if (defined($CGI->haveSessionCheck('Session'))) {
$t->expand(
TEXT => $CGI->get('text'),
);
} else {
$t->expand(
TEXT => '正常な書き込みではありません',
);
}
$t->flush;
}
sub DispTop
{
my $t = $TL->newTemplate('write.html', 'utf8');
#仮にアクセスしてきた人をuseridを100としてしまう
my $userid = 100;
$TL->getSession->setValue($userid);
$t->addSessionCheck('Session');
$t->addHiddenForm($TL->newForm->set(Command => 'Write'));
$t->flush;
}
[TL]
[DB]
type = mysql
defaultset = SET_Default
SET_Default = CON_DBRW
[CON_DBRW]
host = localhost
user = user
dbname = test
password = pass
[Session]
mode = http
dbgroup = DB
dbset = SET_Default
sessiontable = TripletaiL_Session
csrfkey = TripletaiL_Key
<!DOCTYPE html>
<HTML>
<BODY>
<form method="post">
書き込み<input type="text" name="text">
<br>
<input type="submit" name="submit" value="書き込む">
</form>
</BODY>
</HTML>
<!DOCTYPE html>
<HTML>
<BODY>
<&TEXT>
</BODY>
</HTML>