FileMaker Server 16とHSTS

FileMaker Server 16ͱHSTS 2017/06/17 FM-TokyoϥΠτχϯάτʔΫൃදࢿྉ দඌಞʢ‫ࣜג‬ձࣾΤϛοΫʣ

FileMaker Server 16

FileMaker Server 16 • 2017೥5݄ʹϦϦʔε • SSL/TLSؔ࿈ͷվળ͕‫·ؚ‬ΕΔ • ͦͷ͏ͪͷ1͕ͭHSTS

FileMaker Server 16ͱHSTS • Admin Consoleʢʦσʔλϕʔεαʔ όʔʧʼʦηΩϡϦςΟʧʣͰʦWeb ΫϥΠΞϯτʹ HSTS Λ࢖༻͢Δʧ νΣοΫϘοΫε͕৽ઃ

HSTS • HTTP Strict Transport Securityͷུ • Webαʔόʔ͕Webϒϥ΢βʔʹରͯ͠ ࣍ճҎ߱HTTPͰ͸ͳ͘HTTPSͰ௨৴͢ ΔΑ͏ʹ఻ୡ • ৗ࣌SSLԽͷࡍʹ௨ৗWebαʔόʔଆͰ ઃఆ͢Δ߲໨ͷ1ͭ

SSLLabs SSL Server Test HSTSద༻લͷείΞ HSTSద༻‫ޙ‬ͷείΞ ʢHSTSͷಋೖͰείΞ͕Aͩͬͨ৔߹ʹ͸A+ʹʗ2017೥6݄17೔࣌఺ʣ

HTTPϔομʔͷྫ • Strict-Transport-Security: max- age=31536000; includeSubDomains • ্‫Ͱྫه‬HSTS͕ద༻͞ΕΔ༗ޮ‫ؒظ‬ ͸31,536,000ඵʢ365೔ʣ

HSTSΩϟογϡͷ࡟আ • ௨ৗWebαʔόʔଆͰmax-ageͷ஋Λ0ʹ ͢Ε͹ΩϟογϡΛແޮԽͰ͖Δ • Strict-Transport-Security: max-age=0; • ͨͩ͠ɺHTTPSͰ͸ͳ͘HTTPͷ৔߹ ʹ͸Webϒϥ΢βʔ͸Strict-TransportSecurityϨεϙϯεϔομʔΛແࢹ

HSTSΩϟογϡͷ࡟আ • Chromeͷ৔߹͸ΞυϨεόʔʹ ʮchrome://net-internals/#hstsʯͱೖྗ • Delete DomainͷจࣈೖྗཝʹυϝΠ ϯ໊Λೖྗͯ͠ʦDeleteʧϘλϯΛΫ ϦοΫ

ؔ࿈৘ใ • Preloaded HSTSʢHSTS Preloadʣ • HSTSͰ͸ॳճ͸HTTPS௨৴͕‫੍͞ڧ‬ Εͳ͍ • Webϒϥ΢βʔຊମʹHSTSͰ઀ଓ͢ ΔυϝΠϯͷϦετΛ࣋ͨͤΔํ๏΋ ͋Δ

·ͱΊ • FileMaker Server 16Ͱ͸SSLΛ༗ޮʹ͢ Δͱ௨ৗHSTS΋Ұॹʹ༗ޮԽ͞ΕΔ ʢΦϓγϣϯʣ • SSLΛಋೖ͢Δࡍʹ͸ೝূ‫͔ہ‬Βߪೖ ͨ͠ূ໌ॻ͕ඞཁ