{ "schemaVersion": "1.0.0", "kind": "editorial-inspection-pack", "provenance": "editorial-guidance", "guideId": "authorization-and-cache", "updatedAt": "2026-11-12", "catalogVersion": "0.11.0", "sourceRepository": "https://github.com/sakimyto/security-knowledge", "sourceLicense": "MIT", "catalogHash": "e99906d58134e7e0d33d994548277ae7814000d92c088aa5894c49b62ae60cca", "catalogReviewedAt": "2026-11-09", "execution": "read-only-by-default", "selectedRuleIds": ["SEC-014", "SEC-016"], "deferredRuleIds": [ "SEC-001", "SEC-002", "SEC-003", "SEC-004", "SEC-005", "SEC-006", "SEC-007", "SEC-008", "SEC-009", "SEC-010", "SEC-011", "SEC-012", "SEC-013", "SEC-015" ], "outsideSelectionStatus": "unverified", "resultStatuses": ["finding", "no-finding", "not-applicable", "unverified"], "reportSchemaUrl": "https://sakimyto.com/security-data/report.schema.json", "reportExampleUrl": "https://sakimyto.com/security-data/report.example.json", "catalogDiscoveryUrl": "https://sakimyto.com/security-data/discovery.json", "distributionIndexUrl": "https://sakimyto.com/security-learning-data/index.json", "requiredRuleIndex": [ { "id": "SEC-001", "hash": "efec3489e1663249a2aff75cdb7c25e82d9765acb2bdcfa31e8ee934f12ef626" }, { "id": "SEC-002", "hash": "1398f1a8c28e4441472ef3a0952fde97c4ff19b5010178989f4ddd05b6a193dd" }, { "id": "SEC-003", "hash": "00aa6c368be21452c79e662728102938d7d3896073e53de74ea5fc913250b808" }, { "id": "SEC-004", "hash": "4c8742376f6fe13cb33908f282d1a6af6fd73ae0a13007f8013ca7042fd629b4" }, { "id": "SEC-005", "hash": "695e2e119a1364887732e6ee90c1250d22063f1e6e0ec71746e80b7231ace15f" }, { "id": "SEC-006", "hash": "a3cc524b847c5ec9223ea64ed01920283062fe3fcd0eaf2595bde44f951eed71" }, { "id": "SEC-007", "hash": "154186523c183ea0ec0059b951eb9b35f0ac41557c28df13c071663be3aef6ee" }, { "id": "SEC-008", "hash": "ab2bd7e87128a2ce571578558337ab8577fcda20f841171dba5b45d732ad2f03" }, { "id": "SEC-009", "hash": "8b9d4f314306ca656f73c115c195d84dd803e8a58a53355ed03516b330b26cb2" }, { "id": "SEC-010", "hash": "66b39f4eb8a0f334e98e9388e3f9dab27415e726c0862f0b6a4a4dd10e5e81df" }, { "id": "SEC-011", "hash": "3ae198ddd5fa82a53bcbca648d3a9070b03e3cd5665387e69e50c6bb6d365cb3" }, { "id": "SEC-012", "hash": "2da99baf28980f61385469445d6c000edb5434471a4a3500f1775ca78467824a" }, { "id": "SEC-013", "hash": "630183526a6d030807db345f6214176c12ca911fb261bde3abebc1c355a21d98" }, { "id": "SEC-014", "hash": "d9142da38fbe305f72d506a6d6c3c97f658fa446587dc9b27657622c880c1163" }, { "id": "SEC-015", "hash": "1dfd83077658a79d47897d199f646eb9f69aa4d92c7646c57f2b82a715fde44c" }, { "id": "SEC-016", "hash": "cce435bbacb6fef88c9e9d661222b081d8463e4f025448a7796cdcddd7548488" } ], "boundary": { "ja": "選択した2ルールだけを、許可された対象で読み取り点検します。残る14ルールは実行せず、既存の結果形式へunverifiedと範囲外の理由を残します。資料を読むだけで合格にせず、秘密の実値・変更・外部送信の権限は増やしません。", "en": "Inspect only the two selected rules in authorized scope, read-only. Leave the other fourteen unperformed and report them as unverified with an out-of-scope reason under the existing contract. Reading guidance is not a pass and grants no authority to expose secrets, modify systems, or send data." }, "guide": { "id": "authorization-and-cache", "title": { "ja": "別の利用者へ、情報が渡らないかを見る", "en": "Keep user and organization data separated" }, "lead": { "ja": "取得時の認可と、作った応答を再利用する境界をつなげて読みます。", "en": "Connect resource authorization with the boundaries controlling reuse of generated responses." }, "situation": { "ja": "会員・組織のデータをAPIと共有キャッシュで扱うとき。", "en": "Use this when APIs and shared caches handle user- or organization-specific data." }, "goal": { "ja": "取得する時点と再利用する時点の両方で、相手の区別が残るかを確かめます。", "en": "Review whether identity separation is preserved both when retrieving data and when reusing responses." }, "ruleIds": ["SEC-014", "SEC-016"], "incidentIds": ["2rinkan-api-2026", "tixplus-cache-exposure-2026"], "termIds": ["authorization", "tenant", "cache"], "sourceIds": ["authorization", "http-cache"], "steps": [ { "title": { "ja": "対象と操作を並べる", "en": "Map callers, resources, and actions" }, "action": { "ja": "詳細・一覧・出力ごとに、誰がどの対象へ何をできるかを読みます。", "en": "Read who may act on which resources through detail, list, and export routes." }, "evidence": { "ja": "認可条件と、それを確認する既存テストの対応。", "en": "Authorization conditions mapped to existing tests." } }, { "title": { "ja": "応答の共有範囲を読む", "en": "Read response sharing rules" }, "action": { "ja": "利用者に依存する経路で、Cache-Control、CDN設定、キーの区切りを比べます。", "en": "Compare Cache-Control, CDN settings, and key variation on identity-dependent routes." }, "evidence": { "ja": "共有できる応答と、利用者ごとに分ける応答の根拠。", "en": "The rationale for shared responses and identity-separated responses." } }, { "title": { "ja": "境界の確認範囲を残す", "en": "Record the tested boundaries" }, "action": { "ja": "既存の許可・拒否と利用者間分離の試験を読み、未検証の経路や条件を明示します。", "en": "Review existing allow, deny, and cross-user isolation tests, identifying untested routes and conditions." }, "evidence": { "ja": "利用者・組織・経路・キャッシュ状態ごとの試験範囲。", "en": "Test scope by identity, organization, route, and cache state." } } ], "limits": [ { "ja": "ログイン必須や推測しづらいIDだけを、対象ごとの認可に置き換えません。", "en": "Login requirements and hard-to-guess identifiers do not replace resource authorization." }, { "ja": "キャッシュのprivateとno-storeの意味は異なります。設定名だけで全経路を合格にしません。", "en": "Private and no-store have different meanings; a setting name cannot establish coverage of every route." } ], "takeaway": { "ja": "取得時に正しくても、再利用した応答で境界が崩れないかを別に確かめます。", "en": "Correct retrieval authorization still needs a separate review of response reuse." } }, "rules": [ { "rule": { "id": "SEC-014", "version": "1.2.1", "updatedAt": "2026-10-19", "title": { "ja": "照会APIの認可と取得量の制御を確認する", "en": "Inspect query authorization and retrieval limits" }, "summary": { "ja": "会員・顧客・組織の情報を照会、一覧表示、一括出力するWebアプリやAPI。", "en": "Web apps and APIs that query, list, or export member, customer, or organization information." }, "category": "implementation", "surfaces": ["web-app", "identity", "data-store"], "applicability": { "ja": "利用者のIDや所属組織に応じて取得可能なデータが変わる環境。大量照会の制御も対象です。", "en": "Environments where user or organization identity determines accessible data, including bulk-query controls." }, "targets": [ { "ja": "APIルート・認可処理・組織IDによる絞り込み・DBへの照会", "en": "API routes, authorization, tenant filtering, and database queries" }, { "ja": "ページ送り・一括出力・取得量の上限・監視設定", "en": "Pagination, exports, retrieval limits, and monitoring configuration" } ], "checks": [ { "ja": "画面の表示制限に加え、各APIが呼び出し元の権限とデータの所属を照合するか確認する。未認証・権限不足・別組織の試験データが拒否されるか、許可されたテスト環境の証拠で確認する。", "en": "Inspect server-side caller and record authorization; use evidence from an authorized test environment for unauthenticated, insufficient-role, and cross-tenant denial." }, { "ja": "通常形式のリクエストを繰り返した場合も、利用者・組織ごとの取得量を制限・検知できるか確認する。ページ送りや複数のAPIに分けた取得も試験計画に含める。", "en": "Inspect per-user and per-tenant volume limits and detection, including repeated ordinary requests, pagination, and access spread across endpoints." }, { "ja": "非公開APIやHTTPメソッドの違いでも認可を維持するか、不正形式の認証トークンを拒否するか、許可されたテスト環境で確認する。招待・権限変更も対象に含める。", "en": "In an authorized test environment, verify authorization across private endpoints and methods, rejection of malformed tokens, invitations and role changes." } ], "remediation": [ { "ja": "認可をサーバー側で共通化し、業務に合う取得量の上限と通知を設ける。許可された操作の成功と、許可していない照会の拒否を試験データで確認する。", "en": "Centralize server-side authorization and set appropriate limits and alerts; verify allowed and denied queries with synthetic data." } ], "completionEvidence": [ { "ja": "対象API、権限とデータ所属の組合せ、許可・拒否の試験結果、取得量の上限と通知の証拠を残す。未検査のAPIや一括出力は明記する。", "en": "Record API coverage, role/ownership combinations, allow/deny results, retrieval limits, and alert evidence; identify untested endpoints and exports." } ], "limitations": [ { "ja": "取得量の制限だけでは認可の欠陥を直せません。本番での大量リクエストや実顧客データへの照会を点検のために実行せず、権限や試験証拠が不足すれば未確認とします。", "en": "Limits do not repair authorization flaws. Do not exercise bulk requests or real customer queries in production; unavailable permissions or test evidence mean unverified." } ], "incidentIds": [ "2rinkan-api-2026", "aflac-japan-2026", "benefit-one-tenant-export-2026", "commune-2026", "denmark-cpr-2026", "en-midcareer-credential-stuffing-2026", "fancrew-credential-stuffing-2026", "fines-reservations-2026", "gmo-infoq-2026", "gpoint-2026", "hiho-mypage-2026", "jaea-jrr3-files-2026", "kaga-solnet-2026", "komatsu-user-directory-exposure-2026", "kwansei-external-sns-2026", "kyoto-kyotv-exposure-2026", "nimoca-2026", "osaka-high-court-teams-2026", "saga-hirakawaya-payment-2026", "seicomart-app-2026", "seiho-contract-lookup-2026", "shizuoka-form-exposure-2026", "shueisha-hapicomi-2026", "skyticket-bus-2026", "studysapuri-enumeration-2026", "takaratomy-dmp-auth-2026", "tixplus-cache-exposure-2026", "weblife-oem-2026", "weverse-payment-api-2026" ], "references": [ { "title": "アフラック生命保険：調査結果と再発防止策", "url": "https://www.aflac.co.jp/static/corp/profile/news/2026/2026073100.pdf" }, { "title": "JPCERT/CC：直近で相次いでいる国内組織における不正アクセスに関する注意喚起（10月9日更新）", "url": "https://www.jpcert.or.jp/at/2026/at260030.html" } ], "execution": "read-only-by-default", "provenance": "editorial-guidance" }, "example": { "ruleId": "SEC-014", "scenario": { "ja": "会員や組織のデータを、詳細・一覧・一括出力で返すAPI。", "en": "An API exposes user or organization data through detail, list, and export endpoints." }, "firstCheck": { "ja": "入口ごとに、呼び出し元と対象を照合する認可処理を読みます。", "en": "Read how each endpoint checks the caller against the requested resource." }, "lookAt": [ { "ja": "組織・利用者の識別情報を決める処理。", "en": "How organization and user context is established." }, { "ja": "詳細・一覧・出力で共有する認可条件。", "en": "Authorization conditions for detail, list, and export access." }, { "ja": "取得件数・ページ送り・大量取得の制限。", "en": "Limits covering volume, pagination, and bulk retrieval." } ], "evidence": { "ja": "誰がどの対象へ何をできるかと、既存の拒否・取得量テストの対象を残します。", "en": "Record actor-resource-action rules and the scope of existing denial and volume tests." }, "limit": { "ja": "推測しづらいIDやログイン必須だけで認可済みとは判断しません。許可のない照会は行いません。", "en": "Hard-to-guess IDs and login requirements do not establish authorization. Do not make unauthorized requests." }, "sourceIds": ["authorization"] } }, { "rule": { "id": "SEC-016", "version": "1.0.0", "updatedAt": "2026-10-09", "title": { "ja": "利用者ごとのレスポンスをキャッシュで混在させない", "en": "Keep personalized responses isolated in caches" }, "summary": { "ja": "CDN、プロキシ、アプリのキャッシュで、別の利用者や組織の情報が返らないことを確認します。", "en": "Check that CDN, proxy and application caches do not return another user’s or tenant’s data." }, "category": "configuration", "surfaces": ["web-app", "cloud", "data-store"], "applicability": { "ja": "ログイン状態や組織、権限によってレスポンスが変わり、キャッシュを利用するサービス。", "en": "Services that cache responses which vary by login identity, tenant or permissions." }, "targets": [ { "ja": "CDN・プロキシの保存条件、キャッシュキー、Cookie・Authorizationの扱い、認証後のページとAPI", "en": "CDN and proxy storage conditions, cache keys, Cookie and Authorization handling, authenticated pages and APIs." } ], "checks": [ { "ja": "個人情報を含むレスポンスの保存条件とキャッシュキーを照合し、利用者・組織・権限の違いを正しく扱っているか確認する。", "en": "Compare storage conditions and cache keys for personalized responses; verify isolation by identity, tenant and permission." }, { "ja": "所有者が許可した検証環境の試験証拠で、Aの後にBが同じURLへアクセスしてもAのデータが返らず、未ログイン・ログアウト後にもデータが残らないことを確認する。", "en": "Review tests in an owner-authorized environment: B visiting a URL after A must not receive A’s data, including anonymous and post-logout access." }, { "ja": "通常、エラー、リダイレクト、再認証のレスポンスとキャッシュ無効化後の挙動を確認する。設定だけで証明できなければunverifiedとする。", "en": "Check normal, error, redirect and reauthentication responses, plus behavior after invalidation. Configuration alone without behavioral evidence remains unverified." } ], "remediation": [ { "ja": "個別レスポンスの共有キャッシュを止めるか、必要な識別子と権限を含む分離を設計し、変更時には既存キャッシュも無効化する。", "en": "Disable shared caching of personalized responses or design adequate identity and permission isolation; invalidate existing cache entries when changing policy." } ], "completionEvidence": [ { "ja": "変更した設定と、異なる利用者・組織・未ログイン状態の順序を変えても混在しない試験結果を残す。通常の配信も成功することを確認する。", "en": "Keep configuration changes and tests that vary user, tenant and anonymous-access order without cross-user data. Verify normal delivery still succeeds." } ], "limitations": [ { "ja": "Cache-Controlの記載だけでは、CDNやアプリ独自の保存処理まで保証できません。認可そのものはSEC-014で別に確認します。", "en": "Cache-Control alone does not prove CDN or custom application storage behavior. Inspect authorization separately with SEC-014." }, { "ja": "事故へのリンクは点検の提案です。各サービスに同じ設定不備があるという認定ではありません。", "en": "Incident links provide inspection guidance; they do not establish the same defect in every service." } ], "incidentIds": ["tixplus-cache-exposure-2026"], "references": [], "execution": "read-only-by-default", "provenance": "editorial-guidance" }, "example": { "ruleId": "SEC-016", "scenario": { "ja": "利用者ごとに変わる応答を、CDNやアプリのキャッシュでも扱うサービス。", "en": "A CDN or application cache handles responses that vary by user." }, "firstCheck": { "ja": "対象の応答、共有キャッシュ設定、キャッシュキーの対応を読みます。", "en": "Review the relationship between the response, shared-cache policy, and cache key." }, "lookAt": [ { "ja": "利用者や組織で内容が変わる経路。", "en": "Routes whose content varies by user or organization." }, { "ja": "Cache-ControlとCDN側の保存・再利用条件。", "en": "Cache-Control and CDN storage and reuse rules." }, { "ja": "利用者の違いを含むキーと既存の分離テスト。", "en": "Key variation and existing isolation tests across users." } ], "evidence": { "ja": "誰の応答を誰が再利用できる設計かと、確認した設定・テストを残します。", "en": "Record the intended sharing boundary and the settings and tests examined." }, "limit": { "ja": "privateとno-storeは同じ意味ではありません。ヘッダーの確認だけで全経路の混在を否定しません。", "en": "Private and no-store have different meanings. Header review alone does not rule out mixing on every route." }, "sourceIds": ["http-cache"] } } ], "referenceIncidents": [ { "id": "2rinkan-api-2026", "organization": "2りんかんイエローハット", "title": { "ja": "2りんかんイエローハット：不正アクセスの経緯と影響", "en": "2りんかんイエローハット: unauthorized access and impact" }, "summary": { "ja": "アプリのAPIを悪用して会員専用サーバーの情報が取得されました。具体的な認可不備や脆弱性の内容は未公表です。 3,179,454人分の会員情報が流出しました。第二報の最大3,455,754人分から修正されました。決済情報は別管理で対象外です。", "en": "The application API was abused to retrieve membership data; the specific authorization defect or vulnerability is undisclosed. Membership information for 3,179,454 people was leaked, revised from a maximum of 3,455,754. Separately managed payment data was excluded." }, "occurredAt": null, "disclosedAt": "2026-04-23", "reviewedAt": "2026-10-09", "outcome": "confirmed-breach", "categories": ["unknown"], "cves": [], "claims": [ { "topic": "entry", "text": { "ja": "アプリのAPIを悪用して会員専用サーバーの情報が取得されました。具体的な認可不備や脆弱性の内容は未公表です。", "en": "The application API was abused to retrieve membership data; the specific authorization defect or vulnerability is undisclosed." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "6月19日最終報 §§1-3 / 4月23日第一報" }, { "topic": "impact", "text": { "ja": "3,179,454人分の会員情報が流出しました。第二報の最大3,455,754人分から修正されました。決済情報は別管理で対象外です。", "en": "Membership information for 3,179,454 people was leaked, revised from a maximum of 3,455,754. Separately managed payment data was excluded." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "6月19日最終報 §§1-3 / 4月23日第一報" } ], "timeline": [ { "date": "2026-04-23", "text": { "ja": "公表資料で確認できる開示日。", "en": "Disclosure date established by the reviewed notice." }, "sourceIds": ["s1"] } ], "reportedActions": [ { "topic": "response", "text": { "ja": "対象者への通知を完了し、アプリ停止中にシステムを再構築しています。再開時の一斉ログアウトとパスワード再設定を案内しています。", "en": "Individual notification is complete; the suspended application is being rebuilt. Logout and password reset are planned on reopening." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "6月19日最終報 §§1-3 / 4月23日第一報" } ], "prevention": { "classification": "unknown", "assessment": { "ja": "侵入方法や修正の提供時期が分からず、防げたかは判断できません。関連ルールで権限、取得ログ、保存期限と稼働設定を点検します。", "en": "Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules." }, "sourceIds": ["s1"] }, "ai": { "status": "unknown", "assessment": { "ja": "確認した公表資料からは、攻撃者によるAI利用を判断できません。", "en": "The reviewed disclosures do not establish attacker use of AI." } }, "unknowns": [ { "ja": "具体的な侵入方法、攻撃開始日、取得の確定範囲は未公表です。", "en": "The API abuse is established; the notice does not establish a specific IDOR or SQL injection flaw. Revised records replace the original estimate." } ], "sources": [ { "id": "s1", "title": "2りんかんイエローハット：事故に関する公表資料", "url": "https://2rinkan.jp/annai/20260423/", "publisher": "2りんかんイエローハット", "kind": "organization", "publishedAt": null, "reviewedAt": "2026-10-09" } ], "ruleIds": ["SEC-005", "SEC-008", "SEC-009", "SEC-012", "SEC-014"] }, { "id": "tixplus-cache-exposure-2026", "organization": "チケットプラス", "title": { "ja": "チケットプラス：情報の公開範囲・権限の問題", "en": "チケットプラス: data exposure and authorization boundaries" }, "summary": { "ja": "負荷軽減のキャッシュ設定変更後、同時アクセスで別ユーザーの情報を表示する状態になりました。 自分の情報を表示された可能性のある最大107名と、他人の情報を表示された可能性のある最大322名を分けています。429名を流出被害者数とは扱いません。", "en": "A cache change intended to reduce load caused cross-user information display during concurrent access. Up to 107 data owners and 322 viewers are separate scopes. Their sum is not a confirmed leaked-person count." }, "occurredAt": "2026-09-28", "disclosedAt": "2026-10-01", "reviewedAt": "2026-10-09", "outcome": "exposure-only", "categories": ["configuration"], "cves": [], "claims": [ { "topic": "entry", "text": { "ja": "負荷軽減のキャッシュ設定変更後、同時アクセスで別ユーザーの情報を表示する状態になりました。", "en": "A cache change intended to reduce load caused cross-user information display during concurrent access." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "1. 発生経緯 / 4. 影響を受けた可能性のあるお客様" }, { "topic": "impact", "text": { "ja": "自分の情報を表示された可能性のある最大107名と、他人の情報を表示された可能性のある最大322名を分けています。429名を流出被害者数とは扱いません。", "en": "Up to 107 data owners and 322 viewers are separate scopes. Their sum is not a confirmed leaked-person count." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "1. 発生経緯 / 4. 影響を受けた可能性のあるお客様" } ], "timeline": [ { "date": "2026-09-28", "text": { "ja": "公表資料が示す事象発生日。", "en": "Event date reported by the source." }, "sourceIds": ["s1"] }, { "date": "2026-10-01", "text": { "ja": "公表資料で確認できる開示日。", "en": "Disclosure date established by the reviewed notice." }, "sourceIds": ["s1"] } ], "reportedActions": [ { "topic": "response", "text": { "ja": "サービスを停止して設定を修正し、9月30日に再開しました。", "en": "The service was suspended, configuration corrected, and service resumed on September 30." }, "status": "confirmed", "sourceIds": ["s1"], "locator": "1. 発生経緯 / 4. 影響を受けた可能性のあるお客様" } ], "prevention": { "classification": "operational-control", "assessment": { "ja": "公表された設定・権限・運用上の問題に対応する点検です。適用条件を確認し、変更後の挙動と証拠を残します。", "en": "Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation." }, "sourceIds": ["s1"] }, "ai": { "status": "unknown", "assessment": { "ja": "確認した公表資料からは、攻撃者によるAI利用を判断できません。", "en": "The reviewed disclosures do not establish attacker use of AI." } }, "unknowns": [ { "ja": "両対象の重複や実際に他人へ表示された人数は未公表です。", "en": "Overlap and the actual count displayed to other people are undisclosed." } ], "sources": [ { "id": "s1", "title": "チケットプラス：事故に関する公表資料", "url": "https://tixplus.jp/information/", "publisher": "チケットプラス", "kind": "organization", "publishedAt": null, "reviewedAt": "2026-10-09" } ], "ruleIds": ["SEC-014", "SEC-016"] } ], "terms": [ { "id": "authorization", "name": { "ja": "操作できる範囲", "en": "Authorization" }, "meaning": { "ja": "利用者が、その対象に、その操作をしてよいかを決めること。ログインできることとは別の判断です。", "en": "The decision about whether a caller may perform a particular action on a particular resource, separate from establishing their identity." }, "question": { "ja": "対象を別の利用者や組織に変えても、同じ判断が働きますか。", "en": "Does the decision still hold when the resource belongs to another user or organization?" }, "ruleId": "SEC-014", "sourceId": "authorization" }, { "id": "tenant", "name": { "ja": "組織ごとの境界", "en": "Tenant boundary" }, "meaning": { "ja": "同じアプリを使う会社やグループの区切り。データと権限が、この区切りをまたがないかを見ます。", "en": "The separation between organizations sharing an application. Review whether data and permissions can cross that separation." }, "question": { "ja": "一覧・詳細・出力のどこでも組織の境界を確認していますか。", "en": "Is the organization boundary checked for lists, detail views, and exports?" }, "ruleId": "SEC-014", "sourceId": "authorization" }, { "id": "cache", "name": { "ja": "応答の再利用", "en": "Cache" }, "meaning": { "ja": "一度作った応答などを保存して再利用する仕組み。誰と共有するか、どの条件で再利用するかを決めます。", "en": "Storage and reuse of responses. Define who may share them and the conditions under which they can be reused." }, "question": { "ja": "利用者に依存する応答が、他の人に再利用されませんか。", "en": "Can a response tied to one user be reused for someone else?" }, "ruleId": "SEC-016", "sourceId": "http-cache" } ], "sources": [ { "id": "authorization", "title": "Authorization Cheat Sheet", "publisher": "OWASP", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html", "locator": "Enforce Least Privileges; Validate the Permissions on Every Request", "reviewedAt": "2026-11-12" }, { "id": "http-cache", "title": "RFC 9111: HTTP Caching", "publisher": "IETF / RFC Editor", "url": "https://www.rfc-editor.org/rfc/rfc9111.html", "locator": "3.5; 5.2.2.5 no-store; 5.2.2.7 private", "reviewedAt": "2026-11-12" } ] }