Embed Size (px)
Citation preview
Practical Django Security
Andy Dai
Software Security is HARD!
Quick Investigation
OWASP TOP 10 2013
10. Unvalidated Redirects and Forwards
SOLUTION: Be careful!
9. Using Components with Known Vulnerabilities
SOLUTION: Check often and Upgrade often
8. Cross Site Request Forgery
SOLUTION: CSRF token & CAPTCHA
7. Missing Function Level Access Control
SOLUTION: Control your access
Django Provides
• @login_required
• Access Mixins in django-braces
6. Sensitive Data Exposure
Forget your password
NO SSL
SOLUTION: SSL & Encrypt all sensitive data
django-encrypted-fields
5. Security Misconfiguration
• Use default username/password
• Directory listing
• Debug Mode
4. Insecure Direct Object References
SOLUTION: Access Control
3. Cross-Site Scripting(XSS)
SOLUTION: Check user input. Escape!
Django Template will do this for you
2. Broken Authentication and Session Management
h\p://example.com/sale/saleitems;jsessionid=
2P0OC2JDPXM0OQSNDLPSKHCJUN2JV?dest=Hawaii
1. Injection
SOLUTION
• Don’t Use SQL directly
• Check user input
• Turn off debug mode
Software Security is HARD!
Other Rules
Don’t mixing up data and code
What is code? What is data?
Explicit is better than implicit
class ArticleForm(ModelForm): class Meta: model = Article fields = ['pub_date', 'headline', 'content', ]
class ArticleForm(ModelForm): class Meta: model = Article exclude = ['id', ]
v.s
Don’t reinvent the wheel
Look to assert what is supposed to happen in
your application
Software Security is IMPORTANT!!
Q&A
