Practical Django Security

1. Practical Django
Security
Andy Dai

2. Software Security is
HARD!

3. Quick Investigation

4. OWASP TOP 10 2013

5. 10. Unvalidated
Redirects and Forwards

6. http://www.example.com/
redirect.jsp?url=evil.com

7. SOLUTION:
Be careful!

8. 9. Using Components
with Known Vulnerabilities

9. SOLUTION: Check often
and Upgrade often

10. 8. Cross Site Request
Forgery

11. SOLUTION: CSRF
token & CAPTCHA

12. 7. Missing Function
Level Access Control

13. SOLUTION: Control
your access

14. Django Provides
• @login_required
• Access Mixins in django-braces

15. 6. Sensitive Data
Exposure

16. Forget your password

17. NO SSL

18. SOLUTION: SSL &
Encrypt all sensitive data

19. django-encrypted-
fields

20. 5. Security
Misconfiguration

21. • Use default username/password
• Directory listing
• Debug Mode

22. 4. Insecure Direct
Object References

23. http://example.com/app/
accountInfo?acct=notmyacct

24. SOLUTION: Access
Control

25. 3. Cross-Site
Scripting(XSS)

26. SOLUTION: Check
user input. Escape!

27. Django Template will
do this for you

28. 2. Broken Authentication
and Session
Management

29. hp://example.com/sale/
saleitems;jsessionid=
2P0OC2JDPXM0OQSNDLPSKHC
JUN2JV?dest=Hawaii

30. 1. Injection

31. SOLUTION
• Don’t Use SQL directly
• Check user input
• Turn off debug mode

32. Software Security is
HARD!

33. Other Rules

34. Don’t mixing up data
and code

35. What is code? What is
data?

36. Explicit is better than
implicit

37. class ArticleForm(ModelForm):
class Meta:
model = Article
fields = ['pub_date', 'headline', 'content', ]
class ArticleForm(ModelForm):
class Meta:
model = Article
exclude = ['id', ]
v.s

38. Don’t reinvent the
wheel

39. Look to assert what is
supposed to happen in
your application

40. Software Security is
IMPORTANT!!

41. Q&A