Two scoops of Django - Security Best Practices

Two Scoops of Django
Security Best Practices
Spin Lai

I. Django Configurations
II. Django Security Features
III. Django Admin
IV. What Else ?

Django Conﬁgurations
Designate Settings
DEBUG / TEMPLATE_DEBUG
ALLOWED_HOSTS
SECRET_KEY
!

Designate Settings
ALLOW_HOSTS
SECRET_KEY
!
$ python manage.py --settings=[setting path]
$ django-admin.py --settings=[setting path]
$ export DJANGO_SETTINGS_MODULE=[setting path]

Designate Settings
ALLOWED_HOSTS
SECRET_KEY
!
DEBUG = False
!
TEMPLATE_DEBUG = False

Designate Settings
ALLOWED_HOSTS
SECRET_KEY
!
# Must be set when DEBUG = False
ALLOWED_HOSTS = [
'localhost',
'www.example.com',
'.example.com',
'*' # Avoid !
]

Designate Settings
ALLOWED_HOSTS
SECRET_KEY
!
‣ Configuration values, not code.
‣ DO NOT keep them in version control.
‣ Use environment variables.

Designate Settings
ALLOWED_HOSTS
SECRET_KEY
!
!
def get_env_variable(varname):
try:
return os.environ[varname]
except KeyError:
msg = "Set the %s environment variable" % var_name
raise ImporperlyConfigured(msg)

Django Security Features
XSS Protection
CSRF Protection
Injection Protection
Clickjacking Protection
SSL / HTTPS
Password Storage
Data Validation

Django Security Features
XSS Protection
CSRF Protection
Injection Protection
Clickjacking Protection
SSL / HTTPS
Password Storage
Data Validation
‣ Django by default escapes specific characters
‣ Be careful when using is_safe attribute
‣ Be very careful when storing HTML in Database

CSRF protection
• Django CSRF Protection Workﬂow
• CSRF Protection for AJAX Request
• HTML Search Form
• CsrfViewMiddleware rather than @csrf_protect
• Be careful with @csrf_exempt

CSRF protection
• CsrfViewMiddleware rather than csrf_protect()
• Be careful with csrf_exempt()
‣ Random token value by CsrfViewMiddleware (CSRF cookie)
‣ `csrf_token` template tag generate hidden input
‣ Every request calls django.middleware.csrf.get_token()
‣ Compare CSRF cookie with `csrfmiddlewaretoken` value
‣ With HTTPS, CsrfViewMiddleWare will check referer header

CSRF protection
‣ Pass CSRF token as POST data with every POST request
‣ Set a custom `X-CSRFToken` header on each request
‣ CSRF cookie might not exist without `csrf_token` tag

CSRF protection
var origSync = Backbone.sync;
Backbone.sync = function (method, model, options) {
options.beforeSend = function (xhr) {
xhr.setRequestHeader('X-CSRFToken', $.cookie('csrftoken'));
};
!
return origSync(method, model, options);
};

Injection protection
• Script Injection
• SQL Injection

• SQL Injection
‣Beware of the eval(), exec() and execfile()
‣DO NOT use `pickle` module to serialize/deserialize data.
‣Only use safe_load() in PyYAML

• SQL Injection
‣ Django Queryset escape varaibles automatically
‣ Be careful to escape raw SQL properly
‣ Exercise caution when using extra()

Clickjacking protection
• `X-Frame-Options` HTTP header
• Conﬁgurations
• @xframe_options_exempt
• Browsers Support

• Conﬁgurations
Whether or not a resource is allowed to load
within a frame or iframe

• Conﬁgurations
MIDDLEWARE_CLASSES = (
...
'django.middleware.clickjacking.XFrameOptionsMiddleware',
...
)

• Conﬁgurations
# Default
X_FRAME_OPTIONS = 'SAMEORIGIN'
!
X_FRAME_OPTIONS = 'DENY'

• Conﬁgurations
‣ Internet Explorer 8+
‣ Firefox 3.6.9+
‣ Opera 10.5+
‣ Safari 4+
‣ Chrome 4.1+

SSL / HTTPS
• HTTPS Everywhere !
• Secure Cookies
• HSTS
• Packages

SSL / HTTPS
• Secure Cookies
• HSTS
• Packages
‣ Web server configuration
‣ Django middleware
‣ SSL certificate from reputable source

SSL / HTTPS
• Secure Cookies
• HSTS
• Packages
SECURE_PROXY_SSL_HEADER = False
!
$ export HTTPS=on

SSL / HTTPS
• Secure Cookies
• HSTS
• Packages
SESSION_COOKIE_SECURE = True
!
CSRF_COOKIE_SECURE = True

SSL / HTTPS
• Secure Cookies
• HSTS
• Packages
‣Redirect HTTP links to HTTPS
‣Web server level configuration
‣HSTS-compliant browsers

SSL / HTTPS
• Secure Cookies
• HSTS
• Packages
Strict-Transport-Security: max-age=31536000, includeSubDomains

SSL / HTTPS
• Secure Cookies
• HSTS
• Packages
‣ django-sslify
‣ django-secure
‣ django-hstsmiddleware

Password Storage
• PBKDF2 + SHA256
• User.password
• PASSWORD_HASHER
• Use bcrypt
• Increase work factor

Password Storage
• PBKDF2 + SHA256
• User.password
• PASSWORD_HASHER
• Use bcrypt
<algorithm>$<iteration>$<salt>$<hash>

Password Storage
• PBKDF2 + SHA256
• User.password
• PASSWORD_HASHER
• Use bcrypt
PASSWORD_HASHERS = (
'django.contrib.auth.hashers.PBKDF2PasswordHasher',
'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',
'django.contrib.auth.hashers.BCryptPasswordHasher',
'django.contrib.auth.hashers.SHA1PasswordHasher',
'django.contrib.auth.hashers.MD5PasswordHasher',
'django.contrib.auth.hashers.UnsaltedSHA1PasswordHasher',
'django.contrib.auth.hashers.UnsaltedMD5PasswordHasher',
'django.contrib.auth.hashers.CryptPasswordHasher',
)

Password Storage
• PBKDF2 + SHA256
• User.password
• PASSWORD_HASHER
• bcrypt

Data Validation
• Django Forms
• User-Uploaded Content

Data Validation
• Django Forms
‣ Designed to validate Python dictionaries
‣ Not only for HTTP POST request
‣ DO NOT use ModelForms.Meta.exclude
‣ Use ModelForms.Meta.fields instead

Data Validation
• Django Forms
from django import forms
from .models import Store
!
class StoreForm(forms.ModelForm):
!
class Meta:
model = Store
# Don't Do this!!
excludes = ("pk", "slug", "modified")

Data Validation
• Django Forms
from django import forms
from .models import Store
!
class StoreForm(forms.ModelForm):
!
class Meta:
model = Store
# Explicitly specifying what we want
fields = ("title", "address", "email")

Data Validation
• Django Forms
‣ Limit upload in web server
‣ FileField / ImageField
‣ python-magic
‣ Validate with specific file type library

Data Validation
• Django Forms
from django.utils.image import Image
!
try:
Image.open(file).verify()
except Exception:
# Pillow (or PIL) doesn't recognize it as an image.
six.reraise(ValidationError, ValidationError(
self.error_messages['invalid_image'],
code='invalid_image',
), sys.exc_info()[2])

Django Admin
Change the Default Admin URL
Access Admin via HTTPS
Limited Access Based on IP
Use `allow_tags` attribute with Caution
Admin Docs
Packages

Django Admin
Admin Docs
Packages
‣ Web server configuration
‣ Django middleware

Django Admin
Admin Docs
Packages
‣ django-admin-honeypot
‣ django-axes

What else ?
Harden your servers
NEVER store credit card data
Server monitoring
Vulnerability reporting page
Keep things up-to-date

What else ?
Harden your servers
Server monitoring
‣ PCI-DSS Security Standards
‣ Sufficient Time/Resource/Funds
‣ Using 3rd-Party Services
‣ Beware of Open Source Solutions

What else ?
Harden your servers
Server monitoring
‣ Check access/error logs regularly
‣ Install monitoring tools

Keep Things Up-to-Date
• Dependencies
• Security Practices

Keep Things Up-to-Date
• Dependencies
• Security Practiceshttps://www.djangoproject.com/weblog/

Two scoops of Django - Security Best Practices

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (20)

Ähnlich wie Two scoops of Django - Security Best Practices

Ähnlich wie Two scoops of Django - Security Best Practices (20)

Mehr von Spin Lai

Mehr von Spin Lai (6)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Two scoops of Django - Security Best Practices