Contribute Media
A thank you to everyone who has made this possible: Read More

Safe-ish By Default

Description

Come join us by the fire as we have Security Story Time with our friends, Frog and Toad. With them, you'll learn about all the things Django does to protect users and developers out of the box. We'll look at simplified code samples from the Django codebase to see what's happening under the hood, and cover how to make the Django security model even stronger in your application ​ Abstract Introduction to the story, and the characters. Safe-ish: Talk about Django’s Security Model and how it tries to provide sane defaults for developers

Run-through of the parts of the django security model:

  • XSS (brief definition). How do you turn it off? Mark Safe, | n, safe
  • CSRF (brief definition). Django has middleware that checks POST requests for a token. Token is stored in cookie, also. Side-effect: harder to JS. Also, only an issue if you’re already owned, so maybe not an issue?. How to get around it? csrf_exempt
  • SQLi (brief definition). Django’s ORM makes clean sql, (even when given bad data?). How? How to get around it: extra()/RawSQL()
  • Clickjacking protection (brief definition). Django has middleware that sets headers browsers are supposed to respect. How to get around it: xframe_options_exempt, xframe_options_deny, xframe_options_sameorigin
  • HTTPS. This one is less "out of the box" than the others, so won’t be talked about here.
  • Host Header Validation (brief definition). Django verifies against allowed hosts in settings. How? get_host()
  • Session security. What are django sessions?. Cookie-based by design. How can we make this better?
  • Overall: Vigilance. Be aware of uses of this within your product
  • HTTPS: Use it!. Set the correct settings. SECURE_SSL_REDIRECT: How does it work?

Bio: Philip is a Senior Software Engineer at Eventbrite. In his spare time, he writes novels, makes twitter bots, and gives technical talks. He used to run a webcomic, but there's just no money in it, you know? Philip is a refugee from the video games industry, and wishes anyone still there the best of luck. Philip has spoken at conferences about Python, Django, Node.js, and Linux. Philip believes in the web.

https://speakerdeck.com/pybay2016/philip-james-safe-ish-by-default-the-django-security-model-and-how-to-make-it-better-security-intermediate

Details

Improve this page