0

I am working on a statistic tool for our company, millions of datasets. Now I need to upload the project, so all company members can request data from everywhere.

I am working with Python 3/Flask and I plan to upload the project on heroku.

Heroku offers by default an SSL certificate (I do not plan to use a custom domain).

In addition I integrated Flask-BasicAuth. It works on localhost fine, one can only access the website if the username and password are known.

I also use Flask-WTF and a CRSF token on the form. After the from submits, which is a must, I request different statistics via AJAX.

  1. User enters a daterange
  2. User submits form and the basic dataset is selected
  3. Different statistics are requested via AJAX POST

Step 3. means I have a lot of routes, which only accept a POST method and return a JSON object.

This tool MUST be only accessible by company members, because important data can be requested and seen. Does my approach sound reasonable?

1

HTTP basic auth is prone to be bruteforced. Flask-HTTPAuth with digest mode could be a better solution, but there are also several security concerns to be resolved, as well as additional password and lockout policies.

Another approach colud be integration with trusted Oauth provider like Google. This way you just shift authentication-related responsibilities to 3rd party that you can trust, and it could be much easier yet reliable.

4
  • Thanks for the reply, I am also thinking to add more security layers, for example allow requests only from a certain city. But all in all every system can be hacked if targeted specifically. Maybe that is generally a bad idea to upload such a tool on a live server. I am thinking about adding a functionality to download all the stats as a PDF
    – Roman
    Oct 29 '18 at 9:35
  • Would you upload such a tool on a live server or would you search an other option?
    – Roman
    Oct 29 '18 at 9:36
  • An other idea is to install this tool on the PC's of other company members, so everyone has a local version and everyone would be able to run it from localhost.
    – Roman
    Oct 29 '18 at 10:03
  • Yes, I'd upload such tool on a live server after at least: - successfull verification of tool with OWASP ASVS checklist; - enabling 2FA for all users; - establishing a regular monitoring of a hosting regarding data breaches. Regarding localhosts - your data will be as secure as every laptop of your company.
    – odo
    Oct 29 '18 at 10:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.