Questions tagged [django]

Django is a free and open source web application framework, written in Python, which follows the model–view–controller architectural pattern.

Filter by
Sorted by
Tagged with
1 vote
1 answer
101 views

"PUT /SDK/webLanguage HTTP/1.1" on a server with only port 22 open

I've recently spun on a new droplet on Digital Ocean with Ubuntu 22 and enabled UFW and allowed only SSH, which reports being active even after a reboot: sudo ufw status Status: active To ...
Fanu's user avatar
  • 13
2 votes
2 answers
2k views

How to access CSRF token in fronted when API is on different domain?

I am building a website with a separate Javascript frontend and a Django backend. My backend uses CSRF protection. Now the problem is that the CSRF token is being set on the client side as a cookie on ...
atskdev's user avatar
  • 23
0 votes
0 answers
83 views

How to secure an API end point when using javascipt

I'm struggling to understand how one can secure an API endpoint using JavaScript. I want to create a copy and paste-able snippet of Javascript that a user can paste in their site. And on page load/s ...
themissionmars's user avatar
0 votes
1 answer
311 views

Should email password be encrypted in a django app when using TLS?

I have seen multiple videos/tutorials regarding how to setup the email system in Django. It seems that they all assume as long as the password is stored in an environmental variable, no encryption is ...
Hector Ordonez's user avatar
0 votes
1 answer
703 views

Django File Validation

I' m building a REST API with Django and Django Rest Framework. I allow users to upload images and videos using different subclasses of ModelSerializer. When a file is received, the server saves it to ...
Alain Bianchini's user avatar
0 votes
2 answers
1k views

Is there any reason to block HEAD requests?

Apologies if this isn't the right place to ask this. I occasionally get alerts from my Django website along these lines: Internal Server Error: /posts/specific-post/ UnboundLocalError at /posts/...
heds1's user avatar
  • 103
11 votes
3 answers
4k views

Concerning GET request in logs

I have a Django application running on a Digital Ocean Ubuntu server. I am using NGINX and Daphne to serve the application because I am using Django Channels. My websockets keep crashing, and I ...
MattG's user avatar
  • 213
0 votes
1 answer
201 views

2FA with blower.io SMS

I'm currently planning to deploy a project on Heroku and was wondering if it is safe to send 2FA sms messages with the blower.io heroku addon? Also is it safe/ok to send a short lived authentication ...
Jonatan's user avatar
  • 101
1 vote
1 answer
225 views

Letting users to download data from my Django app

I want to provide a way for my users to download their data, which are stored in S3, through my app. Should I provide them with a public url followed by a key random key, as in this example? http://s3....
mick's user avatar
  • 11
0 votes
0 answers
399 views

How can you fingerprint a Django web app?

In order to better protect my Django web app, I want to reduce the leakage of information that could help an attacker profile my application. If you were an attacker, what would you look at to ...
Kyle Fennell's user avatar
1 vote
1 answer
1k views

Ways to exploit a form action value when it s reflected from URI on React-Django

I am working on a security testing project, where I have noticed that the form action of a login page takes whatever is fed to URI as a parameter, the respective part of the login page is as follows: ...
GunG's user avatar
  • 11
0 votes
1 answer
933 views

Is sending token authentication information via cookie headers secure?

I am by no means a security engineer , and I have barely started my journey as a web developer. I'm utilizing a Python package known as Django for my backend and react.js for my front end. Recently I ...
neowenshun's user avatar
4 votes
1 answer
579 views

Is it safe to create a session from an auth token?

My server is using Django Rest Framework. My mobile app logs in using token authentication. However, I also have a webview in the mobile app where I need to log in. I can't inject the auth token on ...
personjerry's user avatar
  • 1,246
1 vote
0 answers
144 views

VPN as a temporary layer of security?

I have a startup working on Django app, that will be processing sensitive personal and financial information. We're just finalizing a prototype of the product (no paying clients, no investors), so we'...
Simon's user avatar
  • 11
2 votes
1 answer
453 views

Is <meta> http-equiv secure?

I'd like to redirect a visitor to the login page if he's not authenticated and she/he wants to access a protected page. I can handle this via the backend code, but it's easier to make it using HTML. ...
4m1nh4j1's user avatar
  • 181
1 vote
1 answer
1k views

URL query string params Django security

I am new to Django and I am working on a website, where you can filter some articles using a normal GET url query string param. Theese params can be made from some input fields. I have found two ...
J.Doe.Doe's user avatar
3 votes
4 answers
4k views

Is sending a cookie with a sessionid in every HTTP response considered a bad practice?

My Django application sets a set-cookie: sessionid=xxxx; expires=Thu, 16-May-2019 18:54:59 (and some more, like max-age and path) on every response. The sessionid remains the same until the session ...
benzkji's user avatar
  • 133
0 votes
1 answer
2k views

Django admin site privilege escalation

Last night, I read a PDF detailing a privilege escalation attack a researcher had performed on a Django admin site. I'm curious- was the unfortunate application susceptible to this attack due to a ...
Patrick Charles's user avatar
2 votes
0 answers
731 views

Malicious PNG (html with png header)

I found following security notice on Django website: Django’s media upload handling poses some vulnerabilities when that media is served in ways that do not follow security best practices. ...
Alex Zaitsev's user avatar
3 votes
2 answers
3k views

Strange GET request to my web application

I developed a Django application for a school project and I hosted it on an EC2 instance to test and learn the environment. During inspection of the logs, I found the following GET request, "GET /...
Emre's user avatar
  • 133
1 vote
2 answers
218 views

A computer on the public network I was using was penetrated at a codejam. Am I at risk?

I was at a code jam today for 12 hours. At the end of the day as I was leaving, one of the programmers claimed his computer was hit with a reverse shell attack. He was voicing this as I was ...
bbenz's user avatar
  • 15
6 votes
2 answers
5k views

What should I use for authentication for my Django Rest API?

I just read this article about why JWT's suck. I'm now uncertain what I should use for authentication. For context: The API I wrote is mainly used by mobile Apps (iOS and Android). In the future it ...
J. Hesters's user avatar
2 votes
1 answer
385 views

What are the implications of removing SECURE_HSTS_INCLUDE_SUBDOMAINS = True with Django?

At the moment my django site's email confirmation links are not clickable for about 60 seconds. However, if I open them using right click open in new incognito window they work. I do have the ...
Sam Piecz's user avatar
0 votes
2 answers
812 views

Is it secure not to set a user in django admin?

Is it possible for someone to hack into my django admin app, if I do not create a user for it, by executing: python manage.py createsuperuser For example, is there a default username-password pair ...
pgmank's user avatar
  • 425
1 vote
1 answer
561 views

Getting a suspicious error in apache error.log (DJANGO)

Using django, I get the following error showing up in my apache errorlog: Invalid HTTP_HOST header: 'kyortisdzheykob.ru'. You may need to add u'kyortisdzheykob.ru' to ALLOWED_HOSTS. But I do not ...
Lawless Leopard's user avatar
2 votes
1 answer
2k views

Django, ajax and HttpOnly cookies

While reading "Tangled web" I came across description of http only cookies and I wanted to try it out in my project, so I've added these settings according according to docs: CSRF_COOKIE_HTTPONLY = ...
gonczor's user avatar
  • 123
4 votes
2 answers
543 views

What are the implications of making Djangos SECRET_KEY public?

I know the SECRET_KEY for a website made in Django. The owner of the site has accidentally made the settings.py public. What are the implications of making SECRET_KEY public? How can someone use ...
abybaddi009's user avatar
0 votes
1 answer
734 views

django-python3-ldap Does TLS Encrypt AD Passwords When Site is Hosted on http

I have implemented django-python3-ldap and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am deciding between using this ...
OverflowingTheGlass's user avatar
88 votes
7 answers
63k views

Does a CSRF cookie need to be HttpOnly?

We were recently handed a security report containing the following: Cookie(s) without HttpOnly flag set vulnerability, which we apparently had in one of our internal applications. The applied fix ...
alecxe's user avatar
  • 1,585
2 votes
1 answer
253 views

What does `&==;` mean with regard to Python Django and bypassing WAFs?

I'm reading someone's slides on bypassing WAFs. &==; : Python Django between parameters; FooBar==POST verb : Apache with PHP; <%I%M%U011e>==<IMG> : IIS ASP Classic; ;/path1 ...
daisy's user avatar
  • 2,057
1 vote
1 answer
902 views

Proxy not rejecting illegal host header when coming from my VM provider's network

I have a django app hosted on a linode VM, proxied by nginx on that same VM. In my nginx config I have a block to deny bad host header requests: ## Deny illegal Host headers if ($host !~* ^(mydomain....
Escher's user avatar
  • 603
1 vote
0 answers
218 views

Safe to have specific RESTful API endpoint without CSRF tokens?

I have a RESTful API. There are two ways to authenticate to it: a user/password-centric model, and OAuth2. Although user/password-authenticated users can make requests to this specific API endpoint, ...
std''OrgnlDave's user avatar
2 votes
1 answer
1k views

Heroku postgres: potential brute force attack

I have a Django app running on Heroku using Heroku Postgres. I was looking at the latest log (something I don't do very often) and something strange caught my eye. There were all these fatal database ...
Kritz's user avatar
  • 465
0 votes
1 answer
253 views

Django and Mindspark

I have a Django based website that collects data using forms. All users have to login to access the forms. Today I saw a strange error where a user submitted a form with a combination of form values ...
Chuck's user avatar
  • 103
0 votes
1 answer
80 views

What L7 traffic patterns can make it easier DoS an Apache web server?

We have a single JMeter HTTP load generator that we use to capacity test our web service (running Django + mod-wsgi + Apache)? If we want to modify the traffic generated to DoS our web service, what ...
Jedi's user avatar
  • 3,966
8 votes
3 answers
483 views

Proving the need to upgrade Django

The Story: In one of our projects, we are using Django web framework. But, we are currently stuck at 1.6.11 (mainly because in 1.7 Python 2.6 support was dropped - we are working on it, but it's ...
alecxe's user avatar
  • 1,585
1 vote
2 answers
961 views

Is it bad to give www-data user access to Postgres client certificate?

I have a first server running a Postgres database. I have allowed remote access to this database, using certificates for authentification (following this tutorial). Now I have a second server running ...
Istopopoki's user avatar
3 votes
1 answer
2k views

Nginx forwarding undesired hosts to Django

I've been getting errors from Django on my webserver (behind Nginx/uWSGI) complaining that it's being accessed with a request where the Host is the IP address of the server. Nginx is using virtual ...
Nick T's user avatar
  • 3,412
4 votes
1 answer
405 views

BREACH attack vs filtered reflected user input

I am in charge of the applicative security of our application and would like to test our exposure to the BREACH attack. Our django-based web application reflects filtered user-input and serves a CSRF ...
Maxime Leblanc's user avatar
4 votes
1 answer
5k views

Sending a token with a request from one app to another

Say I have an application written in some language and framework (Python + flask, for instance), and have a great deal of the functionality requiring login, and authentication via JWT. Now I want to ...
bitterman's user avatar
  • 143
4 votes
1 answer
1k views

How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off?

I've been writing a Django app and almost published it with debug mode on. Django's documentation indicates Never deploy a site into production with DEBUG turned on. Did you catch that? NEVER deploy ...
personjerry's user avatar
  • 1,246
1 vote
2 answers
717 views

Is this sanitizer vulnerable to XSS?

To have a simple and secure editor for text fields of a django app, I have this snippet to sanitize input HTML into django code: from bs4 import BeautifulSoup def sanitize_html(value): ...
Jand's user avatar
  • 213
2 votes
1 answer
429 views

How to make the most secure text editor in Django?

As a follow up to this question, I'm wondering what is the most secure way (using either markup or markdown) to allow users to format their inputs and upload images in a Django app? I'm not asking ...
Jand's user avatar
  • 213
1 vote
2 answers
377 views

Should I invest my time in making my site HTTPS-only?

I'm building a Django website that does not need to have registration/authentication. The only sensitive part is a form with a reCaptcha v2. Of course I'm embedding the CSRF token, which then I read ...
rubik's user avatar
  • 175
3 votes
2 answers
253 views

Securely saving credentials for later plain-text authentication

I am developing a Django application where a user logs in with Kerberos, and then has accesses to a number of internal applications. One of these is a file application that connects to a server over ...
James's user avatar
  • 31
19 votes
2 answers
8k views

Why is referer checking needed for Django to prevent CSRF

Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below. ...
Mark's user avatar
  • 333
12 votes
4 answers
4k views

What are the pros and cons of using sha256 to hash a password before passing it to bcrypt?

I recently became aware of the fact that bcrypt truncates passwords to 72 characters. Practically speaking my intuition is that this does not pose any major security problems. However, I understand ...
Dan Tao's user avatar
  • 281
3 votes
1 answer
1k views

Is Two-way SSL sufficient for Multiple web servers communicating to each other?

I have a fixed number of web servers. Each web server represents a company and the users of the company talk to their assigned web server. I have this setup to decentralise the databases. So if one ...
user1872507's user avatar
5 votes
1 answer
2k views

How to to make a file private by securing the url that only authenticated users can see

I was wondering if there is a way to secure an image or a file to be hidden when it is not authenticated. Suppose there is an image in my website which can only be seen if that user is authenticated. ...
Robin's user avatar
  • 153
5 votes
4 answers
741 views

Best way to store/retrieve sensitive key files?

We have our web servers running in AWS EC2. We have about 30 API Keys/passwords/etc (sensitive data) which is set in the environment for our app to use. Whenever we deploy, we start a new server ...
trikosuave's user avatar