Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [django]

Django is a free and open source web application framework, written in Python, which follows the model–view–controller architectural pattern.

0
votes
2answers
377 views

Strange GET request to my web application

I developed a Django application for a school project and I hosted it on an EC2 instance to test and learn the environment. During inspection of the logs, I found the following GET request, "GET /...
1
vote
2answers
147 views

A computer on the public network I was using was penetrated at a codejam. Am I at risk?

I was at a code jam today for 12 hours. At the end of the day as I was leaving, one of the programmers claimed his computer was hit with a reverse shell attack. He was voicing this as I was ...
4
votes
2answers
2k views

What should I use for authentication for my Django Rest API?

I just read this article about why JWT's suck. I'm now uncertain what I should use for authentication. For context: The API I wrote is mainly used by mobile Apps (iOS and Android). In the future it ...
2
votes
1answer
87 views

What are the implications of removing SECURE_HSTS_INCLUDE_SUBDOMAINS = True with Django?

At the moment my django site's email confirmation links are not clickable for about 60 seconds. However, if I open them using right click open in new incognito window they work. I do have the ...
0
votes
2answers
161 views

Is it secure not to set a user in django admin?

Is it possible for someone to hack into my django admin app, if I do not create a user for it, by executing: python manage.py createsuperuser For example, is there a default username-password pair ...
0
votes
1answer
172 views

Getting a suspicious error in apache error.log (DJANGO)

Using django, I get the following error showing up in my apache errorlog: Invalid HTTP_HOST header: 'kyortisdzheykob.ru'. You may need to add u'kyortisdzheykob.ru' to ALLOWED_HOSTS. But I do not ...
1
vote
1answer
572 views

Django, ajax and HttpOnly cookies

While reading "Tangled web" I came across description of http only cookies and I wanted to try it out in my project, so I've added these settings according according to docs: CSRF_COOKIE_HTTPONLY = ...
3
votes
2answers
136 views

What are the implications of making Djangos SECRET_KEY public?

I know the SECRET_KEY for a website made in Django. The owner of the site has accidentally made the settings.py public. What are the implications of making SECRET_KEY public? How can someone use ...
0
votes
1answer
287 views

django-python3-ldap Does TLS Encrypt AD Passwords When Site is Hosted on http

I have implemented django-python3-ldap and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am deciding between using this ...
42
votes
4answers
10k views

Does a CSRF cookie need to be HttpOnly?

We've recently were handed a security report containing the: Cookie(s) without HttpOnly flag set vulnerability, which we apparently had in one of our internal applications. The applied fix was as ...
2
votes
1answer
175 views

What does `&==;` mean with regard to Python Django and bypassing WAFs?

I'm reading someone's slides on bypassing WAFs. &==; : Python Django between parameters; FooBar==POST verb : Apache with PHP; <%I%M%U011e>==<IMG> : IIS ASP Classic; ;/path1 ...
1
vote
1answer
354 views

Proxy not rejecting illegal host header when coming from my VM provider's network

I have a django app hosted on a linode VM, proxied by nginx on that same VM. In my nginx config I have a block to deny bad host header requests: ## Deny illegal Host headers if ($host !~* ^(mydomain....
1
vote
0answers
144 views

Safe to have specific RESTful API endpoint without CSRF tokens?

I have a RESTful API. There are two ways to authenticate to it: a user/password-centric model, and OAuth2. Although user/password-authenticated users can make requests to this specific API endpoint, ...
1
vote
1answer
433 views

Heroku postgres: potential brute force attack

I have a Django app running on Heroku using Heroku Postgres. I was looking at the latest log (something I don't do very often) and something strange caught my eye. There were all these fatal database ...
0
votes
1answer
173 views

Django and Mindspark

I have a Django based website that collects data using forms. All users have to login to access the forms. Today I saw a strange error where a user submitted a form with a combination of form values ...
0
votes
1answer
37 views

What L7 traffic patterns can make it easier DoS an Apache web server?

We have a single JMeter HTTP load generator that we use to capacity test our web service (running Django + mod-wsgi + Apache)? If we want to modify the traffic generated to DoS our web service, what ...
8
votes
3answers
354 views

Proving the need to upgrade Django

The Story: In one of our projects, we are using Django web framework. But, we are currently stuck at 1.6.11 (mainly because in 1.7 Python 2.6 support was dropped - we are working on it, but it's ...
1
vote
2answers
438 views

Is it bad to give www-data user access to Postgres client certificate?

I have a first server running a Postgres database. I have allowed remote access to this database, using certificates for authentification (following this tutorial). Now I have a second server running ...
3
votes
1answer
1k views

Nginx forwarding undesired hosts to Django

I've been getting errors from Django on my webserver (behind Nginx/uWSGI) complaining that it's being accessed with a request where the Host is the IP address of the server. Nginx is using virtual ...
5
votes
1answer
224 views

BREACH attack vs filtered reflected user input

I am in charge of the applicative security of our application and would like to test our exposure to the BREACH attack. Our django-based web application reflects filtered user-input and serves a CSRF ...
4
votes
1answer
2k views

Sending a token with a request from one app to another

Say I have an application written in some language and framework (Python + flask, for instance), and have a great deal of the functionality requiring login, and authentication via JWT. Now I want to ...
3
votes
1answer
172 views

How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off?

I've been writing a Django app and almost published it with debug mode on. Django's documentation indicates Never deploy a site into production with DEBUG turned on. Did you catch that? NEVER ...
1
vote
2answers
526 views

Is this sanitizer vulnerable to XSS?

To have a simple and secure editor for text fields of a django app, I have this snippet to sanitize input HTML into django code: from bs4 import BeautifulSoup def sanitize_html(value): ...
2
votes
1answer
251 views

How to make the most secure text editor in Django?

As a follow up to this question, I'm wondering what is the most secure way (using either markup or markdown) to allow users to format their inputs and upload images in a Django app? I'm not asking ...
1
vote
2answers
323 views

Should I invest my time in making my site HTTPS-only?

I'm building a Django website that does not need to have registration/authentication. The only sensitive part is a form with a reCaptcha v2. Of course I'm embedding the CSRF token, which then I read ...
3
votes
2answers
209 views

Securely saving credentials for later plain-text authentication

I am developing a Django application where a user logs in with Kerberos, and then has accesses to a number of internal applications. One of these is a file application that connects to a server over ...
8
votes
2answers
4k views

Why is referer checking needed for Django to prevent CSRF

Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below. ...
12
votes
3answers
2k views

What are the pros and cons of using sha256 to hash a password before passing it to bcrypt?

I recently became aware of the fact that bcrypt truncates passwords to 72 characters. Practically speaking my intuition is that this does not pose any major security problems. However, I understand ...
3
votes
1answer
1k views

Is Two-way SSL sufficient for Multiple web servers communicating to each other?

I have a fixed number of web servers. Each web server represents a company and the users of the company talk to their assigned web server. I have this setup to decentralise the databases. So if one ...
5
votes
1answer
940 views

How to to make a file private by securing the url that only authenticated users can see

I was wondering if there is a way to secure an image or a file to be hidden when it is not authenticated. Suppose there is an image in my website which can only be seen if that user is authenticated. ...
5
votes
4answers
583 views

Best way to store/retrieve sensitive key files?

We have our web servers running in AWS EC2. We have about 30 API Keys/passwords/etc (sensitive data) which is set in the environment for our app to use. Whenever we deploy, we start a new server ...
7
votes
2answers
2k views

Is Django vulnerable to shellshock?

Does the recent shellshock vulnerability in bash affect stock Django? Assume any of the production setups listed on the Django site are used (gunicorn, wsgi, nginx). If not, are there any commonly ...
22
votes
1answer
12k views

Django SECRET_KEY security, how are methods more secure

I am nearing a point where I will deploy my Django application to the hostile environment otherwise known as "the internet" and I'm trying to better understand the ramifications of the Django ...
3
votes
4answers
3k views

How is this XSS attack working?

SPOILER ALERT: This question contains an answer to one of the problems from the Google's XSS Challenge! Please stop reading further if you're not interested in knowing the answer right now. I'm able ...
3
votes
1answer
816 views

Protecting <a href='{{ my_model.some_url }}'> in Django

In my Django template, I have a link like this: <a href='{{ my_model.some_url }}'> The some_url bit is a Django URLField that a user can influence. Can this be exploited in any way? (What ...
47
votes
1answer
21k views

Is Django's built-in security enough?

I have learned that Django provides built-in protection against the three main types of web app attacks (SQL injection, XSS and CSRF), which is really awesome. Yet I have spoken to a few Django ...