Questions tagged [django]

Django is a free and open source web application framework, written in Python, which follows the model–view–controller architectural pattern.

Filter by
Sorted by
Tagged with
0 votes
0 answers
43 views

Why famouse frameworks like django (And probably Rails) use both synchronizer pattern and Origin/Referer header checks for preventing CSRF attacks?

I see in the source code of Django that they do use both synchronizer token pattern and Origin/Referer header checks. I understand that if you are using the double-submit technique via cookie the ...
2 votes
2 answers
615 views

How to access CSRF token in fronted when API is on different domain?

I am building a website with a separate Javascript frontend and a Django backend. My backend uses CSRF protection. Now the problem is that the CSRF token is being set on the client side as a cookie on ...
  • 23
0 votes
0 answers
54 views

Which is more secure and better practice? Setting up a reverse proxy on backend with localhost or on a separate VM and route to other VMs/services?

I wanna know if it's better in terms of security, availability and best practice to set up a nginx reverse proxy on my backend and use it with localhost or to set up a VM that handles everything for ...
0 votes
0 answers
76 views

How to secure an API end point when using javascipt

I'm struggling to understand how one can secure an API endpoint using JavaScript. I want to create a copy and paste-able snippet of Javascript that a user can paste in their site. And on page load/s ...
0 votes
1 answer
255 views

Should email password be encrypted in a django app when using TLS?

I have seen multiple videos/tutorials regarding how to setup the email system in Django. It seems that they all assume as long as the password is stored in an environmental variable, no encryption is ...
0 votes
1 answer
481 views

Django File Validation

I' m building a REST API with Django and Django Rest Framework. I allow users to upload images and videos using different subclasses of ModelSerializer. When a file is received, the server saves it to ...
0 votes
2 answers
764 views

Is there any reason to block HEAD requests?

Apologies if this isn't the right place to ask this. I occasionally get alerts from my Django website along these lines: Internal Server Error: /posts/specific-post/ UnboundLocalError at /posts/...
  • 103
11 votes
3 answers
4k views

Concerning GET request in logs

I have a Django application running on a Digital Ocean Ubuntu server. I am using NGINX and Daphne to serve the application because I am using Django Channels. My websockets keep crashing, and I ...
  • 213
0 votes
1 answer
181 views

2FA with blower.io SMS

I'm currently planning to deploy a project on Heroku and was wondering if it is safe to send 2FA sms messages with the blower.io heroku addon? Also is it safe/ok to send a short lived authentication ...
  • 101
1 vote
1 answer
157 views

Letting users to download data from my Django app

I want to provide a way for my users to download their data, which are stored in S3, through my app. Should I provide them with a public url followed by a key random key, as in this example? http://s3....
  • 11
0 votes
0 answers
347 views

How can you fingerprint a Django web app?

In order to better protect my Django web app, I want to reduce the leakage of information that could help an attacker profile my application. If you were an attacker, what would you look at to ...
1 vote
1 answer
691 views

Ways to exploit a form action value when it s reflected from URI on React-Django

I am working on a security testing project, where I have noticed that the form action of a login page takes whatever is fed to URI as a parameter, the respective part of the login page is as follows: ...
  • 11
0 votes
1 answer
756 views

Is sending token authentication information via cookie headers secure?

I am by no means a security engineer , and I have barely started my journey as a web developer. I'm utilizing a Python package known as Django for my backend and react.js for my front end. Recently I ...
4 votes
1 answer
518 views

Is it safe to create a session from an auth token?

My server is using Django Rest Framework. My mobile app logs in using token authentication. However, I also have a webview in the mobile app where I need to log in. I can't inject the auth token on ...
  • 1,236
1 vote
0 answers
137 views

VPN as a temporary layer of security?

I have a startup working on Django app, that will be processing sensitive personal and financial information. We're just finalizing a prototype of the product (no paying clients, no investors), so we'...
  • 11
2 votes
1 answer
389 views

Is <meta> http-equiv secure?

I'd like to redirect a visitor to the login page if he's not authenticated and she/he wants to access a protected page. I can handle this via the backend code, but it's easier to make it using HTML. ...
  • 181
1 vote
1 answer
1k views

URL query string params Django security

I am new to Django and I am working on a website, where you can filter some articles using a normal GET url query string param. Theese params can be made from some input fields. I have found two ...
3 votes
4 answers
3k views

Is sending a cookie with a sessionid in every HTTP response considered a bad practice?

My Django application sets a set-cookie: sessionid=xxxx; expires=Thu, 16-May-2019 18:54:59 (and some more, like max-age and path) on every response. The sessionid remains the same until the session ...
  • 131
0 votes
1 answer
2k views

Django admin site privilege escalation

Last night, I read a PDF detailing a privilege escalation attack a researcher had performed on a Django admin site. I'm curious- was the unfortunate application susceptible to this attack due to a ...
2 votes
0 answers
614 views

Malicious PNG (html with png header)

I found following security notice on Django website: Django’s media upload handling poses some vulnerabilities when that media is served in ways that do not follow security best practices. ...
3 votes
2 answers
3k views

Strange GET request to my web application

I developed a Django application for a school project and I hosted it on an EC2 instance to test and learn the environment. During inspection of the logs, I found the following GET request, "GET /...
1 vote
2 answers
211 views

A computer on the public network I was using was penetrated at a codejam. Am I at risk?

I was at a code jam today for 12 hours. At the end of the day as I was leaving, one of the programmers claimed his computer was hit with a reverse shell attack. He was voicing this as I was ...
  • 15
6 votes
2 answers
5k views

What should I use for authentication for my Django Rest API?

I just read this article about why JWT's suck. I'm now uncertain what I should use for authentication. For context: The API I wrote is mainly used by mobile Apps (iOS and Android). In the future it ...
2 votes
1 answer
355 views

What are the implications of removing SECURE_HSTS_INCLUDE_SUBDOMAINS = True with Django?

At the moment my django site's email confirmation links are not clickable for about 60 seconds. However, if I open them using right click open in new incognito window they work. I do have the ...
0 votes
2 answers
784 views

Is it secure not to set a user in django admin?

Is it possible for someone to hack into my django admin app, if I do not create a user for it, by executing: python manage.py createsuperuser For example, is there a default username-password pair ...
  • 425
1 vote
1 answer
552 views

Getting a suspicious error in apache error.log (DJANGO)

Using django, I get the following error showing up in my apache errorlog: Invalid HTTP_HOST header: 'kyortisdzheykob.ru'. You may need to add u'kyortisdzheykob.ru' to ALLOWED_HOSTS. But I do not ...
2 votes
1 answer
2k views

Django, ajax and HttpOnly cookies

While reading "Tangled web" I came across description of http only cookies and I wanted to try it out in my project, so I've added these settings according according to docs: CSRF_COOKIE_HTTPONLY = ...
  • 123
4 votes
2 answers
521 views

What are the implications of making Djangos SECRET_KEY public?

I know the SECRET_KEY for a website made in Django. The owner of the site has accidentally made the settings.py public. What are the implications of making SECRET_KEY public? How can someone use ...
0 votes
1 answer
679 views

django-python3-ldap Does TLS Encrypt AD Passwords When Site is Hosted on http

I have implemented django-python3-ldap and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am deciding between using this ...
88 votes
7 answers
56k views

Does a CSRF cookie need to be HttpOnly?

We were recently handed a security report containing the following: Cookie(s) without HttpOnly flag set vulnerability, which we apparently had in one of our internal applications. The applied fix ...
  • 1,565
2 votes
1 answer
244 views

What does `&==;` mean with regard to Python Django and bypassing WAFs?

I'm reading someone's slides on bypassing WAFs. &==; : Python Django between parameters; FooBar==POST verb : Apache with PHP; <%I%M%U011e>==<IMG> : IIS ASP Classic; ;/path1 ...
  • 1,745
1 vote
1 answer
837 views

Proxy not rejecting illegal host header when coming from my VM provider's network

I have a django app hosted on a linode VM, proxied by nginx on that same VM. In my nginx config I have a block to deny bad host header requests: ## Deny illegal Host headers if ($host !~* ^(mydomain....
  • 603
1 vote
0 answers
210 views

Safe to have specific RESTful API endpoint without CSRF tokens?

I have a RESTful API. There are two ways to authenticate to it: a user/password-centric model, and OAuth2. Although user/password-authenticated users can make requests to this specific API endpoint, ...
2 votes
1 answer
1k views

Heroku postgres: potential brute force attack

I have a Django app running on Heroku using Heroku Postgres. I was looking at the latest log (something I don't do very often) and something strange caught my eye. There were all these fatal database ...
  • 465
0 votes
1 answer
248 views

Django and Mindspark

I have a Django based website that collects data using forms. All users have to login to access the forms. Today I saw a strange error where a user submitted a form with a combination of form values ...
  • 103
0 votes
1 answer
75 views

What L7 traffic patterns can make it easier DoS an Apache web server?

We have a single JMeter HTTP load generator that we use to capacity test our web service (running Django + mod-wsgi + Apache)? If we want to modify the traffic generated to DoS our web service, what ...
  • 3,936
8 votes
3 answers
476 views

Proving the need to upgrade Django

The Story: In one of our projects, we are using Django web framework. But, we are currently stuck at 1.6.11 (mainly because in 1.7 Python 2.6 support was dropped - we are working on it, but it's ...
  • 1,565
1 vote
2 answers
898 views

Is it bad to give www-data user access to Postgres client certificate?

I have a first server running a Postgres database. I have allowed remote access to this database, using certificates for authentification (following this tutorial). Now I have a second server running ...
3 votes
1 answer
2k views

Nginx forwarding undesired hosts to Django

I've been getting errors from Django on my webserver (behind Nginx/uWSGI) complaining that it's being accessed with a request where the Host is the IP address of the server. Nginx is using virtual ...
  • 3,392
4 votes
1 answer
370 views

BREACH attack vs filtered reflected user input

I am in charge of the applicative security of our application and would like to test our exposure to the BREACH attack. Our django-based web application reflects filtered user-input and serves a CSRF ...
4 votes
1 answer
5k views

Sending a token with a request from one app to another

Say I have an application written in some language and framework (Python + flask, for instance), and have a great deal of the functionality requiring login, and authentication via JWT. Now I want to ...
  • 143
4 votes
1 answer
1k views

How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off?

I've been writing a Django app and almost published it with debug mode on. Django's documentation indicates Never deploy a site into production with DEBUG turned on. Did you catch that? NEVER deploy ...
  • 1,236
1 vote
2 answers
688 views

Is this sanitizer vulnerable to XSS?

To have a simple and secure editor for text fields of a django app, I have this snippet to sanitize input HTML into django code: from bs4 import BeautifulSoup def sanitize_html(value): ...
  • 213
2 votes
1 answer
407 views

How to make the most secure text editor in Django?

As a follow up to this question, I'm wondering what is the most secure way (using either markup or markdown) to allow users to format their inputs and upload images in a Django app? I'm not asking ...
  • 213
1 vote
2 answers
372 views

Should I invest my time in making my site HTTPS-only?

I'm building a Django website that does not need to have registration/authentication. The only sensitive part is a form with a reCaptcha v2. Of course I'm embedding the CSRF token, which then I read ...
  • 175
3 votes
2 answers
246 views

Securely saving credentials for later plain-text authentication

I am developing a Django application where a user logs in with Kerberos, and then has accesses to a number of internal applications. One of these is a file application that connects to a server over ...
  • 31
19 votes
2 answers
8k views

Why is referer checking needed for Django to prevent CSRF

Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below. ...
  • 333
12 votes
4 answers
4k views

What are the pros and cons of using sha256 to hash a password before passing it to bcrypt?

I recently became aware of the fact that bcrypt truncates passwords to 72 characters. Practically speaking my intuition is that this does not pose any major security problems. However, I understand ...
  • 281
3 votes
1 answer
1k views

Is Two-way SSL sufficient for Multiple web servers communicating to each other?

I have a fixed number of web servers. Each web server represents a company and the users of the company talk to their assigned web server. I have this setup to decentralise the databases. So if one ...
5 votes
1 answer
1k views

How to to make a file private by securing the url that only authenticated users can see

I was wondering if there is a way to secure an image or a file to be hidden when it is not authenticated. Suppose there is an image in my website which can only be seen if that user is authenticated. ...
  • 153