Questions tagged [django]
Django is a free and open source web application framework, written in Python, which follows the model–view–controller architectural pattern.
56
questions
0
votes
0
answers
43
views
Why famouse frameworks like django (And probably Rails) use both synchronizer pattern and Origin/Referer header checks for preventing CSRF attacks?
I see in the source code of Django that they do use both synchronizer token pattern and Origin/Referer header checks. I understand that if you are using the double-submit technique via cookie the ...
2
votes
2
answers
615
views
How to access CSRF token in fronted when API is on different domain?
I am building a website with a separate Javascript frontend and a Django backend. My backend uses CSRF protection.
Now the problem is that the CSRF token is being set on the client side as a cookie on ...
- 23
0
votes
0
answers
54
views
Which is more secure and better practice? Setting up a reverse proxy on backend with localhost or on a separate VM and route to other VMs/services?
I wanna know if it's better in terms of security, availability and best practice to set up a nginx reverse proxy on my backend and use it with localhost or to set up a VM that handles everything for ...
0
votes
0
answers
76
views
How to secure an API end point when using javascipt
I'm struggling to understand how one can secure an API endpoint using JavaScript.
I want to create a copy and paste-able snippet of Javascript that a user can paste in their site. And on page load/s ...
0
votes
1
answer
255
views
Should email password be encrypted in a django app when using TLS?
I have seen multiple videos/tutorials regarding how to setup the email system in Django.
It seems that they all assume as long as the password is stored in an environmental variable, no encryption is ...
- 101
0
votes
1
answer
481
views
Django File Validation
I' m building a REST API with Django and Django Rest Framework. I allow users to upload images and videos using different subclasses of ModelSerializer. When a file is received, the server saves it to ...
- 116
0
votes
2
answers
764
views
Is there any reason to block HEAD requests?
Apologies if this isn't the right place to ask this. I occasionally get alerts from my Django website along these lines:
Internal Server Error: /posts/specific-post/
UnboundLocalError at /posts/...
- 103
11
votes
3
answers
4k
views
Concerning GET request in logs
I have a Django application running on a Digital Ocean Ubuntu server. I am using NGINX and Daphne to serve the application because I am using Django Channels.
My websockets keep crashing, and I ...
- 213
0
votes
1
answer
181
views
2FA with blower.io SMS
I'm currently planning to deploy a project on Heroku and was wondering if it is safe to send 2FA sms messages with the blower.io heroku addon?
Also is it safe/ok to send a short lived authentication ...
- 101
1
vote
1
answer
157
views
Letting users to download data from my Django app
I want to provide a way for my users to download their data, which are stored in S3, through my app. Should I provide them with a public url followed by a key random key, as in this example?
http://s3....
- 11
0
votes
0
answers
347
views
How can you fingerprint a Django web app?
In order to better protect my Django web app, I want to reduce the leakage of information that could help an attacker profile my application. If you were an attacker, what would you look at to ...
- 931
1
vote
1
answer
691
views
Ways to exploit a form action value when it s reflected from URI on React-Django
I am working on a security testing project, where I have noticed that the form action of a login page takes whatever is fed to URI as a parameter, the respective part of the login page is as follows:
...
- 11
0
votes
1
answer
756
views
Is sending token authentication information via cookie headers secure?
I am by no means a security engineer , and I have barely started my journey as a web developer. I'm utilizing a Python package known as Django for my backend and react.js for my front end. Recently I ...
- 101
4
votes
1
answer
518
views
Is it safe to create a session from an auth token?
My server is using Django Rest Framework. My mobile app logs in using token authentication. However, I also have a webview in the mobile app where I need to log in. I can't inject the auth token on ...
- 1,236
1
vote
0
answers
137
views
VPN as a temporary layer of security?
I have a startup working on Django app, that will be processing sensitive personal and financial information. We're just finalizing a prototype of the product (no paying clients, no investors), so we'...
- 11
2
votes
1
answer
389
views
Is <meta> http-equiv secure?
I'd like to redirect a visitor to the login page if he's not authenticated and she/he wants to access a protected page.
I can handle this via the backend code, but it's easier to make it using HTML. ...
- 181
1
vote
1
answer
1k
views
URL query string params Django security
I am new to Django and I am working on a website, where you can filter some articles using a normal GET url query string param. Theese params can be made from some input fields. I have found two ...
- 13
3
votes
4
answers
3k
views
Is sending a cookie with a sessionid in every HTTP response considered a bad practice?
My Django application sets a set-cookie: sessionid=xxxx; expires=Thu, 16-May-2019 18:54:59 (and some more, like max-age and path) on every response. The sessionid remains the same until the session ...
- 131
0
votes
1
answer
2k
views
Django admin site privilege escalation
Last night, I read a PDF detailing a privilege escalation attack a researcher had performed on a Django admin site. I'm curious- was the unfortunate application susceptible to this attack due to a ...
2
votes
0
answers
614
views
Malicious PNG (html with png header)
I found following security notice on Django website:
Django’s media upload handling poses some vulnerabilities when that media is served in ways that do not follow security best practices. ...
- 121
3
votes
2
answers
3k
views
Strange GET request to my web application
I developed a Django application for a school project and I hosted it on an EC2 instance to test and learn the environment.
During inspection of the logs, I found the following GET request,
"GET /...
- 133
1
vote
2
answers
211
views
A computer on the public network I was using was penetrated at a codejam. Am I at risk?
I was at a code jam today for 12 hours. At the end of the day as I was leaving, one of the programmers claimed his computer was hit with a reverse shell attack. He was voicing this as I was ...
- 15
6
votes
2
answers
5k
views
What should I use for authentication for my Django Rest API?
I just read this article about why JWT's suck. I'm now uncertain what I should use for authentication.
For context: The API I wrote is mainly used by mobile Apps (iOS and Android). In the future it ...
- 163
2
votes
1
answer
355
views
What are the implications of removing SECURE_HSTS_INCLUDE_SUBDOMAINS = True with Django?
At the moment my django site's email confirmation links are not clickable for about 60 seconds. However, if I open them using right click open in new incognito window they work.
I do have the ...
- 23
0
votes
2
answers
784
views
Is it secure not to set a user in django admin?
Is it possible for someone to hack into my django admin app, if I do not create a user for it, by executing:
python manage.py createsuperuser
For example, is there a default username-password pair ...
- 425
1
vote
1
answer
552
views
Getting a suspicious error in apache error.log (DJANGO)
Using django, I get the following error showing up in my apache errorlog:
Invalid HTTP_HOST header: 'kyortisdzheykob.ru'. You may need to add u'kyortisdzheykob.ru' to ALLOWED_HOSTS.
But I do not ...
2
votes
1
answer
2k
views
Django, ajax and HttpOnly cookies
While reading "Tangled web" I came across description of http only cookies and I wanted to try it out in my project, so I've added these settings according according to docs:
CSRF_COOKIE_HTTPONLY = ...
- 123
4
votes
2
answers
521
views
What are the implications of making Djangos SECRET_KEY public?
I know the SECRET_KEY for a website made in Django. The owner of the site has accidentally made the settings.py public.
What are the implications of making SECRET_KEY public? How can someone use ...
- 141
0
votes
1
answer
679
views
django-python3-ldap Does TLS Encrypt AD Passwords When Site is Hosted on http
I have implemented django-python3-ldap and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am deciding between using this ...
88
votes
7
answers
56k
views
Does a CSRF cookie need to be HttpOnly?
We were recently handed a security report containing the following:
Cookie(s) without HttpOnly flag set
vulnerability, which we apparently had in one of our internal applications.
The applied fix ...
- 1,565
2
votes
1
answer
244
views
What does `&==;` mean with regard to Python Django and bypassing WAFs?
I'm reading someone's slides on bypassing WAFs.
&==; : Python Django between parameters;
FooBar==POST verb : Apache with PHP;
<%I%M%U011e>==<IMG> : IIS ASP Classic;
;/path1 ...
- 1,745
1
vote
1
answer
837
views
Proxy not rejecting illegal host header when coming from my VM provider's network
I have a django app hosted on a linode VM, proxied by nginx on that same VM.
In my nginx config I have a block to deny bad host header requests:
## Deny illegal Host headers
if ($host !~* ^(mydomain....
- 603
1
vote
0
answers
210
views
Safe to have specific RESTful API endpoint without CSRF tokens?
I have a RESTful API. There are two ways to authenticate to it: a user/password-centric model, and OAuth2.
Although user/password-authenticated users can make requests to this specific API endpoint, ...
- 143
2
votes
1
answer
1k
views
Heroku postgres: potential brute force attack
I have a Django app running on Heroku using Heroku Postgres.
I was looking at the latest log (something I don't do very often) and something strange caught my eye. There were all these fatal database ...
- 465
0
votes
1
answer
248
views
Django and Mindspark
I have a Django based website that collects data using forms. All users have to login to access the forms.
Today I saw a strange error where a user submitted a form with a combination of form values ...
- 103
0
votes
1
answer
75
views
What L7 traffic patterns can make it easier DoS an Apache web server?
We have a single JMeter HTTP load generator that we use to capacity test our web service (running Django + mod-wsgi + Apache)? If we want to modify the traffic generated to DoS our web service, what ...
- 3,936
8
votes
3
answers
476
views
Proving the need to upgrade Django
The Story:
In one of our projects, we are using Django web framework. But, we are currently stuck at 1.6.11 (mainly because in 1.7 Python 2.6 support was dropped - we are working on it, but it's ...
- 1,565
1
vote
2
answers
898
views
Is it bad to give www-data user access to Postgres client certificate?
I have a first server running a Postgres database.
I have allowed remote access to this database, using certificates for authentification (following this tutorial).
Now I have a second server running ...
- 113
3
votes
1
answer
2k
views
Nginx forwarding undesired hosts to Django
I've been getting errors from Django on my webserver (behind Nginx/uWSGI) complaining that it's being accessed with a request where the Host is the IP address of the server. Nginx is using virtual ...
- 3,392
4
votes
1
answer
370
views
BREACH attack vs filtered reflected user input
I am in charge of the applicative security of our application and would like to test our exposure to the BREACH attack.
Our django-based web application reflects filtered user-input and serves a CSRF ...
4
votes
1
answer
5k
views
Sending a token with a request from one app to another
Say I have an application written in some language and framework (Python + flask, for instance), and have a great deal of the functionality requiring login, and authentication via JWT.
Now I want to ...
- 143
4
votes
1
answer
1k
views
How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off?
I've been writing a Django app and almost published it with debug mode on. Django's documentation indicates
Never deploy a site into production with DEBUG turned on.
Did you catch that? NEVER deploy ...
- 1,236
1
vote
2
answers
688
views
Is this sanitizer vulnerable to XSS?
To have a simple and secure editor for text fields of a django app, I have this snippet to sanitize input HTML into django code:
from bs4 import BeautifulSoup
def sanitize_html(value):
...
- 213
2
votes
1
answer
407
views
How to make the most secure text editor in Django?
As a follow up to this question, I'm wondering what is the most secure way (using either markup or markdown) to allow users to format their inputs and upload images in a Django app?
I'm not asking ...
- 213
1
vote
2
answers
372
views
Should I invest my time in making my site HTTPS-only?
I'm building a Django website that does not need to have registration/authentication.
The only sensitive part is a form with a reCaptcha v2. Of course I'm embedding the CSRF token, which then I read ...
- 175
3
votes
2
answers
246
views
Securely saving credentials for later plain-text authentication
I am developing a Django application where a user logs in with Kerberos, and then has accesses to a number of internal applications.
One of these is a file application that connects to a server over ...
- 31
19
votes
2
answers
8k
views
Why is referer checking needed for Django to prevent CSRF
Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below.
...
- 333
12
votes
4
answers
4k
views
What are the pros and cons of using sha256 to hash a password before passing it to bcrypt?
I recently became aware of the fact that bcrypt truncates passwords to 72 characters. Practically speaking my intuition is that this does not pose any major security problems. However, I understand ...
- 281
3
votes
1
answer
1k
views
Is Two-way SSL sufficient for Multiple web servers communicating to each other?
I have a fixed number of web servers. Each web server represents a company and the users of the company talk to their assigned web server. I have this setup to decentralise the databases. So if one ...
- 31
5
votes
1
answer
1k
views
How to to make a file private by securing the url that only authenticated users can see
I was wondering if there is a way to secure an image or a file to be hidden when it is not authenticated.
Suppose there is an image in my website which can only be seen if that user is authenticated. ...
- 153