security - Coffee on the Keyboard

Open Source Update: Bleach

As of today, I transferred ownership of Bleach [https://github.com/mozilla/bleach] to the Mozilla organization, and the Mozilla WebDev team, in particular Will Kahn-Greene [http://bluesock.org/~willkg/] and Jannis Leidel [https://twitter.com/jezdez/], are taking over maintenance of it. Huge thanks to Will, Jannis and Chris

django

Mozilla's Security Best Practices

This list of resources is meant as a companion to the talk I gave at DjangoCon 2012, but it should stand on its own as a useful list for Django developers. Best Practices? What are “best practices,” anyway? The internet loves to debate these things. For us, think of it

django

Mass Assignment - Security Part 10

NB: This is the tenth post in a series [https://www.coffeeonthekeyboard.com/best-basic-security-practices-especially-with-django-697/] of posts on web application security. > “Mass assignment”? That’s a Rails [http://rubyonrails.org/] thing! GitHub [https://github.com/] was the recent, high-profile target of an “attack”—it wasn’t so much a vicious

django-nyc-security

Intermission

I sincerely hope to start the Advanced section of the security series [https://www.coffeeonthekeyboard.com/best-basic-security-practices-especially-with-django-697/] tomorrow or Wednesday, but it’s been a full and hectic weekend and I didn’t have as much time to write as I’d hoped. I still need to finish the first

django

Stay Up to Date - Basic Security Part 9

NB: This is the ninth post in a series [https://www.coffeeonthekeyboard.com/best-basic-security-practices-especially-with-django-697/] of posts on web application security. Rounding out this week is the last, but perhaps most important part of the basic security series: staying up to date. Keeping everything up-to-date is a pain. You have to

click-jacking

Click-Jacking and a little Phishing - Basic Security Part 8

NB: This is the eighth post in a series [https://www.coffeeonthekeyboard.com/best-basic-security-practices-especially-with-django-697/] of posts on web application security. Click-jacking is a process of “stealing” clicks on your site, redirecting them to other places, either by using an XSS vector [https://www.coffeeonthekeyboard.com/xss-cross-site-scripting-basic-security-part-2-711/] to replace the targets

django

Server Configuration - Basic Security Part 7

NB: This is the seventh post in a series [https://www.coffeeonthekeyboard.com/best-basic-security-practices-especially-with-django-697/] of posts on web application security. Configuring a server correctly is both 1) hard and 2) critical. You’ve probably spent a bunch of time configuring Apache [http://httpd.apache.org/] or nginx [http://nginx.org/

django

Session Fixation and Hijacking - Basic Security Part 6

NB: This is the sixth post in a series [https://www.coffeeonthekeyboard.com/best-basic-security-practices-especially-with-django-697/] of posts on web application security. 1. Don’t put session IDs in the URL. Django explicitly does not support [https://docs.djangoproject.com/en/dev/topics/http/sessions/#session-ids-in-urls] this because it’s just dangerous.

access control

Access Control - Basic Security Part 5

NB: This is the fifth post in a series [https://www.coffeeonthekeyboard.com/best-basic-security-practices-especially-with-django-697/] of posts on web application security. Proper access control is an absolutely key part of web app security and is easily overlooked—possibly because it’s so easy. In Django, to hide a link from someone,

django

Injections, SQL and otherwise - Basic Security Part 4

NB: This is the fourth post in a series [https://www.coffeeonthekeyboard.com/best-basic-security-practices-especially-with-django-697/] of posts on web application security. SQL Injection SQL injection is a vector that lets a user insert their own SQL into a statement sent to your database server. The typical example is: 1. "SELECT

csrf

CSRF: Cross-Site Request Forgeries - Basic Security Part 3

NB: This is the third post in a series [https://www.coffeeonthekeyboard.com/best-basic-security-practices-especially-with-django-697/] of posts on web application security. The quintessential example of a CSRF (sometimes pronounced “sea-surf”) is a bank that naively does transfers over a GET request without any other security: http://badbank.com/transfer?from=act1&

django

XSS: Cross-Site Scripting - Basic Security Part 2

NB: This is the second post in a series [https://www.coffeeonthekeyboard.com/best-basic-security-practices-especially-with-django-697/] of posts on web application security. XSS covers a number of various attacks, but the common thread is that someone gets to execute code in the context of your web page and domain. Doing that, they

django

Password Storage - Basic Security Part 1

NB-1: This is the first post in a series [https://www.coffeeonthekeyboard.com/best-basic-security-practices-especially-with-django-697/] of posts on web application security. NB-2: Fred [http://fredericiana.com/] wrote a great post on password storage [https://blog.mozilla.org/webdev/2012/06/08/lets-talk-about-password-storage/]. You should read it. I’m assuming we’re

django

Best Basic Security Practices (Especially with Django)

Or: Locking Your Doors This goes along with a talk I gave at Django-NYC [http://www.djangonyc.org/events/70626822/] in July 2012, but is meant to stand on its own. It is the first in a series of posts, because I realized it was too big for one. Security

django

Putting My Slides Where My Mouth Is

I’m giving a talk tonight [http://www.djangonyc.org/events/70626822/] at GetGlue [http://getglue.com/] on web app security, particularly with Django. Over the next several days—starting tonight—parts of that talk will be posted here as blog posts (I’ve realized there’s too much material

data

Bleach, HTML sanitizer and auto-linker

Bleach [http://github.com/jsocol/bleach] is a whitelist-based HTML sanitizer and auto-linker in Python, built on html5lib [http://code.google.com/p/html5lib/], for AMO [https://addons.mozilla.org/] and SUMO [http://support.mozilla.com/] and released under the BSD license. Bleach has two main functions: sanitizing HTML based

firefox

Upgrade Flash in Firefox

If you upgraded Firefox [http://www.mozilla.com/] lately, you might have seen a message on the start page urging you to upgrade Flash [http://www.mozilla.com/en-US/firefox/3.5.3/whatsnew/]. As of yesterday, something like 12 million people [http://blog.mozilla.com/metrics/2009/09/16/

Browsers

Stop Supporting IE6

As a community, as a whole, web designers and developers need to stop supporting Internet Explorer 6. Now. Completely. I’ve been thinking a lot about browser compatibility as I’ve been working on Today’s Meet [http://todaysmeet.com/]. My CSS is valid, but it doesn’t work quite

attack

Responsible SQL: How to Authenticate Users

Most SQL-injection articles set a horrible example for young programmers. Here is a very typical “bad example” of why you need to escape user data before it goes into SQL queries: (ed. The symbol « is a line break that’s not in the real code.) 1. $username = $_POST[‘username’]; // username=