An Introduction to Secure Web Development with Django (and Python!)

How to talk about security (and how not to)

Getting up again after you fall: a brief history of Django and security

There's no such thing as "secure"; you're always making tradeoffs and trying to stay a step or two ahead

Integrating thoughtful, informed security decisions as a necessary part of the development process

What sorts of things are we worried about?

Basic categories of security issues

• Unauthorized data accesss

• Arbitrary code execution (against you or your users)

• Denial-of-service

Rogues' gallery: a tour of the OWASP Top Ten list

• Injection attacks

• Authentication and session management

• Cross-site scripting

• Direct object references

• Misconfiguration

• Sensitive data exposure

• Function-level access control

• Cross-site request forgery

• Components with known vulnerabilities

• Unvalidated redirects and forwards

What can we do about it?

• The OWASP Top Ten, reprise: how to mitigate or avoid all ten in Django-based applications, including:

• Best practices for use of the ORM

• Approaches to authentication

• Django's built-in XSS protection

• Using Django's URL routing to avoid exposing object IDs

• Using the system check framework to identify issues before you go live

• How to safely store, or avoid storing, sensitive data

• Locking down your views with Django's authentication and permission system

• Using Django's anti-CSRF framework

• How to stay on top of your dependencies so they don't let you down: requires.io, hashed requirements and other tools

• Tools for avoiding and mitigating unsafe redirects in Django applications

Intermediate issues

The OWASP Top Ten is a good start, but...

The expanded rogues' gallery:

• SSL everywhere: using HTTP Strict Transport Security

• Keeping unwanted hands out of the cookie jar

• Don't get framed: how clickjacking works and how to stop it

• This smells bad: how to give content-sniffing attacks a stuffy nose

• How did that get there? Using Content Security Policy to help browsers help you

• Further topics in cross-domain data access (how to lock down Flash and Silverlight)

Security as a process

• Developing a security policy for your code (or company)

• Responsible handling and disclosure

• Thoughtfully packaging and distributing your code

Advanced topics

A spotter's guide to common patterns for DoS vectors

Cryptography and its discontents

• Using Django's crypto utilities in moderation

Reflections on trusting trust: how not to go overboard

Conclusion + Q&A