We can't find the internet
Attempting to reconnect
Something went wrong!
Hang in there while we get back on track
Security Best Practices for Django Applications with Gajendra Deshpande - DjangoCon US 2022
Django security expert shares best practices for securing Django applications, covering vulnerabilities and testing tools.
- Security testing using tools like Mozilla Observatory
- Identifying common web vulnerabilities (broken access control, insecure deserialization, command injection, SQL injection)
- OAuth top 10 vulnerabilities for 2021, with 8 of 10 overlapping with Django
- Insecure deserialization, using trusted input only and validated XML data
- Access control issues (secure secret key, logging and monitoring)
- Command injection using homomorphic encryption (expensive in terms of computation)
- Stateful session identifiers to invalidate sessions
- Server-side request forgery (SSRF), validate URLs when fetching resources
- Weak authentication, enforcement of SSL, security misconfiguration, sensitive data processing and transmission
- Monitoring for potential exploits (Shodan and Django Hunter tools)
- Limitations on OWASP SAM model and Mozilla HTTP Observatory statistics