Security Best Practices for Django Applications with Gajendra Deshpande - DjangoCon US 2022

Django Testing Security

Django security expert shares best practices for securing Django applications, covering vulnerabilities and testing tools.

Key takeaways

Security testing using tools like Mozilla Observatory
Identifying common web vulnerabilities (broken access control, insecure deserialization, command injection, SQL injection)
OAuth top 10 vulnerabilities for 2021, with 8 of 10 overlapping with Django
Insecure deserialization, using trusted input only and validated XML data
Access control issues (secure secret key, logging and monitoring)
Command injection using homomorphic encryption (expensive in terms of computation)
Stateful session identifiers to invalidate sessions
Server-side request forgery (SSRF), validate URLs when fetching resources
Weak authentication, enforcement of SSL, security misconfiguration, sensitive data processing and transmission
Monitoring for potential exploits (Shodan and Django Hunter tools)
Limitations on OWASP SAM model and Mozilla HTTP Observatory statistics

More talks