Practical Django Secuirty
summary
Advocates asserting and validating every input, marking data explicitly so SQL and XSS engines treat it as data not code, and using proven libraries rather than homegrown crypto. Recommends PBKDF2 -> 100000 iterations (upgrade from 10k), use Django Signer or HMAC instead of DIY, prefer UUID4 not ad hoc hashes for identifiers, and use login_required in urls.py with class based view mixins for object ownership checks. Mentions burp suite and WebGoat for testing, django-encrypted-fields for field encryption, and always disable DEBUG in production.
AI-written summary · about
chapters (12)
- 0:00Start
- 1:32Software Security Is Hard!
- 2:34Making Security Simple
- 3:51A New Approach To Software Security
- 4:49Mixing Up Data and Code
- 5:54Wait... WHAT!!?!!
- 7:14Improperly Implemented Security Controls
- 14:07DRY Security Controls
- 16:35When Using Model Forms
- 20:49Yan's Hash Rule
- 24:07Last minute thoughts...
- 26:35Questions?
related talks
26mMaking Django Really, Really, Ridiculously Secure (CW)
29mSecuring Django Applications
54mPython Security Best Practices Against Vulnerabilities
37mFrog and Toad Learn About Django Security
27mAccount Security for the Fashionable App Developer
31mhunter2: A Symphony of Password Horror
26mOh, I Found a Security Issue
58mTaking the pain out of passwords and authentication