Securing Django Applications
summary
Penetration testing and automated scans target the OWASP Top 10 with concrete checks: run djcheckup.com to flag misconfigurations, use django hunter and Django Goat for vulnerable patterns, and query Shodan or dependency-check tools to find known-bad components. Concrete fixes include disabling DEBUG, rotating secret keys, enforcing TLS and HSTS, parameterizing raw SQL, adding django-otp / django-two-factor and django-user-sessions, encrypting fields with django-encrypted-model-fields or django-cryptography, and logging access-control failures.
AI-written summary · about
chapters (14)
- 0:00Django security intro
- 1:55Key Django security settings
- 3:19Injection attacks
- 5:47Broken authentication flaws
- 9:19Sensitive data exposure
- 12:54XML external entity attacks
- 16:05Broken access control fixes
- 18:15Security misconfigurations
- 20:03Cross-site scripting defense
- 22:31Insecure deserialization
- 24:16Dependency vulnerabilities
- 25:41Logging and monitoring
- 27:29Django security testing tools
- 28:30Summary and responsibility
related talks
48mPractical Django Secuirty
53mBuilding secure web apps: Python vs the OWASP Top 10
26mMaking Django Really, Really, Ridiculously Secure (CW)
26mOh, I Found a Security Issue
41mProduction Django: Building a Highly Scalable, Secure Django Site
27mHow to Start Security Testing Without Fear
27mPygoat - Learn django security the hard way with Adarsh Divakaran
27mAccount Security for the Fashionable App Developer