Building secure web apps: Python vs the OWASP Top 10
summary
Python web frameworks already block most OWASP Top 10 problems when used correctly: use an ORM or bind parameters to prevent SQL injection; template auto-escaping and input validation stop XSS; use bcrypt/passlib for password storage; enforce SSL and HSTS via Flask-SSLify or Django Secure and treat session/CSRF tokens as secrets. Access control and safe redirects require app-level checks. The surprising gap is dependency monitoring — components with vulnerabilities fail and the ecosystem lacks good, automated security-update signaling.
AI-written summary · about
chapters (16)
- 0:00Intro
- 3:03The OWASP Top 10
- 14:40Vulnerabilities in sessions/auth
- 15:25Man-in-the-middle attacks
- 15:54SSL ALL THE THINGS!
- 17:12Session security
- 21:52Preventing XSS
- 26:34Read the docs
- 26:49Have a deployment checklist
- 27:40Turn off debug mode!
- 29:08Password storage
- 31:55Handling access control
- 36:46Preventing CSRF
- 38:47Staying up-to-date
- 40:26Validating redirects/forwards
- 40:42The Top 10 vs Python
related talks
01h 00mWeb Application Security Risks: A Look at OWASP Top Ten 2017
29mSecuring Django Applications
53mOWASP Top 10: What are them and how to prevent them
02h 34mFundamentals of API security with Python
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
01h 02mUnderstanding the OWASP Top 10
23mWeb Application Security - owasp top 10 vulnerabilities
54mPython Security Best Practices Against Vulnerabilities