Philip James

Bio

Philip is a Senior Software Engineer at Eventbrite. In his spare time, he writes novels, makes twitter bots, and gives technical talks. He used to run a webcomic, but there's just no money in it, you know? Philip is a refugee from the video games industry, and wishes anyone still there the best of luck. Philip has spoken at conferences about Python, Django, Node.js, and Linux. Philip believes in the web.

Safe-ish By Default: The Django Security Model and How to Make it Better

Security, Intermediate

​

Description 

Come join us by the fire as we have Security Story Time with our friends, Frog and Toad. With them, you'll learn about all the things Django does to protect users and developers out of the box. We'll look at simplified code samples from the Django codebase to see what's happening under the hood, and cover how to make the Django security model even stronger in your application

​

Abstract

Introduction. Philip James, how long I’ve worked with Python and Django, background at EB
 

Introduction to the story, and the characters. Safe-ish: Talk about Django’s Security Model and how it tries to provide sane defaults for developers

Run-through of the parts of the django security model:

* XSS (brief definition). How do you turn it off? Mark Safe, | n, safe
* CSRF (brief definition). Django has middleware that checks POST requests for a token. Token is stored in cookie, also. Side-effect: harder to JS. Also, only an issue if you’re already owned, so maybe not an issue?. How to get around it? csrf_exempt
* SQLi (brief definition). Django’s ORM makes clean sql, (even when given bad data?). How? How to get around it: extra()/RawSQL()
* Clickjacking protection (brief definition). Django has middleware that sets headers browsers are supposed to respect. How to get around it: xframe_options_exempt, xframe_options_deny, xframe_options_sameorigin
* HTTPS. This one is less "out of the box" than the others, so won’t be talked about here.
* Host Header Validation (brief definition). Django verifies against allowed hosts in settings. How? get_host()
* Session security. What are django sessions?. Cookie-based by design. How can we make this better?
* Overall: Vigilance. Be aware of uses of this within your product
* HTTPS: Use it!. Set the correct settings. SECURE_SSL_REDIRECT: How does it work?

Other things

​