Full Stack Python

# Web Application Security

Website security must be thought about while building every level of the web stack. However, this section includes topics that deserve particular treatment, such as cross-site scripting (XSS), SQL injection, cross-site request forgery and usage of public-private keypairs.

## Security open source projects

- Bro is a network security and traffic monitor.

- quick NIX secure script for securing Linux distributions.

## HTTPS resources

- How does HTTPS actually work? is a well-written overview of the protocol including certificates, signatures, signing and related topics.

- This question asking what is the difference between TLS and SSL? explains that TLS is a newer version of SSL and should be used because SSL through version 3.0 is insecure.

- If you're having users submit sensitive information to your site you need to use SSL/TLS. Anything before TLS is now insecure. Check out this handy guide that goes over some of the nuances of the subject.

- The Sorry State of SSL details the history and evolution of SSL/TLS. There are important differences between the versions and Hynek explains why TLS should always be used. The talk prompted work to improve Python's SSL in 2.7.9 based on the upgrades in Python 3 outlined in The not-so-sorry state of SSL in Python.

- How HTTPS Secures Connections is a guide for what HTTPS does and does not secure against.

- When and How to Deploy HTTPS

- The first few milliseconds of an HTTPS connection provides a detailed look at the SSL handshake process that is implemented by browsers based on the RFC 2818 specification.

- Qualy SSL Server Test can be used to determine what's in place and what is missing for your server's HTTPS connection. Once you run the test read this article on Getting an A+ on Qualy's SSL Labs Tester to improve your situation.

## General security resources

- The Open Web Application Security Project (OWASP) has cheat sheets for security topics.

- This page contains a fantastic currated list of security reading material from beginning to advanced topics.

- The /r/netsec subreddit is one place to go to learn more about network and application security.

- Hacking Tools Repository is a great list of password cracking, scanning, sniffing and other security penetration testing tools.

- Securing an Ubuntu Server

- Securing Ubuntu

- Security Tips from Apache

- Securing a Linux Server

- The EFF has a well written overview on what makes a good security audit. It's broad but contains some of their behind the scenes thinking on important considerations with security audits.

- Securing Your Website

- Crypto 101 is an introductory course on cryptography for programmers.

- An in-depth analysis of SSH attacks on Amazon EC2 shows how important it is to secure your web servers, especially when they are hosted in IP address ranges that are commonly scanned by malicious actors.

## Web security learning checklist

Read and understand the major web application security flaws that are commonly exploited by malicious actors. These include cross-site request forgery (CSRF), cross-site scripting (XSS), SQL injection and session hijacking. The OWASP top 10 web application vulnerabilities list is a great place to get an overview of these topics.

Determine how the framework you've chosen mitigates these vulnerabilities.

Ensure your code implements the mitigation techniques for your framework.

Think like an attacker and actively work to break into your own system. If you do not have enough experience to confidently break the security consider hiring a known white hat attacker. Have her break the application's security, report the easiest vulnerabilities to exploit in your app and help implement protections against those weaknesses.

Recognize that no system is ever totally secure. However, the more popular an application becomes the more attractive a target it is to attackers. Reevaluate your web application security on a frequent basis.

### What topic do you want to learn about next?

I want to learn more about the users of my app with analytics.

How do I integrate external APIs into my app?

How can I log events that occur while the app is running?

Who created Full Stack Python?

#### Interested in major updates to this site or an alert when a complete Full Stack Python book with detailed example code is released? Sign up here and you'll an occasional email only when there's big news to report.