book

Full Stack Python Security

Name: Full Stack Python Security
Author: Dennis Byrne
ISBN: 9781617298820

by Dennis Byrne

August 2021

Intermediate to advanced

304 pages

8h 50m

English

Manning Publications

Audiobook available

Read now

Unlock full access

Full Stack Python Security
Copyright
contents
front matter
prefaceacknowledgmentsabout this bookWho should read this bookHow this book is organized: A roadmapAbout the codeliveBook discussion forumabout the authorabout the cover illustration
1 Defense in depth
1.1 Attack surface1.2 Defense in depth1.2.1 Security standards1.2.2 Best practices1.2.3 Security fundamentals1.3 Tools1.3.1 Staying practicalSummary
Part 1 Cryptographic foundations
2 Hashing
2.1 What is a hash function?2.1.1 Cryptographic hash function properties2.2 Archetypal characters2.3 Data integrity2.4 Choosing a cryptographic hash function2.4.1 Which hash functions are safe?2.4.2 Which hash functions are unsafe?2.5 Cryptographic hashing in Python2.6 Checksum functionsSummary
3 Keyed hashing
3.1 Data authentication3.1.1 Key generation3.1.2 Keyed hashing3.2 HMAC functions3.2.1 Data authentication between parties3.3 Timing attacksSummary
4 Symmetric encryption
4.1 What is encryption?4.1.1 Package management4.2 The cryptography package4.2.1 Hazardous materials layer4.2.2 Recipes layer4.2.3 Key rotation4.3 Symmetric encryption4.3.1 Block ciphers4.3.2 Stream ciphers4.3.3 Encryption modesSummary
5 Asymmetric encryption
5.1 Key-distribution problem5.2 Asymmetric encryption5.2.1 RSA public-key encryption5.3 Nonrepudiation5.3.1 Digital signatures5.3.2 RSA digital signatures5.3.3 RSA digital signature verification5.3.4 Elliptic-curve digital signaturesSummary

6 Transport Layer Security
6.1 SSL? TLS? HTTPS?6.2 Man-in-the-middle attack6.3 The TLS handshake6.3.1 Cipher suite negotiation6.3.2 Key exchange6.3.3 Server authentication6.4 HTTP with Django6.4.1 The DEBUG setting6.5 HTTPS with Gunicorn6.5.1 Self-signed public-key certificates6.5.2 The Strict-Transport-Security response header6.5.3 HTTPS redirects6.6 TLS and the requests package6.7 TLS and database connections6.8 TLS and email6.8.1 Implicit TLS6.8.2 Email client authentication6.8.3 SMTP authentication credentialsSummary
Part 2 Authentication and authorization
7 HTTP session management
7.1 What are HTTP sessions?7.2 HTTP cookies7.2.1 Secure directive7.2.2 Domain directive7.2.3 Max-Age directive7.2.4 Browser-length sessions7.2.5 Setting cookies programmatically7.3 Session-state persistence7.3.1 The session serializer7.3.2 Simple cache-based sessions7.3.3 Write-through cache-based sessions7.3.4 Database-based session engine7.3.5 File-based session engine7.3.6 Cookie-based session engineSummary
8 User authentication
8.1 User registration8.1.1 Templates8.1.2 Bob registers his account8.2 User authentication8.2.1 Built-in Django views8.2.2 Creating a Django app8.2.3 Bob logs into and out of his account8.3 Requiring authentication concisely8.4 Testing authenticationSummary
9 User password management
9.1 Password-change workflow9.1.1 Custom password validation9.2 Password storage9.2.1 Salted hashing9.2.2 Key derivation functions9.3 Configuring password hashing9.3.1 Native password hashers9.3.2 Custom password hashers9.3.3 Argon2 password hashing9.3.4 Migrating password hashers9.4 Password-reset workflowSummary
10 Authorization
10.1 Application-level authorization10.1.1 Permissions10.1.2 User and group administration10.2 Enforcing authorization10.2.1 The low-level hard way10.2.2 The high-level easy way10.2.3 Conditional rendering10.2.4 Testing authorization10.3 Antipatterns and best practicesSummary
11 OAuth 2
11.1 Grant types11.1.1 Authorization code flow11.2 Bob authorizes Charlie11.2.1 Requesting authorization11.2.2 Granting authorization11.2.3 Token exchange11.2.4 Accessing protected resources11.3 Django OAuth Toolkit11.3.1 Authorization server responsibilities11.3.2 Resource server responsibilities11.4 requests-oauthlib11.4.1 OAuth client responsibilitiesSummary
Part 3 Attack resistance
12 Working with the operating system
12.1 Filesystem-level authorization12.1.1 Asking for permission12.1.2 Working with temp files12.1.3 Working with filesystem permissions12.2 Invoking external executables12.2.1 Bypassing the shell with internal APIs12.2.2 Using the subprocess moduleSummary
13 Never trust input
13.1 Package management with Pipenv13.2 YAML remote code execution13.3 XML entity expansion13.3.1 Quadratic blowup attack13.3.2 Billion laughs attack13.4 Denial of service13.5 Host header attacks13.6 Open redirect attacks13.7 SQL injection13.7.1 Raw SQL queries13.7.2 Database connection queriesSummary
14 Cross-site scripting attacks
14.1 What is XSS?14.1.1 Persistent XSS14.1.2 Reflected XSS14.1.3 DOM-based XSS14.2 Input validation14.2.1 Django form validation14.3 Escaping output14.3.1 Built-in rendering utilities14.3.2 HTML attribute quoting14.4 HTTP response headers14.4.1 Disable JavaScript access to cookies14.4.2 Disable MIME type sniffing14.4.3 The X-XSS-Protection headerSummary
15 Content Security Policy
15.1 Composing a content security policy15.1.1 Fetch directivesNavigation and document directives15.2 Deploying a policy with django-csp15.3 Using individualized policies15.4 Reporting CSP violations15.5 Content Security Policy Level 3Summary
16 Cross-site request forgery
16.1 What is request forgery?16.2 Session ID management16.3 State-management conventions16.3.1 HTTP method validation16.4 Referer header validation16.4.1 Referrer-Policy response header16.5 CSRF tokens16.5.1 POST requests16.5.2 Other unsafe request methodsSummary
17 Cross-Origin Resource Sharing
17.1 Same-origin policy17.2 Simple CORS requests17.2.1 Cross-origin asynchronous requests17.3 CORS with django-cors-headers17.3.1 Configuring Access-Control-Allow-Origin17.4 Preflight CORS requests17.4.1 Sending the preflight request17.4.2 Sending the preflight response17.5 Sending cookies across origins17.6 CORS and CSRF resistanceSummary
18 Clickjacking
18.1 The X-Frame-Options header18.1.1 Individualized responses18.2 The Content-Security-Policy header18.2.1 X-Frame-Options versus CSP18.3 Keeping up with MallorySummary
index

Content preview from Full Stack Python Security

13 Never trust input

This chapter covers

Validating Python dependencies with Pipenv
Parsing YAML safely with PyYAML
Parsing XML safely with defusedxml
Preventing DoS attacks, Host header attacks, open redirects, and SQL injection

In this chapter, Mallory wreaks havoc on Alice, Bob, and Charlie with a half dozen attacks. These attacks, and their countermeasures, are not as complicated as the attacks I cover later. Each attack in this chapter follows a pattern: Mallory abuses a system or user with malicious input. These attacks arrive as many different forms of input: package dependencies, YAML, XML, HTTP, and SQL. The goals of these attacks include data corruption, privilege escalation, and unauthorized data access. Input validation is the ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

DevOps in Python: Infrastructure as Python

Publisher Resources

ISBN: 9781617298820Publisher Support Publisher Website

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Full Stack Python Security

by Dennis Byrne

13 Never trust input

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.