Python Microservices Development

Securing your code

In the previous section, we've looked at how to set up a simple WAF. The rate limiting feature we've added is useful but protects us from just one possible attack. Without being paranoid, as soon as you are exposing your app to the world, there are numerous possible attacks, and your code needs to be designed with that threat in mind.

The idea behind secure code is simple, yet hard to do well in practice. The two fundamental principles are:

• Every request from the outside world should be carefully assessed before it does something in your application and data
• Everything your application is doing on a system should have a well-defined and limited scope

Let's look at how to implement these principles in practice.