WebAppSec/MozSecureWorld: Difference between revisions
Jump to navigation
Jump to search
| Line 57: | Line 57: | ||
# X Design Planning | # X Design Planning | ||
# X Figure out how to do [https://docs.djangoproject.com/en/dev/ref/templates/api/#loading-templates templates] | # X Figure out how to do [https://docs.djangoproject.com/en/dev/ref/templates/api/#loading-templates templates] | ||
# Figure out how to put in database | # X Figure out how to put in database | ||
# | # X Know how to make pages with templates | ||
# | # basic: x-frame-options | ||
# basic: secure flag | |||
# basic: httponly flag | |||
# Use bleach for rich text. | # Use bleach for rich text. | ||
# add decorators for data and business layers | # add decorators for data and business layers | ||
# read about presentation layer | # read about presentation layer | ||
# Complete initial presentation layer and CSS for basic item | # Complete initial presentation layer and CSS for basic item | ||
# Authentication/login | # Authentication/login | ||
# File upload stuff | # File upload stuff | ||
# Write about page for each vulnerability | |||
== Links References == | == Links References == | ||
https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines | https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines | ||
Revision as of 23:57, 9 June 2011
Purpose
A running web application to demonstrate major security paradigms used within Mozilla web applications and security capabilities of modern browsers.
Uses
- Demonstration of secure application design
- Explanation of importance and purpose of security features
- Learning tool for others to reference
- Testing site to validate effectiveness of security & design recommendations
- Evaluation tool for pen testing individuals or tools
Design
Architecture
Python on Django via Playdoh
Security Components & Controls
Authentication
- Brute force prevention via adaptive CAPTCHA
- Password storage via bcrypt and system nonce
- Account creation with blacklisted password support
- (Possible) Secure Password Reset
How
- Login with database and different users
Access Control
- Presentation, Business, Data Layer Access Control
- Presentation and Data layers use decorators
- Read about presentation layer protection
- (Possible) Two tier design for admin account separation
- The picture of separate control of changing passwords
Input Validation
- Rich text handling via bleach
- File upload support via secure file handling guidelines
- File Handling
- SQL
- Content Security Policy
- outsource all javascript source! for the CSP demo as 2nd barrier beyond escaping characters
- (Possible) Third party service
- (Possible) Third party hosted images. Initial processing and per visit processing?
Transport Security
- Full & correct TLS
- HTTP Strict Transport Security
How
- Follow these rules
Cross Domain Controls
- X-frame-options in header options
Cookie Protection
- Secure Flag
- HTTPOnly Flag
Roadmap
- X Setup playdoh & github
- X Running HelloWorld
- X Design Planning
- X Figure out how to do templates
- X Figure out how to put in database
- X Know how to make pages with templates
- basic: x-frame-options
- basic: secure flag
- basic: httponly flag
- Use bleach for rich text.
- add decorators for data and business layers
- read about presentation layer
- Complete initial presentation layer and CSS for basic item
- Authentication/login
- File upload stuff
- Write about page for each vulnerability