- Full Stack Python Security
- Copyright
- contents
- front matter
- 1 Defense in depth
- Part 1 Cryptographic foundations
- 2 Hashing
- 2.1 What is a hash function?
- 2.1.1 Cryptographic hash function properties
- 2.2 Archetypal characters
- 2.3 Data integrity
- 2.4 Choosing a cryptographic hash function
- 2.4.1 Which hash functions are safe?
- 2.4.2 Which hash functions are unsafe?
- 2.5 Cryptographic hashing in Python
- 2.6 Checksum functions
- Summary
- 3 Keyed hashing
- 4 Symmetric encryption
- 5 Asymmetric encryption
- 6 Transport Layer Security
- 6.1 SSL? TLS? HTTPS?
- 6.2 Man-in-the-middle attack
- 6.3 The TLS handshake
- 6.3.1 Cipher suite negotiation
- 6.3.2 Key exchange
- 6.3.3 Server authentication
- 6.4 HTTP with Django
- 6.4.1 The DEBUG setting
- 6.5 HTTPS with Gunicorn
- 6.5.1 Self-signed public-key certificates
- 6.5.2 The Strict-Transport-Security response header
- 6.5.3 HTTPS redirects
- 6.6 TLS and the requests package
- 6.7 TLS and database connections
- 6.8 TLS and email
- 6.8.1 Implicit TLS
- 6.8.2 Email client authentication
- 6.8.3 SMTP authentication credentials
- Summary
- Part 2 Authentication and authorization
- 7 HTTP session management
- 7.1 What are HTTP sessions?
- 7.2 HTTP cookies
- 7.2.1 Secure directive
- 7.2.2 Domain directive
- 7.2.3 Max-Age directive
- 7.2.4 Browser-length sessions
- 7.2.5 Setting cookies programmatically
- 7.3 Session-state persistence
- 7.3.1 The session serializer
- 7.3.2 Simple cache-based sessions
- 7.3.3 Write-through cache-based sessions
- 7.3.4 Database-based session engine
- 7.3.5 File-based session engine
- 7.3.6 Cookie-based session engine
- Summary
- 8 User authentication
- 9 User password management
- 9.1 Password-change workflow
- 9.1.1 Custom password validation
- 9.2 Password storage
- 9.2.1 Salted hashing
- 9.2.2 Key derivation functions
- 9.3 Configuring password hashing
- 9.3.1 Native password hashers
- 9.3.2 Custom password hashers
- 9.3.3 Argon2 password hashing
- 9.3.4 Migrating password hashers
- 9.4 Password-reset workflow
- Summary
- 10 Authorization
- 11 OAuth 2
- 11.1 Grant types
- 11.1.1 Authorization code flow
- 11.2 Bob authorizes Charlie
- 11.2.1 Requesting authorization
- 11.2.2 Granting authorization
- 11.2.3 Token exchange
- 11.2.4 Accessing protected resources
- 11.3 Django OAuth Toolkit
- 11.3.1 Authorization server responsibilities
- 11.3.2 Resource server responsibilities
- 11.4 requests-oauthlib
- 11.4.1 OAuth client responsibilities
- Summary
- Part 3 Attack resistance
- 12 Working with the operating system
- 13 Never trust input
- 13.1 Package management with Pipenv
- 13.2 YAML remote code execution
- 13.3 XML entity expansion
- 13.3.1 Quadratic blowup attack
- 13.3.2 Billion laughs attack
- 13.4 Denial of service
- 13.5 Host header attacks
- 13.6 Open redirect attacks
- 13.7 SQL injection
- 13.7.1 Raw SQL queries
- 13.7.2 Database connection queries
- Summary
- 14 Cross-site scripting attacks
- 14.1 What is XSS?
- 14.1.1 Persistent XSS
- 14.1.2 Reflected XSS
- 14.1.3 DOM-based XSS
- 14.2 Input validation
- 14.2.1 Django form validation
- 14.3 Escaping output
- 14.3.1 Built-in rendering utilities
- 14.3.2 HTML attribute quoting
- 14.4 HTTP response headers
- 14.4.1 Disable JavaScript access to cookies
- 14.4.2 Disable MIME type sniffing
- 14.4.3 The X-XSS-Protection header
- Summary
- 15 Content Security Policy
- 16 Cross-site request forgery
- 17 Cross-Origin Resource Sharing
- 17.1 Same-origin policy
- 17.2 Simple CORS requests
- 17.2.1 Cross-origin asynchronous requests
- 17.3 CORS with django-cors-headers
- 17.3.1 Configuring Access-Control-Allow-Origin
- 17.4 Preflight CORS requests
- 17.4.1 Sending the preflight request
- 17.4.2 Sending the preflight response
- 17.5 Sending cookies across origins
- 17.6 CORS and CSRF resistance
- Summary
- 18 Clickjacking
- index
Unlike parts 1 and 2, part 3 isn’t primarily concerned with fundamentals or development. Instead, everything revolves around Mallory as she devastates the other characters with attacks such as cross-site scripting, open redirect attacks, SQL injection, cross-site request forgery, clickjacking, and more. This is the most adversarial portion of the book. In each chapter, attacks don’t complement the main idea; attacks are the main idea.
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.