<!DOCTYPE html>

<html lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">

<meta charset="utf-8">

<meta http-equiv="X-UA-Compatible" content="IE=edge">

<meta name="viewport" content="width=device-width, initial-scale=1.0">

<meta name="author" content="Matt Makai">

<meta name="description" content="Full Stack Python explains each layer of the web application stack, from the server up through the rendering in a user's browser.">

<link rel="shortcut icon" href="theme/img/fsp-fav.png">

<title>Web Application Security - Full Stack Python</title>

<link href="theme/css/fsp.css" rel="stylesheet">

<!--[if lt IE 9]>

<script src="https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>

<script src="https://oss.maxcdn.com/libs/respond.js/1.3.0/respond.min.js"></script>

<![endif]-->

<link href="//netdna.bootstrapcdn.com/font-awesome/4.1.0/css/font-awesome.css" rel="stylesheet">

<script type="text/javascript">

var _gaq = _gaq || [];

_gaq.push(['_setAccount', 'UA-19910497-7']);

_gaq.push(['_trackPageview']);

(function() {

var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;

ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';

var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);

})();

</script>

</head>

<body>

<a href="https://github.com/makaimc/fullstackpython.github.com" class="github">

<img style="position: absolute; top: 0; right: 0; border: 0;" src="http://s3.amazonaws.com/github/ribbons/forkme_right_darkblue_121621.png" alt="Fork me on GitHub" />

</a>

<div class="container">

<div class="row">

<div class="col-md-12">

<div class="logo-header-section">

<a href="/" style="text-decoration: none; border: none;"><img src="theme/img/fsp-logo.png" height="52" width="52" class="logo-image" style="padding-top: 1px;"/></a>

<span class="logo-title"><a href="/">Full Stack Python</a></span>

</div>

</div>

</div> <div class="row">

<div class="col-md-8">

<h1>Web Application Security</h1>

<p>Website security must be thought about while building every level of the web

stack. However, this section includes topics that deserve particular

treatment, such as cross-site scripting (XSS), SQL injection, cross-site

request forgery and usage of public-private keypairs.</p>

<h2>Security Resources</h2>

<ul>

<li>

<p><a href="http://www.andrewault.net/2010/05/17/securing-an-ubuntu-server/">Securing an Ubuntu Server</a></p>

</li>

<li>

<p><a href="http://joshrendek.com/2013/01/securing-ubuntu/">Securing Ubuntu</a></p>

</li>

<li>

<p><a href="https://github.com/marshyski/quick-secure">quick NIX secure script</a> for

securing Linux distributions.</p>

</li>

<li>

<p><a href="http://httpd.apache.org/docs/current/misc/security_tips.html">Security Tips from Apache</a></p>

</li>

<li>

<p><a href="http://erik.io/blog/2013/06/08/a-basic-guide-to-when-and-how-to-deploy-https/">When and How to Deploy HTTPS</a></p>

</li>

<li>

<p><a href="http://spenserj.com/blog/2013/07/15/securing-a-linux-server/">Securing a Linux Server</a></p>

</li>

<li>

<p><a href="http://arstechnica.com/security/2013/02/securing-your-website-a-tough-job-but-someones-got-to-do-it/">Securing Your Website</a></p>

</li>

<li>

<p><a href="http://blog.hartleybrody.com/https-certificates/">How HTTPS Secures Connections: What Every Web Dev Should Know</a></p>

</li>

<li>

<p>The Open Web Application Security Project (OWASP) has

<a href="https://www.owasp.org/index.php/Cheat_Sheets">cheat sheets for security</a>

topics.</p>

</li>

<li>

<p><a href="http://blog.hartleybrody.com/https-certificates/">How HTTPS Secures Connections</a>

is a guide for what HTTPS does and does not secure against.</p>

</li>

<li>

<p><a href="https://www.crypto101.io/">Crypto 101</a> is an introductory course on

cryptography for programmers.</p>

</li>

<li>

<p><a href="http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html">The first few milliseconds of an HTTPS connection</a>

provides a detailed look at the SSL handshake process that is implemented

by browsers based on the <a href="http://tools.ietf.org/html/rfc2818">RFC 2818</a>

specification.</p>

</li>

</ul>

<h3>What topic do you want to learn about next?</h3>

<div class="row">

<div class="col-md-3">

<div class="well select-next">

<a href="/web-analytics.html" class="btn btn-success btn-full"><i class="fa fa-dashboard fa-2x"></i></a>

<p class="under-btn">

I want to learn more about the users of my app with analytics.

</p>

</div>

</div>

<div class="col-md-3">

<div class="well select-next">

<a href="/api-integration.html" class="btn btn-success btn-full"><i class="fa fa-link fa-inverse fa-2x"></i></a>

</a>

<p class="under-btn">

How do I integrate external APIs into my app?

</p>

</div>

</div>

<div class="col-md-3">

<div class="well select-next">

<a href="/logging.html" class="btn btn-success btn-full"><i class="fa fa-align-left fa-inverse fa-2x"></i></a>

<p class="under-btn">

How can I log events that occur while the app is running?

</p>

</div>

</div>

<div class="col-md-3">

<div class="well select-next">

<a href="/monitoring.html" class="btn btn-success btn-full"><i class="fa fa-bar-chart-o fa-inverse fa-2x"></i></a>

<p class="under-btn">

What tools should I use for monitoring the live web app?

</p>

</div>

</div>

</div> <style type="text/css">

#mc_embed_signup{background:#fff; clear:left; font:12px "Helvetica Neue",Arial,sans-serif; }

/* Add your own MailChimp form style overrides in your site stylesheet or in this style block.

We recommend moving this block and the preceding CSS link to the HEAD of your HTML file. */

</style>

<hr/>

<div id="mc_embed_signup">

<form action="http://mattmakai.us2.list-manage.com/subscribe/post?u=b7e774f0c4f05dcebbfee183d&amp;id=b22335388d" method="post" id="mc-embedded-subscribe-form" name="mc-embedded-subscribe-form" class="validate" target="_blank" novalidate>

<h4>Interested in a complete Full Stack Python book with detailed tutorials and example code? Sign up here and you'll get an alert email if a book is created. No other emails will be sent other than sign up confirmation.</h4>

<div class="row">

<div class="col-md-9">

<label for="mce-EMAIL">Email Address</label>

<input type="email" value="" name="EMAIL" class="required email form-control" id="mce-EMAIL">

</div>

<div class="col-md-3">

<input type="submit" value="Subscribe" name="subscribe" id="mc-embedded-subscribe" class="btn btn-success" style="margin-top: 20px;">

</div>

<div id="mce-responses" class="clear">

<div class="response" id="mce-error-response" style="display:none"></div>

<div class="response" id="mce-success-response" style="display:none"></div>

</div> <!-- real people should not fill this in and expect good things - do not remove this or risk form bot signups-->

<div style="position: absolute; left: -5000px;"><input type="text" name="b_b7e774f0c4f05dcebbfee183d_b22335388d" value=""></div>

</div>

</form>

</div>

<script type="text/javascript">

var fnames = new Array();var ftypes = new Array();fnames[0]='EMAIL';ftypes[0]='email';fnames[1]='FNAME';ftypes[1]='text';fnames[2]='LNAME';ftypes[2]='text';

try {

var jqueryLoaded=jQuery;

jqueryLoaded=true;

} catch(err) {

var jqueryLoaded=false;

}

var head= document.getElementsByTagName('head')[0];

if (!jqueryLoaded) {

var script = document.createElement('script');

script.type = 'text/javascript';

script.src = '//ajax.googleapis.com/ajax/libs/jquery/1.4.4/jquery.min.js';

head.appendChild(script);

if (script.readyState && script.onload!==null){

script.onreadystatechange= function () {

if (this.readyState == 'complete') mce_preload_check();

}

}

}

var err_style = '';

try{

err_style = mc_custom_error_style;

} catch(e){

err_style = '#mc_embed_signup input.mce_inline_error{border-color:#6B0505;} #mc_embed_signup div.mce_inline_error{margin: 0 0 1em 0; padding: 5px 10px; background-color:#6B0505; font-weight: bold; z-index: 1; color:#fff;}';

}

var head= document.getElementsByTagName('head')[0];

var style= document.createElement('style');

style.type= 'text/css';

if (style.styleSheet) {

style.styleSheet.cssText = err_style;

} else {

style.appendChild(document.createTextNode(err_style));

}

head.appendChild(style);

setTimeout('mce_preload_check();', 250);

var mce_preload_checks = 0;

function mce_preload_check(){

if (mce_preload_checks>40) return;

mce_preload_checks++;

try {

var jqueryLoaded=jQuery;

} catch(err) {

setTimeout('mce_preload_check();', 250);

return;

}

var script = document.createElement('script');

script.type = 'text/javascript';

script.src = 'http://downloads.mailchimp.com/js/jquery.form-n-validate.js';

head.appendChild(script);

try {

var validatorLoaded=jQuery("#fake-form").validate({});

} catch(err) {

setTimeout('mce_preload_check();', 250);

return;

}

mce_init_form();

}

function mce_init_form(){

jQuery(document).ready( function($) {

var options = { errorClass: 'mce_inline_error', errorElement: 'div', onkeyup: function(){}, onfocusout:function(){}, onblur:function(){} };

var mce_validator = $("#mc-embedded-subscribe-form").validate(options);

$("#mc-embedded-subscribe-form").unbind('submit');//remove the validator so we can get into beforeSubmit on the ajaxform, which then calls the validator

options = { url: 'http://mattmakai.us2.list-manage.com/subscribe/post-json?u=b7e774f0c4f05dcebbfee183d&id=b22335388d&c=?', type: 'GET', dataType: 'json', contentType: "application/json; charset=utf-8",

beforeSubmit: function(){

$('#mce_tmp_error_msg').remove();

$('.datefield','#mc_embed_signup').each(

function(){

var txt = 'filled';

var fields = new Array();

var i = 0;

$(':text', this).each(

function(){

fields[i] = this;

i++;

});

$(':hidden', this).each(

function(){

var bday = false;

if (fields.length == 2){

bday = true;

fields[2] = {'value':1970};//trick birthdays into having years

}

if ( fields[0].value=='MM' && fields[1].value=='DD' && (fields[2].value=='YYYY' || (bday && fields[2].value==1970) ) ){

this.value = '';

} else if ( fields[0].value=='' && fields[1].value=='' && (fields[2].value=='' || (bday && fields[2].value==1970) ) ){

this.value = '';

} else {

if (/\[day\]/.test(fields[0].name)){

this.value = fields[1].value+'/'+fields[0].value+'/'+fields[2].value;

} else {

this.value = fields[0].value+'/'+fields[1].value+'/'+fields[2].value;

}

}

});

});

$('.phonefield-us','#mc_embed_signup').each(

function(){

var fields = new Array();

var i = 0;

$(':text', this).each(

function(){

fields[i] = this;

i++;

});

$(':hidden', this).each(

function(){

if ( fields[0].value.length != 3 || fields[1].value.length!=3 || fields[2].value.length!=4 ){

this.value = '';

} else {

this.value = 'filled';

}

});

});

return mce_validator.form();

},

success: mce_success_cb

};

$('#mc-embedded-subscribe-form').ajaxForm(options);

});

}

function mce_success_cb(resp){

$('#mce-success-response').hide();

$('#mce-error-response').hide();

if (resp.result=="success"){

$('#mce-'+resp.result+'-response').show();

$('#mce-'+resp.result+'-response').html(resp.msg);

$('#mc-embedded-subscribe-form').each(function(){

this.reset();

});

} else {

var index = -1;

var msg;

try {

var parts = resp.msg.split(' - ',2);

if (parts[1]==undefined){

msg = resp.msg;

} else {

i = parseInt(parts[0]);

if (i.toString() == parts[0]){

index = parts[0];

msg = parts[1];

} else {

index = -1;

msg = resp.msg;

}

}

} catch(e){

index = -1;

msg = resp.msg;

}

try{

if (index== -1){

$('#mce-'+resp.result+'-response').show();

$('#mce-'+resp.result+'-response').html(msg);

} else {

err_id = 'mce_tmp_error_msg';

html = '<div id="'+err_id+'" style="'+err_style+'"> '+msg+'</div>';

var input_id = '#mc_embed_signup';

var f = $(input_id);

if (ftypes[index]=='address'){

input_id = '#mce-'+fnames[index]+'-addr1';

f = $(input_id).parent().parent().get(0);

} else if (ftypes[index]=='date'){

input_id = '#mce-'+fnames[index]+'-month';

f = $(input_id).parent().parent().get(0);

} else {

input_id = '#mce-'+fnames[index];

f = $().parent(input_id).get(0);

}

if (f){

$(f).append(html);

$(input_id).focus();

} else {

$('#mce-'+resp.result+'-response').show();

$('#mce-'+resp.result+'-response').html(msg);

}

}

} catch(e){

$('#mce-'+resp.result+'-response').show();

$('#mce-'+resp.result+'-response').html(msg);

}

}

}

</script>

<!--End mc_embed_signup--> </div>

<div class="col-md-offset-1 col-md-3" id="sidebar">

<div class="panel panel-success">

<div class="panel-heading"><h3 class="panel-head">Web Application Security</h3></div>

<div class="panel-body">

<a href="/">Full Stack Python</a> is an open book that explains

each Python web application stack layer and provides the

best web resources for those topics.

<hr/>

<a href="http://twitter.com/mattmakai">Matt Makai</a> designed and

wrote this site with assistance from community pull

requests. If you're on GitHub you can

<a href="https://github.com/makaimc">follow him</a>

to see what daily changes are made or

<a href="https://github.com/makaimc/fullstackpython.github.com">star the repository</a> for future reference.

</div>

</div>

<div class="panel panel-success">

<div class="panel-heading">

<h3 class="panel-head">Table of Contents</h3>

</div>

<div class="list-group">

<a href="/introduction.html" class="list-group-item smaller-item ">Introduction</a>

<a href="/web-frameworks.html" class="list-group-item smaller-item ">Web Frameworks</a>

<a href="/django.html" class="list-group-item smaller-item ">Django</a>

<a href="/flask.html" class="list-group-item smaller-item ">Flask</a>

<a href="/bottle.html" class="list-group-item smaller-item ">Bottle</a>

<a href="/other-web-frameworks.html" class="list-group-item smaller-item ">Other Web Frameworks</a>

<a href="/deployment.html" class="list-group-item smaller-item ">Deployment</a>

<a href="/servers.html" class="list-group-item smaller-item ">Servers</a>

<a href="/operating-systems.html" class="list-group-item smaller-item ">Operating Systems</a>

<a href="/web-servers.html" class="list-group-item smaller-item ">Web Servers</a>

<a href="/platform-as-a-service.html" class="list-group-item smaller-item ">Platform-as-a-service</a>

<a href="/wsgi-servers.html" class="list-group-item smaller-item ">WSGI Servers</a>

<a href="/source-control.html" class="list-group-item smaller-item ">Source Control</a>

<a href="/application-dependencies.html" class="list-group-item smaller-item ">Application Dependencies</a>

<a href="/configuration-management.html" class="list-group-item smaller-item ">Configuration Management</a>

<a href="/databases.html" class="list-group-item smaller-item ">Databases</a>

<a href="/no-sql-datastore.html" class="list-group-item smaller-item ">NoSQL Data Stores</a>

<a href="/cascading-style-sheets.html" class="list-group-item smaller-item ">Cascading Style Sheets</a>

<a href="/javascript.html" class="list-group-item smaller-item ">JavaScript</a>

<a href="/application-programming-interfaces.html" class="list-group-item smaller-item ">Application Programming Interfaces</a>

<a href="/api-integration.html" class="list-group-item smaller-item ">API Integration</a>

<a href="/api-creation.html" class="list-group-item smaller-item ">API Creation</a>

<a href="/static-content.html" class="list-group-item smaller-item ">Static Content</a>

<a href="/caching.html" class="list-group-item smaller-item ">Caching</a>

<a href="/task-queues.html" class="list-group-item smaller-item ">Task Queues</a>

<a href="/logging.html" class="list-group-item smaller-item ">Logging</a>

<a href="/monitoring.html" class="list-group-item smaller-item ">Monitoring</a>

<a href="/web-analytics.html" class="list-group-item smaller-item ">Web Analytics</a>

<a href="/web-application-security.html" class="list-group-item smaller-item active">Web Application Security</a>

<a href="/best-python-resources.html" class="list-group-item smaller-item ">Best Python Resources</a>

<a href="/about-author.html" class="list-group-item smaller-item ">About the Author</a>

<a href="/change-log.html" class="list-group-item smaller-item ">Change Log</a>

<a href="/future-directions.html" class="list-group-item smaller-item ">Future Directions</a>

</div>

</div>

</div></div>

<hr/>

<div class="footer pull-right">

<a href="http://www.mattmakai.com/" class="underline">Matt Makai</a>

2014

</div>

</div>

</body>

</html>