CS1520 Recitation: Security in Flask Jeongmin Lee Slide contents - - PowerPoint PPT Presentation

CS1520 Recitation: Security in Flask

Jeongmin Lee Slide contents based on a post by Damyan Bogoev at: https://damyanon.net/post/flask-series-security/

Plan for Today

• XSS (Cross Site Scripting)
• CSRF (Cross-Site Request Forgery)
• SQL Injection
• Authentication and Authorization

Plan for Today

• XSS
• CSRF
• SQL Injection
• Authentication and Authorization

XSS

• Cross Site Scripting (XSS)

○ Attack that tries to have your websites or applications load malicious script in your browser

XSS

• Cross Site Scripting (XSS)

○ Attack that tries to have your websites or applications load malicious script in your browser ○ Try access user’s credentials, get cookie info, modify settings and download files etc.

XSS

• Cross Site Scripting (XSS)

○ Attack that tries to have your websites or applications load malicious script in your browser ○ Try access user’s credentials, get cookie info, modify settings and download files etc. ○ Can avoided by escaping text and validating user input.

XSS

• In Flask, by default it configures Jinja2 to auto escape

all values loaded in the page. http://jinja.pocoo.org/docs/dev/extensions/#autoescap e-extension)

XSS

• More considerations for securing your applications

w.r.t XSS: ○ avoid generating html without Jinja2

XSS

• More considerations for securing your applications

w.r.t XSS: ○ avoid generating html without Jinja2 ○ avoid sending out data from uploaded files

XSS

• More considerations for securing your applications

w.r.t XSS: ○ avoid generating html without Jinja2 ○ avoid sending out data from uploaded files ○ avoid using the Markup class on not verified data sent by a user

XSS

• More considerations for securing your applications

w.r.t XSS: ○ avoid generating html without Jinja2 ○ avoid sending out data from uploaded files ○ avoid using the Markup class on not verified data sent by a user ○ always quote the attributes values in your templates.

Plan for Today

• XSS
• CSRF
• SQL Injection
• Authentication and Authorization

CSRF

• Cross-Site Request Forgery (CSRF) is an attack that

uses the user’s authentication credentials to execute unwanted actions.

• To against CSRF, you can use random string and to

verify it against a hidden field in post.

CSRF

source: http://flask.pocoo.org/snippets/3/

CSRF

source: http://flask.pocoo.org/snippets/3/

• Put this in your template:

Plan for Today

• XSS
• CSRF
• SQL Injection
• Authentication and Authorization

SQL Injection

• SQL Injection is an attack where users can inject SQL

commands via user input form and have them executed on the server.

SQL Injection

• SQL Injection is an attack where users can inject SQL

commands via user input form and have them executed on the server.

• This SQL query can be anything and can be very

harmful.

SQL Injection

• SQL Injection is an attack where users can inject SQL

commands via user input form and have them executed on the server.

• This SQL query can be anything and can be very

harmful.

• Your application can be exposed to this attack when

you dynamically create SQL statements. ○ e.g., concatenating data based on user’s input

SQL Injection

• By default SQL Alchemy quotes special characters –

semicolons or apostrophes.

Plan for Today

• XSS
• CSRF
• SQL Injection
• Authentication and Authorization

Authentication and Authorization

• Authentication

○ verifies the user’s identity by validating his/her credential (username / email, password)

• Authorization

○ verifies whether authenticated user has access to a given resource

Flask-Security

• Flask-Security uses internally a User and Role data

model, that could be defined via the SQL Alchemy API.

• You can inherit Flask-Security’s User and Role MixIn

class to build your own.

source: https://damyanon.net/post/flask-series-security/ roles_users = db.Table('roles_users', \ db.Column('user_id', db.Integer(), db.ForeignKey('user.id')), \ db.Column('role_id', db.Integer(), db.ForeignKey('role.id'))) class Role(db.Model, RoleMixin): id = db.Column(db.Integer(), primary_key=True) name = db.Column(db.String(80), unique=True) description = db.Column(db.String(255)) def __init__(self, name): self.name = name

source: https://damyanon.net/post/flask-series-security/ class User(db.Model, UserMixin): id = db.Column(db.Integer, primary_key=True) email = db.Column(db.String(255), unique=True) password = db.Column(db.String(255)) active = db.Column(db.Boolean()) roles = db.relationship('Role', secondary=roles_users, backref=db.backref('users', lazy='dynamic')) def __init__(self, email, password, active, roles): self.email = email self.password = password self.active = active self.roles = roles

Flask-Security

• The User class derives from UserMixin Flask-Login

default user implementation. Same for Role class.

• SQL Alchemy is used for both User and Role objects.
• Following configurations is added to use Flask-Login

with SQL Alchemy

source: https://damyanon.net/post/flask-series-security/ def configure_app(app): ... # Configure Security user_datastore = SQLAlchemyUserDatastore(db, User, Role) app.security = Security(app, user_datastore) ...

• Complete explanation of Flask-Security configuration is here:

https://pythonhosted.org/Flask-Security/configuration.html

Questions?