Security Patterns

Security Patterns

Essential security patterns for web applications.

OWASP Top 10 Quick Reference

Input Validation

# WRONG - Trust user input
def search(query):
    return db.execute(f"SELECT * FROM users WHERE name = '{query}'")

# CORRECT - Parameterized query
def search(query):
    return db.execute("SELECT * FROM users WHERE name = ?", [query])

Validation Rules

Always validate:
- Type (string, int, email format)
- Length (min/max bounds)
- Range (numeric bounds)
- Format (regex for patterns)
- Allowlist (known good values)

Never trust:
- URL parameters
- Form data
- HTTP headers
- Cookies
- File uploads

Output Encoding

// WRONG - Direct HTML insertion
element.innerHTML = userInput;

// CORRECT - Text content (auto-escapes)
element.textContent = userInput;

// CORRECT - Template with escaping
render(`<div>${escapeHtml(userInput)}</div>`);

Encoding by Context

Authentication

# Password hashing (use bcrypt, argon2, or scrypt)
import bcrypt

def hash_password(password: str) -> bytes:
    return bcrypt.hashpw(password.encode(), bcrypt.gensalt(rounds=12))

def verify_password(password: str, hashed: bytes) -> bool:
    return bcrypt.checkpw(password.encode(), hashed)

Auth Checklist

• [ ] Hash passwords with bcrypt/argon2 (cost factor 12+)
• [ ] Implement rate limiting on login
• [ ] Use secure session tokens (random, long)
• [ ] Set secure cookie flags (HttpOnly, Secure, SameSite)
• [ ] Implement account lockout after failed attempts
• [ ] Support MFA for sensitive operations

Authorization

# WRONG - Check only authentication
@login_required
def delete_post(post_id):
    post = Post.get(post_id)
    post.delete()

# CORRECT - Check authorization
@login_required
def delete_post(post_id):
    post = Post.get(post_id)
    if post.author_id != current_user.id and not current_user.is_admin:
        raise Forbidden("Not authorized to delete this post")
    post.delete()

Secrets Management

# WRONG - Hardcoded secrets
API_KEY = "sk-1234567890abcdef"

# CORRECT - Environment variables
API_KEY = os.environ["API_KEY"]

# BETTER - Secrets manager
API_KEY = secrets_client.get_secret("api-key")

Secret Handling Rules

DO:
- Use environment variables or secrets manager
- Rotate secrets regularly
- Use different secrets per environment
- Audit secret access

DON'T:
- Commit secrets to git
- Log secrets
- Include secrets in error messages
- Share secrets in plain text

Security Headers

Content-Security-Policy: default-src 'self'; script-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), camera=()

Quick Security Audit

# Find hardcoded secrets
rg -i "(password|secret|api_key|token)\s*=\s*['\"][^'\"]+['\"]" --type py

# Find SQL injection risks
rg "execute\(f['\"]|format\(" --type py

# Find eval/exec usage
rg "\b(eval|exec)\s*\(" --type py

# Check for TODO security items
rg -i "TODO.*security|FIXME.*security"

Additional Resources

• ./references/owasp-detailed.md - Full OWASP Top 10 details
• ./references/auth-patterns.md - JWT, OAuth, session management
• ./references/crypto-patterns.md - Encryption, hashing, signatures
• ./references/secure-headers.md - HTTP security headers guide

Scripts

• ./scripts/security-scan.sh - Quick security grep patterns
• ./scripts/dependency-audit.sh - Check for vulnerable dependencies

Authentication Patterns

Secure authentication implementation patterns.

Password Hashing

bcrypt (Recommended)

import bcrypt

def hash_password(password: str) -> bytes:
    """Hash password with bcrypt."""
    salt = bcrypt.gensalt(rounds=12)  # Cost factor 12
    return bcrypt.hashpw(password.encode('utf-8'), salt)

def verify_password(password: str, hashed: bytes) -> bool:
    """Verify password against hash."""
    return bcrypt.checkpw(password.encode('utf-8'), hashed)

# Usage
hashed = hash_password("user_password")
is_valid = verify_password("user_password", hashed)

Argon2 (Modern Alternative)

from argon2 import PasswordHasher

ph = PasswordHasher(
    time_cost=3,      # Iterations
    memory_cost=65536, # 64MB
    parallelism=4,     # Threads
)

def hash_password(password: str) -> str:
    return ph.hash(password)

def verify_password(password: str, hashed: str) -> bool:
    try:
        ph.verify(hashed, password)
        return True
    except:
        return False

Session Management

Secure Session Configuration

from flask import Flask
from datetime import timedelta

app = Flask(__name__)

app.config.update(
    SECRET_KEY=os.environ['SECRET_KEY'],  # Strong random key
    SESSION_COOKIE_NAME='__session',
    SESSION_COOKIE_SECURE=True,           # HTTPS only
    SESSION_COOKIE_HTTPONLY=True,         # No JavaScript access
    SESSION_COOKIE_SAMESITE='Strict',     # CSRF protection
    PERMANENT_SESSION_LIFETIME=timedelta(hours=1),
)

Session Token Generation

import secrets

def generate_session_id() -> str:
    """Generate cryptographically secure session ID."""
    return secrets.token_urlsafe(32)  # 256 bits of entropy

def generate_csrf_token() -> str:
    """Generate CSRF token."""
    return secrets.token_hex(32)

JWT Patterns

JWT Generation

import jwt
from datetime import datetime, timedelta

SECRET_KEY = os.environ['JWT_SECRET']
ALGORITHM = "HS256"

def create_token(user_id: int, expires_delta: timedelta = timedelta(hours=1)) -> str:
    expire = datetime.utcnow() + expires_delta
    payload = {
        "sub": str(user_id),
        "exp": expire,
        "iat": datetime.utcnow(),
        "jti": secrets.token_urlsafe(16),  # Unique token ID
    }
    return jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM)

def verify_token(token: str) -> dict:
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
        return payload
    except jwt.ExpiredSignatureError:
        raise AuthError("Token expired")
    except jwt.InvalidTokenError:
        raise AuthError("Invalid token")

JWT Best Practices

# DO
- Use strong secret (256+ bits)
- Set short expiration (15min - 1hr)
- Include jti for revocation
- Use HTTPS only
- Store in httpOnly cookie (not localStorage)

# DON'T
- Store sensitive data in payload (it's base64, not encrypted)
- Use long expiration times
- Send in URL parameters
- Use weak algorithms (none, HS256 with weak key)

Refresh Token Pattern

def create_tokens(user_id: int) -> tuple[str, str]:
    """Create access and refresh token pair."""
    access_token = create_token(
        user_id,
        expires_delta=timedelta(minutes=15),
        token_type="access"
    )
    refresh_token = create_token(
        user_id,
        expires_delta=timedelta(days=7),
        token_type="refresh"
    )
    return access_token, refresh_token

def refresh_access_token(refresh_token: str) -> str:
    """Generate new access token from refresh token."""
    payload = verify_token(refresh_token)

    if payload.get("token_type") != "refresh":
        raise AuthError("Not a refresh token")

    # Check if refresh token is revoked
    if is_token_revoked(payload["jti"]):
        raise AuthError("Token revoked")

    return create_token(payload["sub"], token_type="access")

OAuth 2.0 Flow

Authorization Code Flow

from authlib.integrations.flask_client import OAuth

oauth = OAuth(app)
oauth.register(
    name='google',
    client_id=os.environ['GOOGLE_CLIENT_ID'],
    client_secret=os.environ['GOOGLE_CLIENT_SECRET'],
    access_token_url='https://oauth2.googleapis.com/token',
    authorize_url='https://accounts.google.com/o/oauth2/auth',
    api_base_url='https://www.googleapis.com/',
    client_kwargs={'scope': 'openid email profile'},
)

@app.route('/login/google')
def google_login():
    redirect_uri = url_for('google_callback', _external=True)
    return oauth.google.authorize_redirect(redirect_uri)

@app.route('/callback/google')
def google_callback():
    token = oauth.google.authorize_access_token()
    user_info = oauth.google.get('oauth2/v3/userinfo').json()

    # Find or create user
    user = find_or_create_user(
        email=user_info['email'],
        name=user_info['name'],
        oauth_provider='google',
        oauth_id=user_info['sub']
    )

    login_user(user)
    return redirect('/')

Multi-Factor Authentication

TOTP Implementation

import pyotp

def generate_totp_secret() -> str:
    """Generate new TOTP secret for user."""
    return pyotp.random_base32()

def get_totp_uri(secret: str, email: str) -> str:
    """Generate URI for authenticator app."""
    totp = pyotp.TOTP(secret)
    return totp.provisioning_uri(name=email, issuer_name="MyApp")

def verify_totp(secret: str, code: str) -> bool:
    """Verify TOTP code."""
    totp = pyotp.TOTP(secret)
    return totp.verify(code, valid_window=1)  # Allow 30s drift

Backup Codes

def generate_backup_codes(count: int = 10) -> list[str]:
    """Generate one-time backup codes."""
    return [secrets.token_hex(4) for _ in range(count)]

def use_backup_code(user_id: int, code: str) -> bool:
    """Verify and consume backup code."""
    user = get_user(user_id)
    if code in user.backup_codes:
        user.backup_codes.remove(code)
        user.save()
        return True
    return False

Rate Limiting

from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

limiter = Limiter(
    app,
    key_func=get_remote_address,
    default_limits=["200 per day", "50 per hour"]
)

@app.route("/login", methods=["POST"])
@limiter.limit("5 per minute")
def login():
    # Rate limited to 5 attempts per minute per IP
    pass

@app.route("/api/sensitive")
@limiter.limit("10 per minute", key_func=lambda: current_user.id)
def sensitive_endpoint():
    # Rate limited per user, not IP
    pass

Account Security

Account Lockout

MAX_FAILED_ATTEMPTS = 5
LOCKOUT_DURATION = timedelta(minutes=30)

def record_failed_login(user_id: int) -> None:
    user = get_user(user_id)
    user.failed_login_attempts += 1
    user.last_failed_login = datetime.utcnow()

    if user.failed_login_attempts >= MAX_FAILED_ATTEMPTS:
        user.locked_until = datetime.utcnow() + LOCKOUT_DURATION
        security_logger.warning(f"Account locked: {user.email}")

    user.save()

def check_account_locked(user_id: int) -> bool:
    user = get_user(user_id)
    if user.locked_until and user.locked_until > datetime.utcnow():
        return True
    return False

def reset_failed_attempts(user_id: int) -> None:
    user = get_user(user_id)
    user.failed_login_attempts = 0
    user.locked_until = None
    user.save()

Password Reset

def create_reset_token(user_id: int) -> str:
    """Create password reset token."""
    token = secrets.token_urlsafe(32)
    expires = datetime.utcnow() + timedelta(hours=1)

    # Store hash of token, not token itself
    token_hash = hashlib.sha256(token.encode()).hexdigest()
    store_reset_token(user_id, token_hash, expires)

    return token

def verify_reset_token(token: str) -> int | None:
    """Verify reset token and return user_id."""
    token_hash = hashlib.sha256(token.encode()).hexdigest()
    record = get_reset_token(token_hash)

    if not record or record.expires < datetime.utcnow():
        return None

    # Invalidate token after use
    delete_reset_token(token_hash)
    return record.user_id

Cryptography Patterns

Secure cryptographic implementations.

Symmetric Encryption

AES-GCM (Recommended)

from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import os

def encrypt(plaintext: bytes, key: bytes) -> bytes:
    """Encrypt data with AES-GCM."""
    # Generate random 96-bit nonce
    nonce = os.urandom(12)
    aesgcm = AESGCM(key)
    ciphertext = aesgcm.encrypt(nonce, plaintext, associated_data=None)
    # Prepend nonce to ciphertext
    return nonce + ciphertext

def decrypt(data: bytes, key: bytes) -> bytes:
    """Decrypt AES-GCM encrypted data."""
    nonce = data[:12]
    ciphertext = data[12:]
    aesgcm = AESGCM(key)
    return aesgcm.decrypt(nonce, ciphertext, associated_data=None)

# Generate a secure key
key = AESGCM.generate_key(bit_length=256)

Fernet (Simple, Safe)

from cryptography.fernet import Fernet

# Generate key
key = Fernet.generate_key()

# Encrypt
f = Fernet(key)
token = f.encrypt(b"secret message")

# Decrypt
plaintext = f.decrypt(token)

Key Derivation

PBKDF2

from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives import hashes
import os

def derive_key(password: str, salt: bytes = None) -> tuple[bytes, bytes]:
    """Derive encryption key from password."""
    if salt is None:
        salt = os.urandom(16)

    kdf = PBKDF2HMAC(
        algorithm=hashes.SHA256(),
        length=32,
        salt=salt,
        iterations=600000,  # OWASP 2023 recommendation
    )
    key = kdf.derive(password.encode())
    return key, salt

Argon2 for Key Derivation

from argon2.low_level import hash_secret_raw, Type

def derive_key_argon2(password: str, salt: bytes = None) -> tuple[bytes, bytes]:
    """Derive key using Argon2id."""
    if salt is None:
        salt = os.urandom(16)

    key = hash_secret_raw(
        secret=password.encode(),
        salt=salt,
        time_cost=3,
        memory_cost=65536,
        parallelism=4,
        hash_len=32,
        type=Type.ID,
    )
    return key, salt

Hashing

SHA-256 (Data Integrity)

import hashlib

def hash_data(data: bytes) -> str:
    """Hash data for integrity checking."""
    return hashlib.sha256(data).hexdigest()

def verify_integrity(data: bytes, expected_hash: str) -> bool:
    """Verify data hasn't been modified."""
    return hashlib.sha256(data).hexdigest() == expected_hash

HMAC (Message Authentication)

import hmac
import hashlib

def create_signature(message: bytes, key: bytes) -> str:
    """Create HMAC signature."""
    return hmac.new(key, message, hashlib.sha256).hexdigest()

def verify_signature(message: bytes, signature: str, key: bytes) -> bool:
    """Verify HMAC signature (timing-safe)."""
    expected = hmac.new(key, message, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

Digital Signatures

RSA Signatures

from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives import serialization

# Generate key pair
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=4096,
)
public_key = private_key.public_key()

def sign(message: bytes, private_key) -> bytes:
    """Sign message with RSA."""
    return private_key.sign(
        message,
        padding.PSS(
            mgf=padding.MGF1(hashes.SHA256()),
            salt_length=padding.PSS.MAX_LENGTH
        ),
        hashes.SHA256()
    )

def verify(message: bytes, signature: bytes, public_key) -> bool:
    """Verify RSA signature."""
    try:
        public_key.verify(
            signature,
            message,
            padding.PSS(
                mgf=padding.MGF1(hashes.SHA256()),
                salt_length=padding.PSS.MAX_LENGTH
            ),
            hashes.SHA256()
        )
        return True
    except:
        return False

Ed25519 (Modern Alternative)

from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey

# Generate keys
private_key = Ed25519PrivateKey.generate()
public_key = private_key.public_key()

# Sign
signature = private_key.sign(message)

# Verify
try:
    public_key.verify(signature, message)
    print("Valid signature")
except:
    print("Invalid signature")

Secure Random

import secrets
import os

# Cryptographically secure random bytes
random_bytes = os.urandom(32)

# Secure token generation
token = secrets.token_hex(32)      # 64 hex chars
token = secrets.token_urlsafe(32)  # URL-safe base64
token = secrets.token_bytes(32)    # Raw bytes

# Secure random integer
pin = secrets.randbelow(1000000)   # 0-999999

# Secure random choice
selected = secrets.choice(options)

Key Storage

Environment Variables

import os

# Load key from environment
key = os.environ.get('ENCRYPTION_KEY')
if not key:
    raise RuntimeError("ENCRYPTION_KEY not set")
key_bytes = bytes.fromhex(key)

Key Management Service (AWS KMS)

import boto3

kms = boto3.client('kms')

def encrypt_with_kms(plaintext: bytes, key_id: str) -> bytes:
    """Encrypt using AWS KMS."""
    response = kms.encrypt(
        KeyId=key_id,
        Plaintext=plaintext,
    )
    return response['CiphertextBlob']

def decrypt_with_kms(ciphertext: bytes) -> bytes:
    """Decrypt using AWS KMS."""
    response = kms.decrypt(CiphertextBlob=ciphertext)
    return response['Plaintext']

Common Mistakes

DON'T: Use ECB Mode

# WRONG - ECB reveals patterns
cipher = Cipher(algorithms.AES(key), modes.ECB())

# CORRECT - Use GCM or CBC with HMAC
cipher = Cipher(algorithms.AES(key), modes.GCM(iv))

DON'T: Reuse Nonces/IVs

# WRONG - Static IV
iv = b'1234567890123456'

# CORRECT - Random IV each time
iv = os.urandom(16)

DON'T: Roll Your Own Crypto

# WRONG - Custom encryption
def encrypt(data, key):
    return bytes([b ^ key[i % len(key)] for i, b in enumerate(data)])

# CORRECT - Use established libraries
from cryptography.fernet import Fernet

DON'T: Use MD5 or SHA1 for Security

# WRONG - Weak hash
import hashlib
hash = hashlib.md5(password.encode())

# CORRECT - Use bcrypt for passwords
import bcrypt
hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt())

Quick Reference

OWASP Top 10 Detailed Guide

In-depth coverage of OWASP Top 10 2021 vulnerabilities.

A01: Broken Access Control

Description

Access control enforces policy such that users cannot act outside their intended permissions.

Examples

• Bypassing access control by modifying URL, state, or HTML
• Viewing or editing someone else's account
• Privilege escalation (acting as user without login, or user acting as admin)
• Metadata manipulation (replay/tampering JWT, cookies, hidden fields)
• CORS misconfiguration allowing unauthorized API access
• Force browsing to authenticated pages or privileged pages

Prevention

# WRONG - Client-side check only
if user.role == "admin":
    show_admin_button()

# CORRECT - Server-side enforcement
@app.route("/admin/users")
def admin_users():
    if not current_user.has_role("admin"):
        abort(403)
    return render_template("admin/users.html")

# CORRECT - Deny by default
def get_resource(resource_id):
    resource = Resource.get(resource_id)
    if resource.owner_id != current_user.id:
        raise Forbidden("Not your resource")
    return resource

Checklist

• [ ] Deny by default except for public resources
• [ ] Implement access control once, reuse everywhere
• [ ] Record access control failures, alert on repeated attempts
• [ ] Disable web server directory listing
• [ ] Ensure file metadata not accessible

A02: Cryptographic Failures

Description

Failures related to cryptography leading to exposure of sensitive data.

Examples

• Data transmitted in clear text (HTTP, SMTP, FTP)
• Old/weak cryptographic algorithms (MD5, SHA1, DES)
• Default or weak crypto keys
• Improper certificate validation
• Passwords stored without salted hashing

Prevention

# WRONG - Weak hashing
import hashlib
password_hash = hashlib.md5(password.encode()).hexdigest()

# CORRECT - bcrypt with cost factor
import bcrypt
password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt(rounds=12))

# WRONG - ECB mode
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
cipher = Cipher(algorithms.AES(key), modes.ECB())

# CORRECT - GCM mode with random IV
cipher = Cipher(algorithms.AES(key), modes.GCM(iv))

Checklist

• [ ] Classify data by sensitivity
• [ ] Don't store sensitive data unnecessarily
• [ ] Encrypt all sensitive data at rest
• [ ] Use TLS for all data in transit
• [ ] Use strong, standard algorithms
• [ ] Store passwords with bcrypt, scrypt, Argon2, or PBKDF2

A03: Injection

Description

Hostile data sent to an interpreter as part of a command or query.

Examples

• SQL Injection
• NoSQL Injection
• OS Command Injection
• LDAP Injection
• XPath Injection
• Template Injection

Prevention

# WRONG - SQL Injection
query = f"SELECT * FROM users WHERE name = '{name}'"

# CORRECT - Parameterized query
cursor.execute("SELECT * FROM users WHERE name = ?", [name])

# WRONG - Command Injection
os.system(f"ping {host}")

# CORRECT - Use subprocess with list
subprocess.run(["ping", "-c", "4", host], capture_output=True)

# WRONG - Template Injection
template = Template(user_input)

# CORRECT - Safe templating
template = env.get_template("page.html")
template.render(user_data=user_input)

Detection Patterns

# Find SQL injection risks
rg "execute\(f['\"]|format\(|\.format\(" --type py

# Find command injection
rg "os\.system\(|subprocess\.(run|call|Popen)\([^,\[]*\+" --type py

A04: Insecure Design

Description

Missing or ineffective security controls from design phase.

Prevention

• Use threat modeling during design
• Integrate security requirements in user stories
• Use secure design patterns
• Write unit and integration tests for security controls
• Segregate tenants robustly

A05: Security Misconfiguration

Description

Missing or improper security hardening across the application stack.

Examples

• Default accounts enabled
• Unnecessary features enabled
• Error messages revealing stack traces
• Missing security headers
• Out of date software

Prevention

# Secure headers middleware
security_headers:
  Content-Security-Policy: "default-src 'self'"
  X-Frame-Options: "DENY"
  X-Content-Type-Options: "nosniff"
  Strict-Transport-Security: "max-age=31536000"

# Disable debug in production
DEBUG: false
ALLOWED_HOSTS: ["example.com"]

A06: Vulnerable and Outdated Components

Description

Using components with known vulnerabilities.

Prevention

# Python - pip audit
pip install pip-audit
pip-audit

# JavaScript - npm audit
npm audit
npm audit fix

# General - Snyk
snyk test
snyk monitor

# GitHub Dependabot
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"

A07: Identification and Authentication Failures

Description

Confirmation of user's identity and session management weaknesses.

Examples

• Permits brute force attacks
• Permits weak passwords
• Weak credential recovery
• Plain text or weakly hashed passwords
• Missing MFA
• Session IDs in URL

Prevention

# Rate limiting
from flask_limiter import Limiter

limiter = Limiter(app, key_func=get_remote_address)

@app.route("/login", methods=["POST"])
@limiter.limit("5 per minute")
def login():
    # Login logic

# Secure session configuration
app.config.update(
    SESSION_COOKIE_SECURE=True,
    SESSION_COOKIE_HTTPONLY=True,
    SESSION_COOKIE_SAMESITE='Strict',
    PERMANENT_SESSION_LIFETIME=timedelta(hours=1)
)

A08: Software and Data Integrity Failures

Description

Code and infrastructure without integrity verification.

Examples

• Insecure CI/CD pipeline
• Auto-update without verification
• Untrusted deserialization

Prevention

# WRONG - Pickle from untrusted source
import pickle
data = pickle.loads(user_input)  # RCE vulnerability!

# CORRECT - Use JSON for untrusted data
import json
data = json.loads(user_input)

# Verify signatures
import hmac

def verify_webhook(payload, signature, secret):
    expected = hmac.new(secret, payload, 'sha256').hexdigest()
    return hmac.compare_digest(expected, signature)

A09: Security Logging and Monitoring Failures

Description

Without logging and monitoring, breaches cannot be detected.

What to Log

• Login successes and failures
• Access control failures
• Input validation failures
• High-value transactions

Prevention

import logging

security_logger = logging.getLogger("security")

def login(username, password):
    user = authenticate(username, password)
    if user:
        security_logger.info(f"Login success: {username}")
        return user
    else:
        security_logger.warning(f"Login failed: {username}")
        raise AuthenticationError()

# Alert on suspicious patterns
if failed_logins_count > 10:
    security_logger.critical(f"Brute force detected: {ip_address}")
    alert_security_team(ip_address)

A10: Server-Side Request Forgery (SSRF)

Description

Application fetches remote resource without validating user-supplied URL.

Examples

• Accessing internal services
• Reading cloud metadata
• Port scanning internal network

Prevention

# WRONG - Direct URL fetch
import requests

def fetch(url):
    return requests.get(url)  # Can fetch internal URLs!

# CORRECT - Validate URL
from urllib.parse import urlparse

ALLOWED_HOSTS = {"api.example.com", "cdn.example.com"}

def fetch(url):
    parsed = urlparse(url)
    if parsed.hostname not in ALLOWED_HOSTS:
        raise ValueError("Host not allowed")
    if parsed.scheme not in ("http", "https"):
        raise ValueError("Scheme not allowed")
    return requests.get(url)

HTTP Security Headers

Essential security headers for web applications.

Complete Header Set

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self' https://api.example.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
X-XSS-Protection: 0

Content-Security-Policy (CSP)

Basic CSP

Content-Security-Policy: default-src 'self'

Detailed CSP Directives

CSP Values

'self'          - Same origin
'none'          - Block all
'unsafe-inline' - Allow inline (avoid!)
'unsafe-eval'   - Allow eval() (avoid!)
'strict-dynamic' - Trust scripts loaded by trusted scripts
'nonce-abc123'  - Allow specific inline with nonce
'sha256-...'    - Allow specific inline by hash
https:          - Any HTTPS URL
data:           - Data URLs

CSP for Common Frameworks

React/Vue/Angular (Production)

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' https://api.yourapp.com

With CDN

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net

Report-Only Mode

Content-Security-Policy-Report-Only: default-src 'self'; report-uri /csp-report

Strict-Transport-Security (HSTS)

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

• max-age=31536000 - Browser remembers for 1 year
• includeSubDomains - Apply to all subdomains
• preload - Submit to browser preload lists

Implementation

# Flask
@app.after_request
def add_hsts(response):
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
    return response

# Express
app.use(helmet.hsts({
    maxAge: 31536000,
    includeSubDomains: true,
    preload: true
}))

X-Frame-Options

X-Frame-Options: DENY

• DENY - Never allow framing
• SAMEORIGIN - Only same origin can frame
• ALLOW-FROM uri - Specific origin (deprecated, use CSP)

X-Content-Type-Options

X-Content-Type-Options: nosniff

Prevents MIME type sniffing. Always use this.

Referrer-Policy

Referrer-Policy: strict-origin-when-cross-origin

Permissions-Policy

Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()

Disable browser features you don't use:

Permissions-Policy:
  camera=(),              # Disable camera
  microphone=(),          # Disable microphone
  geolocation=(self),     # Only this origin
  payment=*               # Allow all

Implementation Examples

Python Flask

from flask import Flask

app = Flask(__name__)

@app.after_request
def add_security_headers(response):
    response.headers['Content-Security-Policy'] = "default-src 'self'"
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
    response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'
    return response

Python FastAPI

from fastapi import FastAPI
from starlette.middleware import Middleware
from starlette.middleware.httpsredirect import HTTPSRedirectMiddleware

app = FastAPI()

@app.middleware("http")
async def add_security_headers(request, call_next):
    response = await call_next(request)
    response.headers["Content-Security-Policy"] = "default-src 'self'"
    response.headers["X-Content-Type-Options"] = "nosniff"
    response.headers["X-Frame-Options"] = "DENY"
    return response

Node.js Express (Helmet)

const helmet = require('helmet');

app.use(helmet());

// Or with custom config
app.use(helmet({
    contentSecurityPolicy: {
        directives: {
            defaultSrc: ["'self'"],
            scriptSrc: ["'self'", "cdn.example.com"],
        }
    },
    hsts: {
        maxAge: 31536000,
        includeSubDomains: true,
    }
}));

Nginx

add_header Content-Security-Policy "default-src 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Testing Headers

# Check headers with curl
curl -I https://example.com

# Security header scanner
# https://securityheaders.com

# Mozilla Observatory
# https://observatory.mozilla.org

Quick Checklist

• [ ] CSP with restrictive default-src
• [ ] HSTS with 1 year max-age
• [ ] X-Frame-Options: DENY
• [ ] X-Content-Type-Options: nosniff
• [ ] Referrer-Policy set
• [ ] Permissions-Policy restricting unused features
• [ ] No X-Powered-By header (remove it)
• [ ] Test with securityheaders.com