Skip to main content

Use of insecure channel - Source code

Need​

Secure transmission of customer information

Context​

  • Usage of Python 3 for writing and executing Python code
  • Usage of Django for building web applications in Python

Description​

Non compliant code​

from django.http import HttpResponse
from django.views import View

class CustomerInfoView(View):
    def get(self, request, *args, **kwargs):
        customer_info = self.get_customer_info()
        return HttpResponse(customer_info)

    def get_customer_info(self):
        # This is where you would normally interact with your database to get the customer info.
        # For simplicity, we're just going to return a static string.
        return "Customer Info"

In the above code, the CustomerInfoView class has a method get_customer_info which is supposed to interact with the database and get the customer information. This information is then sent as a HTTP response without any encryption.

This is a potential security vulnerability because the customer information is being transmitted over an insecure channel. If an attacker is able to intercept this transmission, they would be able to see the customer information in plain text. This could potentially lead to a breach of customer privacy and could also be a violation of data protection regulations.

The code is vulnerable because it does not use HTTPS for transmission which is a secure protocol that encrypts the data before transmission, ensuring that the data cannot be read if it is intercepted during transmission. It is generally a good practice to use HTTPS for any communication that involves sensitive information.

Steps​

  • Use HTTPS instead of HTTP for secure communication. Django supports this through the 'django-sslserver' package.
  • Enable Django's built-in security middleware 'django.middleware.security.SecurityMiddleware' to automatically handle some security features.
  • Set the 'SECURE_SSL_REDIRECT' setting to True in your Django settings. This will redirect all HTTP connections to HTTPS.
  • Use the 'SECURE_PROXY_SSL_HEADER' setting if your Django app is behind a proxy. This tells Django whether a request is secure or not.
  • Ensure that any third-party packages or middleware you're using also support HTTPS.

Compliant code​

# Install django-sslserver package
# pip install django-sslserver

# In settings.py
MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    #...
]

SECURE_SSL_REDIRECT = True
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

# In your views.py
from django.http import HttpResponse
from django.views import View

class CustomerInfoView(View):
    def get(self, request, *args, **kwargs):
        customer_info = self.get_customer_info()
        return HttpResponse(customer_info)

    def get_customer_info(self):
        # This is where you would normally interact with your database to get the customer info.
        # For simplicity, we're just going to return a static string.
        return "Customer Info"

The above code fixes the vulnerability by enforcing the use of HTTPS for secure communication.

Firstly, the 'django-sslserver' package is installed. This package provides SSL support for Django development server. It can be installed via pip.

In the settings.py file, Django's built-in security middleware 'django.middleware.security.SecurityMiddleware' is enabled. This middleware provides several security enhancements to the Django project.

The 'SECURE_SSL_REDIRECT' setting is set to True. This means that if a request is made over HTTP, it will be permanently redirected to HTTPS.

The 'SECURE_PROXY_SSL_HEADER' setting is used if your Django app is behind a proxy. This setting tells Django that a request is secure, even if it comes from a proxy that is not secure. The value is a tuple where the first element is the header to look for and the second element is the required value.

Finally, in the views.py file, the 'CustomerInfoView' class is defined. This class has a 'get' method that retrieves customer information and returns it as an HTTP response. The 'get_customer_info' method is a placeholder for the code that would interact with your database to get the customer info.

Remember to ensure that any third-party packages or middleware you're using also support HTTPS.

References​

Last updated on