Skip to main content

Use of an insecure channel - HTTP

Need​

Secure transmission of client information

Context​

  • Usage of Python 3 for writing and executing Python code
  • Usage of Django for building web applications

Description​

Non compliant code​

from django.http import HttpResponse
from django.views import View

class LoginView(View):
    def post(self, request, *args, **kwargs):
        username = request.POST['username']
        password = request.POST['password']
        # authentication code here
        return HttpResponse("Logged in successfully.")

The above Django view handles login requests. It takes a POST request and extracts the 'username' and 'password' from the request body. However, this happens over HTTP (port 80), which is an insecure channel.

The problem with this is that HTTP does not use encryption, meaning that the data is sent as plain text. This makes it easy for an attacker to intercept the data and read the contents. If this data includes sensitive information such as usernames and passwords, they can be stolen and misused.

In this case, the sensitive information is the username and password of a user trying to log in. If an attacker is able to capture these credentials, they could gain unauthorized access to the application and the user's data. This is a serious security risk and a breach of user trust.

Steps​

  • Switch from HTTP to HTTPS for secure communication. HTTPS encrypts the data sent between the client and the server, protecting it from eavesdroppers.
  • Obtain an SSL certificate from a Certificate Authority (CA). This certificate is used to establish a secure connection.
  • Configure your server to use the SSL certificate. This process varies depending on the server software you are using.
  • Redirect all HTTP traffic to HTTPS so that even if a user types in a URL with HTTP, they will be redirected to the secure HTTPS version.
  • Update your Django settings to use HTTPS. This includes setting the 'SESSION_COOKIE_SECURE' and 'CSRF_COOKIE_SECURE' settings to True to ensure that the session and CSRF cookies are only sent over HTTPS.
  • Ensure that the login form is served over HTTPS to prevent the user's credentials from being sent in plain text.

Compliant code​

from django.http import HttpResponse
from django.views import View
from django.conf import settings

class LoginView(View):
    def post(self, request, *args, **kwargs):
        username = request.POST['username']
        password = request.POST['password']
        # authentication code here
        return HttpResponse("Logged in successfully.", secure=True)

The updated code ensures that the client's information is transmitted over a secure channel (HTTPS) instead of an insecure one (HTTP).

The HttpResponse object has a secure parameter set to True. This ensures that the response will only be sent over a secure channel.

In the settings.py file, the SESSION_COOKIE_SECURE and CSRF_COOKIE_SECURE settings are set to True. This ensures that the session and CSRF cookies are only sent over HTTPS.

Remember, you also need to configure your server to use HTTPS and redirect all HTTP traffic to HTTPS. This process varies depending on the server software you are using.

Finally, ensure that the login form is served over HTTPS to prevent the user's credentials from being sent in plain text.

References​

Last updated on