現場で使えるDjangoのセキュリティ対策

This video features Akihito Yokose at DjangoCongress JP 2019 in Tokyo, Japan.

現場で使えるDjangoのセキュリティ対策
0:43:42
Published June 9, 2019
469 views

#django #python #programming

Speaker: Akihito Yokose

待望のバージョン2系の LTS がリリースされ、ますます現場で Django が盛り上がることが予想されますが、導入検討の際にネックになるものの一つに「セキュリティ」への懸念があります。
Django にはデフォルトでセキュリティ対策も含まれていますが、そのあたりの理解が中途半端だと、リリースした Webアプリが攻撃者の格好の餌食になってしまいかねません。そうならないためにも、Django のセキュリティ事情については開発前から(もちろん開発中でも)きちんと把握しておきたいところです。
そこで本発表ではまず、Django におけるセキュリティ対策の基礎について概観します。そして CSRF などの重要な(そして重要な割にあまりよく理解されていない)ものについては、「CSRF(しーさーふ)って何?」というレベルの人にも分かるように基本から解説します。

Transcript

1,837 words · auto-generated Show

Automatically transcribed, so expect mistakes in names and technical terms.

0:11

Speaker 1: The first part with one video, Jambo, and the first time. So it is a special. And we'll give you shouldn't. Hey, that's the most case. Hey,

0:56

Speaker 1: so that's so good. The cool handle I must add it up. Okay , actually, I'm not going to be able to do that. So I wasn't looking at your mind.

2:22

Speaker 1: The point is the web application security. IPA, you're also in Kiko, but this time of security, and I don't want to look at the motomi. And then we got up with you.

3:27

Speaker 1: Okay , we 're gonna go to the sky, it's got it, my mass. I can 't do now we have to be the happy opening. The security dice, then I'll get a DMS network , I state security like a code, more commands. Okay, HTTPS.

4:18

Speaker 1: Rasal for to see Digitizer, okay, so have the more digitized up , digitizer , which no one is not as a If Yosuk Rahin Joke Kandakatu, then the Yukonai to call the Kuikia bullet, you are not a good Okay, well , SKV injection ties a good, processing ties

5:05

Speaker 1: a good, she's outside. But for project when you don't discover the more song, to pay, and then say okay, what has to do, say what you can do. Москвы мечтается, кто все.

5:55

Speaker 1: I 'm not sashing. Injection to equate Christians

7:09

Speaker 1: This is all top blue top duo, miniature. Point to the slow, must point to the skate. Soudain, c'est tout, j'ai un pays à déplacer. As well , posado bewasty as well, no , see the top, poslow the novel boy. As to

7:54

Speaker 1: naquita As well that you go , but you should go , you're pee, malokin password , that 's just I'll then pass the voices. You go with us. И кондинаторизатослав, и у нас турби, посводой комнат, они секты с рукой, послал, килласы, посвоно чулами. Ariva, a kam troppo, a controputi ,

8:40

Speaker 1: the windows , and we didn't have a skinny, not trophoe. And you say it's a very good must set things right. You cancel that primo. So when you said to the validation laptop, the passport of set must be a good idea. We can create the user command. User creation form. C'est tout passe de phone. Taking to hold the meeting must go. Sitting

9:25

Speaker 1: sway no. Also password value does you hand so that someone list of the name the mass. А то , минималлин знает , хача мои же да будут нас. Самамила, я укажу поскольку листок и чисти на кампании. Yeah, I come to it.

10:10

Speaker 1: Jumbo access to your spirit and then you don't account for this. To you cut over here.

11:01

Speaker 1: Ariva! Skymaster wai , ladis to kovy, miotish like the putomous. Okay , you need gonna hear that. Romin, asload , mi asez. Să arăt! Scă naște pictuare, s-a mai aceata. Să o ești bine, bani aceita.

11:53

Speaker 1: Masami , you only come to Mandukka Shimash, Et j'en donne la taille de roi, au churron, tu as qu'il y a eu un peu Now I'm passionate about the same, but I'm gonna mistrenal. Signific o sandato, aștept aici, mama să încai. Tu ca. Selecci un cai stu, fără știți , o ei frug de chinele , știe masă.

13:09

Speaker 1: Fuyye nikma furintu ka. L'ouyu henga sala do youu katachimos vete. Kyu kyu k'salatimas So we can use that , set to password. This is a bit password. This is a following go.

13:55

Speaker 1: Sledging through, do you call the matters? Mahashawa Grover settings munapani. Pasaw hasha list of tape Access. Session can you can 't see it? But on the last easier ,

14:40

Speaker 1: took kyoska, took kinish, one session is a lot of the same discussion. Access to any other session , I will say. Along

15:25

Speaker 1: with a session ID to have the system to screen that you do , session ID , up there less. HTTPS, HDB can lose, and H station IDO could use. The cook kiva domain policio, seeking , you know, shall have the HTTPS or HTTP.

16:12

Speaker 1: Pourquoi c'est que tu as la même chose? Il prend des autres motions. Session IDO, you are the winning. HTTPS to HTTP , this session IDO scale. But I could say the book today, it's the shadow that could not be must.

17:24

Speaker 1: Project no yoken, you know, you don't describe the more HTTP S canvas options, session secure, and session cookies secure to hands the product. The cookie secure to get the cream discretion. Assessiva qui. Non la zero. Non sono assistiva che sarà scelto.

18:22

Speaker 1: Ah, jangul, as a couple. Mo eh Authentication middleware , we middleware. So, we get no request on my session ID, use the option of the premise, but we're going to be able to do this. So the right, you are you mark, case night, the we use a king in no pure from the middle of the mouse Vous avez dit le win d'icuaya de mixine, de l'icusine, le win d'icuaya

19:19

Speaker 1: But they are kissed. Aliva, the anishon to grudge to you know that the king of your kidu in lachino, or the kidmas.

20:16

Speaker 1: We like to cut USA. Can you talk? King of the motion of the key. Ah , masani. So we didn't want to do that. To you cutode. Accessively can't see the sea. Injection code came out the same play sack. We have an topic injection, nantupa injection, so it came

21:02

Speaker 1: up The mother, it's the look injection, you could and as you atom you see. So , injection cook to you know , you can use the screen to injection , it doesn't need to injection cook to the inject. Okay , we're going to injection.

21:54

Speaker 1: Jumo , ok , n'y contourne.

23:26

Speaker 1: Okay , nota is a lot of things. It 's HDP header injection. So you know, it's curious that the command. Aquí a Disney injectos. So you go with

24:12

Speaker 1: the mass. The responsible responsible. The point of hand you can side to cara. Hanshakini, I put my mass.

24:57

Speaker 1: Yeah, okay, location la cut that you 're not on the side, I must. Ay, yo photo, exceptionni, surisme. Una requestat, responsable. Utalina , right the code. It's the p response to a small, combat of the caracet of the

25:43

Speaker 1: Okay , I 'll do it. Okay, wait , it's console object from the colour of skill. So we're lazy mass. So you 're not going to do anything. But you can't do it. Record today.

26:29

Speaker 1: HTP Heta injection more big mass. Name hit the injection. O Tirabo é mayor. Send the mail to pa email. So you know, fix it in the sky.

27:25

Speaker 1: The cross-site of scripting, cross-site request of policy, click jacking , you know , cross-site of scripting, right? Giuliano , di questo là, scritto là, ci può sarebbe tutto là. Arriva, che j'am? No, dalle demo là, toro ste , dai demola, poi

28:11

Speaker 1: non il nostro But Django is a kostila. Как повторю, сказал хешруса.

29:22

Speaker 1: So watch a rap, I'll be gold. I'll give it small, I must say. Punce Maybe that script you are ready to make a to show katoka. You know what? So you can have this enough filter , it's not digital alias. You are still linking to the future to

30:07

Speaker 1: know alimas. Ariwa, session cookie HTTP on it, you hand the line.

30:52

Speaker 1: Ai , muita música. And that will you maybe meet up that more. But also requests to the door. View my true, none of you have to go on it. She's after we get a Nauri Master. Why? Catholic has this. But she crossed kind of request of forgery too. And we 're always in the

31:38

Speaker 1: cooking and a taiga. The cooking is cooking ID, but we're going to be able to do it. Eu me caoas și sangu , to iomul cu jamai canato, mai masă. Deci cum e o totă care și masă.

32:24

Speaker 1: So session to you, who's on the knife , use our longing jar , to the mass. Et questo va responsability , session ID là, c'est massacre.

33:14

Speaker 1: Kuna wana saitomi, yudošma i yudo sarteshma i onami tezdva onajona, ostovashumarate bai , konsistia idea, so mama skavar mask. So s top, you need to be questo top, who is the messenger.

34:08

Speaker 1: We unulato animals. Eja și s-a făcut în jolo, isti o list.

34:54

Speaker 1: Tem preto , tem preto ni size autofront, come , quando se sai massa. Post -equest on the buy like she was a good idea. So we didn't know. The changes are coming up. And room a me, no, eh non ghetto richto. Ci sta finendo, ma è solo. Si sta che con la remazione, che non ha me

35:46

Speaker 1: But there was a lot of the same. So stay message mode in the money. So still , remind them , we will grow. Cooking on the pani, cookies , society coming up , for no in photography, she saw me to come back. Суске, посторонних вестония.

36:37

Speaker 1: So sir to them la tam by the king, she's afraid so now. Parce que le moins pour cette guy , si ça photo, pour s'y insaler, c'est un coup de killé à ta si, si ça photo, on s'en est fait. Signor de Cristo , ataya no te sacou.

37:38

Speaker 1: If we could say , Oriki Thais , The quick thousand walk, to be in his gate, has an hour seven, you shouldn't have to meet we could be But it was talking more, a passive bypassion. Tovenatite, pois toi là, konjustate. If one thing is a question , head the lines, x-frame options for your headline must be. So

38:24

Speaker 1: response to your state , you can use the Defortos , sem hoje , não é da gente, né? Cell

39:09

Speaker 1: Anyway , to some stuff, you know, jump side of the secrets of more , are to run the IPA to become a web application no The IPA no, and then the website.

39:58

Speaker 1: J'ai un coach document on y va. Or se the kid on the maidaiba, deja se chin dai, of how should you know you're walking to that side. And she stayed in the way, Django stuff.

40:56

Speaker 1: So you do it. C'est son nom qui est autour de ce qui est massive. Allez, vous commencez à So

41:16

Speaker 2: she can't say something rarely moderate. It's more shit about.

41:31

Speaker 3: Jo, I got to let us eth or hormonal samples to move once that 's not going to be slimma. Это с моих сад , это не знаю. Ah, si ano. And also it might come in the night of the market. No , I'm not gonna

42:16

Speaker 3: care to see the old isn't it?

42:20

Speaker 1: She's not talking about the one that's gonna stop. So we can see how we didn't have another example. No, se ti va a essere là.

43:11

Speaker 1: Okay, what's the use of So you should put out the must so

43:18

Speaker 3: take so the scale ties to the mouth mode? So I will play masks.

Presenters

Note: We understand that names change, people change, and bodies change. We respect each individual's journey and privacy. If you have any concerns about a video or need us to remove content, please don't hesitate to contact us. We will handle your request with care and promptly address any issues.

More videos from DjangoCongress JP