Securing Django Applications

Course details

The protection of user privacy and data is a clear mandate for business success. In this course, learn how to protect your Django web app using essential security and authentication measures. Using a sample project—a pre-built Django web app and a REST API for that web app—instructor Rudolf Olah shows how to add code that keeps your app safe from cyberattacks. Discover how to add SMS two-factor authentication, set up per-object permissions, and leverage per-group permissions to allow groups of users to access, modify, and delete data. Plus, learn how to create audit logs for compliance, implement zero-knowledge encryption, write a unit test to ensure that server data is fully encrypted for a user, and more.

Concepts

Introduction

Security and Django
What you should know
What's included in the project
Installing the project
Running the server

Permissions, Access Controls, Activity Logs

Setting up per-object permissions in Django
Enabling per-object permissions in Django
Unit test for per-object permissions in Django
Creating a group permissions model
Unit test for access control and group permissions
Adding activity logs for auditing
Deleting objects in an audit_compliance-compatible way

Throttling a Flood of Requests

Using ApacheBench to simulate a flood of requests
How to ensure actions happen only once
Unit testing idempotent actions that should only happen once
Using background queues to throttle floods of requests
Unit testing background queue flood prevention

Protecting Data and Data Privacy

Per-field encryption of data in Django
Unit testing per-field encryption
Zero knowledge encryption of data in Django
Unit testing zero knowledge encryption
Packaging user data for download

2FA - Two-Factor Authentication

Using Twilio to send an SMS code
Confirming SMS code and enabling 2FA
Validating 2FA login before performing actions in Django
Unit testing 2FA login requirement for Django REST API

CSRF - Cross-Site Request Forgery Protection

Enabling CSRF tokens in Django
Unit testing Django forms that use CSRF

Conclusion

Next steps