3 ms·

Depends what you mean by "secure": do you mean protecting against attacks or do you mean impenetrable transfer and storage of information? For protecting again

Depends what you mean by "secure": do you mean protecting against attacks or do you mean impenetrable transfer and storage of information? For protecting against attacks, the absolute rule is: Never trust anything that the user has provided. This includes form submission, URLs for requests (i.e. it could be a malformed URL), the HTTP headers, the cookies, etc. They are all vectors for an attack. The corollary to this is: validate everything. From here, you can start learning more about the creative ways your app can be exploited. For securely transferring and storing information, you'll need to look at encryption strategies like SSL and hashes (for, e.g., passwords) and the like. Of course we can only point you in the general direction. This is a very big topic!

diN0bot 17y ago
true. i am at once torn between consuming this large topic and beefing up the few links in the chain that i am currently working on. i'm looking forward to getting some of the above mentioned books from the library sometime, yet i also know i'm on a tight schedule and it's hard enough to sneak engineering goodness tasks into each iteration (tests get on fine, though). getting my server hacked into is certainly on my mind as i set up the server myself only out of necessity and poverty (if not financial then creative and social). i really want the data to remain private. i have form submission secured. not only does django escape input into sql, but i have a pre-save signal that removes html tags. once concern i do have is that when a form has an error in it, the page is reloaded with the previously entered form values. i believe django templates always escape variables, but i should try writing javascript there just to make sure. django also stores salt + hashes of user passwords, rather than the passwords themselves. django also puts non-critial information in session cookies. the real data gets looked up in the view middleware.

diN0bot 17y ago

true. i am at once torn between consuming this large topic and beefing up the few links in the chain that i am currently working on. i'm looking forward to getting some of the above mentioned books from the library sometime, yet i also know i'm on a tight schedule and it's hard enough to sneak engineering goodness tasks into each iteration (tests get on fine, though). getting my server hacked into is certainly on my mind as i set up the server myself only out of necessity and poverty (if not financial then creative and social). i really want the data to remain private. i have form submission secured. not only does django escape input into sql, but i have a pre-save signal that removes html tags. once concern i do have is that when a form has an error in it, the page is reloaded with the previously entered form values. i believe django templates always escape variables, but i should try writing javascript there just to make sure. django also stores salt + hashes of user passwords, rather than the passwords themselves. django also puts non-critial information in session cookies. the real data gets looked up in the view middleware.