WebAppSec/MozSecureWorld

Purpose

A running web application to demonstrate major security paradigms used within Mozilla web applications and security capabilities of modern browsers.

Uses

• Demonstration of secure application design
• Explanation of importance and purpose of security features
• Learning tool for others to reference
• Testing site to validate effectiveness of security & design recommendations
• Evaluation tool for pen testing individuals or tools

Design

Architecture

Python on Django via Playdoh

Security Components & Controls

Authentication

• Brute force prevention via adaptive CAPTCHA
• Password storage via bcrypt and system nonce
• Account creation with blacklisted password support
• (Possible) Secure Password Reset

How

• Login with database and different users

Access Control

• Presentation, Business, Data Layer Access Control
  • Presentation and Data layers use decorators
  • Read about presentation layer protection
• (Possible) Two tier design for admin account separation
  • The picture of separate control of changing passwords

Input Validation

• Rich text handling via bleach
• File upload support via secure file handling guidelines
• File Handling
• SQL
• Content Security Policy
  • outsource all javascript source! for the CSP demo as 2nd barrier beyond escaping characters
• (Possible) Third party service
• (Possible) Third party hosted images. Initial processing and per visit processing?

Transport Security

• Full & correct TLS
• HTTP Strict Transport Security

How

• Follow these rules

Cross Domain Controls

• X-frame-options in header options

Cookie Protection

• Secure Flag
• HTTPOnly Flag

Roadmap

1. X Setup [playdoh] & github
2. X Running HelloWorld
3. X Design Planning
4. Make "about" pages for each bullet above
   • have a generic django template
5. Code basic item first (x-frame-options, secure flag, httponly flag)
6. Use bleach for rich text.
7. add decorators for data and business layers
8. read about presentation layer
9. Complete initial presentation layer and CSS for basic item
10. Setup backend database
11. Authentication/login
12. File upload stuff

Links References

https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines