https://gaetangrond.me/en/tags/security/ Recent content in Security on Gaëtan Grond https://gaetangrond.me/logo-2.png https://gaetangrond.me/logo-2.png Hugo -- 0.165.0 en-GB Tue, 08 Sep 2026 22:41:09 +0200 https://gaetangrond.me/posts/security/why-session-hijacking-remains-a-persistent-web-threat/ Mon, 14 Oct 2024 00:00:00 +0000 https://gaetangrond.me/posts/security/why-session-hijacking-remains-a-persistent-web-threat/ <p>Web Security is a significant concern for me. Over the past few years, I’ve been learning about ethical hacking and the broader field of web and server security and one topic that has always intrigued me is session hijacking.</p> <p>While many security threats, such as weak passwords, SQL injections, and cross-site scripting (XSS), have been mitigated and are relatively easy to fix, session hijacking remains a persistent threat. Its ease of exploitation and potential damage make it a serious risk to web applications.</p> https://gaetangrond.me/posts/django/protecting-data-in-django-admin-preventing-accidental-deletions/ Mon, 23 Sep 2024 10:20:23 +0200 https://gaetangrond.me/posts/django/protecting-data-in-django-admin-preventing-accidental-deletions/ <p>The Django admin interface is one of the standout features that make Django such a powerful framework. It allows you to manage your data, customers, and models with ease. However, as with any tool that provides significant control over your application’s data, there’s a need to ensure that sensitive actions like deletions are handled carefully.</p> https://gaetangrond.me/posts/django/how-to-add-mfa-to-django-allauth-in-under-5mn/ Wed, 13 Mar 2024 01:25:57 +0100 https://gaetangrond.me/posts/django/how-to-add-mfa-to-django-allauth-in-under-5mn/ Add TOTP multi-factor authentication to a Django project with django-allauth, from installation to custom templates, in about five minutes. https://gaetangrond.me/posts/dev/demystifying-the-3-2-1-backup-strategy/ Mon, 13 Nov 2023 17:48:20 +0100 https://gaetangrond.me/posts/dev/demystifying-the-3-2-1-backup-strategy/ The 3-2-1 backup rule explained without the marketing: what each copy really protects against, what it costs, and how I apply it to a production SaaS. https://gaetangrond.me/posts/security/beware-of-fake-vulnerabilities-reports-and-fear-mongering-tactics/ Sat, 14 Oct 2023 03:10:34 +0200 https://gaetangrond.me/posts/security/beware-of-fake-vulnerabilities-reports-and-fear-mongering-tactics/ <p>A few days ago I started receiving <strong>concerning emails</strong> directly to my work email address, the email was from a so-called bug bounty hunter that was claiming to have found a vulnerability in one of our products, the email was very generic and it was not clear what was the vulnerability, the only thing that was clear was that the person was asking for money to disclose the vulnerability.</p> https://gaetangrond.me/posts/django/understanding-idor-vulnerability-in-django/ Tue, 15 Aug 2023 00:45:40 +0200 https://gaetangrond.me/posts/django/understanding-idor-vulnerability-in-django/ <p>Django is by design very secure, most of the common vulnerabilities such as XSS, CSRF, SQL injection, clickjacking are fixed by the simple use of the framework, but there is one that is not fixed by default, and it is the <strong>Idor</strong> vulnerability.</p> <p>In this article we will see what it is and how to fix it.</p> https://gaetangrond.me/posts/django/secure-your-django-administration/ Thu, 03 Aug 2023 07:00:00 +0000 https://gaetangrond.me/posts/django/secure-your-django-administration/ <p>One of the most loved features of Django is the built-in administration interface. It allows for an easy way to manage your data and is highly customizable. However, it is also a very common target for attackers.</p> <p>In this article, we will look at some of the most common attacks against the Django administration interface and how to protect against them.</p> https://gaetangrond.me/posts/django/how-to-customize-csrf-failure-view-django/ Tue, 01 Aug 2023 13:02:50 +0200 https://gaetangrond.me/posts/django/how-to-customize-csrf-failure-view-django/ <p>When working with Django and third party libraries, you may encounter a CSRF error on login or any other form submission. This is because Django requires a CSRF token to be sent with every form submission except GET requests or if the form has the <code>csrf_exempt</code> decorator.</p> <p>During my work with Django, I have encountered this error many times, sometimes due to my own mistakes and sometimes due to third party libraries or user behavior.</p> https://gaetangrond.me/posts/security/secure-your-droplet-with-cloud-firewall/ Mon, 31 Jul 2023 23:32:32 +0200 https://gaetangrond.me/posts/security/secure-your-droplet-with-cloud-firewall/ A short, practical walkthrough for closing every port you do not need on a public server, before someone else finds them.