Recap — Auth, Secrets, HTTPS, Common Mistakes

# Auth, Secrets, HTTPS, Common Mistakes Security can fill a career. This is the floor: the must-haves for any production system in 2026. ## HTTPS everywhere Plain HTTP is unacceptable in production. - **TLS 1.2+ minimum**; prefer 1.3. - **Free certs**: Let's Encrypt for free, auto-renewing. - **HSTS header**: `Strict-Transport-Security: max-age=31536000` — forces HTTPS forever. - **CDN-level TLS**: CDNs (Cloudflare) handle this for you. No exceptions. Internal services too (mTLS between services in zero-trust setups). ## Authentication patterns ### Password storage Never store plaintext or unsalted hashes. Use **bcrypt** (or argon2id) with proper cost factor: ```python import bcrypt hashed = bcrypt.hashpw(password, bcrypt.gensalt(rounds=12)) ``` Salt is per-password; rounds = 10-14 (slow on purpose). ### Sessions vs tokens **Server-side sessions**: - Session ID in cookie; server stores session data (Redis usually). - Stateful; revocation is easy (delete session). - Common for web apps. **JWT (JSON Web Tokens)**: - Self-contained; signed by server. - Stateless; no server lookup. - Hard to revoke (must use blacklist or short TTL). - Common for APIs. Trade-off: sessions are revocable but require server state; JWTs scale better but are harder to invalidate. In practice: use short-lived JWTs (15 min) + refresh tokens (longer, revocable). ### OAuth 2.0 / OpenID Connect Standard for "log in with Google/GitHub/etc.": - User authenticates with identity provider. - Provider issues access token + ID token. - Your app validates token; gets user info. Use libraries (passport.js, oauthlib); don't roll your own. ### Multi-factor auth (MFA) Two factors: - Something you know (password). - Something you have (phone, hardware key). TOTP (Google Authenticator), SMS (less secure), WebAuthn / passkeys (best). For any sensitive system: MFA mandatory for admins. ## Authorization (after authentication) **Authentication**: who are you? **Authorization**: what can you do? Patterns: - **RBAC** (Role-Based Access Control): users → roles → permissions. - **ABAC** (Attribute-Based): policy evaluates user/resource attributes. - **ACL** (Access Control List): explicit per-resource permissions. Check authorization at every endpoint, not just login. Never rely on "user can't see this button" — they can call the API. ```python @require_role("admin") def delete_user(user_id): ... ``` ## Secret management Never commit secrets to source control. Common mistake. Patterns: - **Environment variables**: simple; OK for non-production. - **Secret managers**: AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager. - **K8s secrets**: built-in; encrypted at rest. For local dev: `.env` files (gitignored). Rotation: - DB passwords, API keys, signing keys — rotate periodically. - After any suspected leak: rotate immediately. ## OWASP Top 10 (must know) 1. **Broken access control**: most common. Always check authz. 2. **Cryptographic failures**: bad crypto (homegrown algo, weak hash). 3. **Injection (SQL, NoSQL, OS)**: use parameterized queries; never concatenate user input. 4. **Insecure design**: missing rate limits, no audit logs. 5. **Security misconfiguration**: default passwords, exposed admin panels. 6. **Vulnerable components**: unpatched libraries. 7. **Auth failures**: weak passwords allowed, bad session management. 8. **Software/data integrity**: untrusted code in dependencies. 9. **Logging/monitoring failures**: no audit trail. 10. **SSRF (Server-Side Request Forgery)**: server fetches user-controlled URLs. ## SQL injection Don't: ```python query = f"SELECT * FROM users WHERE id = {user_id}" # injection! ``` Do: ```python cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,)) ``` ORMs (SQLAlchemy, Django ORM) parameterize by default. ## CSRF (Cross-Site Request Forgery) Attacker tricks user's browser into submitting a request to your site (user is logged in; cookies sent). Protection: - CSRF tokens on forms. - SameSite=strict cookies. - Check Origin/Referer headers. ## XSS (Cross-Site Scripting) Attacker injects JS into your page; runs in other users' browsers. Protection: - Escape output (most frameworks do this). - Content Security Policy headers. - Avoid innerHTML; use textContent or framework binding. ## Common security mistakes 1. **Storing passwords plaintext or with weak hash.** 2. **Not using HTTPS.** 3. **Secrets in source control.** 4. **No rate limiting on auth endpoints.** Brute-force attacks succeed. 5. **Returning specific errors** ("invalid password" vs "invalid email") — username enumeration. 6. **Logging secrets / passwords.** Audit logs leak. 7. **Trusting user input.** No validation; injection paths. 8. **Skipping authz checks** ("the URL is hidden"). Security by obscurity fails. 9. **Outdated dependencies.** CVEs in old libraries. 10. **Not having an incident response plan.** ## Security as a process - **Threat modeling**: think through attacker capabilities. - **