Web Security

# csrf_protection.py, CSRF token implementation
from flask import Flask, session, request
import secrets
import hmac

app = Flask(__name__)
app.secret_key = secrets.token_hex(32)

# ── Server-side CSRF token ─────────────────────────────────────
def generate_csrf_token() -> str:
    """Generate a cryptographically secure CSRF token for the session."""
    if "csrf_token" not in session:
        session["csrf_token"] = secrets.token_hex(32)
    return session["csrf_token"]

def validate_csrf_token(token: str) -> bool:
    """Validate CSRF token using constant-time comparison."""
    expected = session.get("csrf_token", "")
    return hmac.compare_digest(expected, token)

@app.route("/transfer", methods=["GET"])
def transfer_form():
    token = generate_csrf_token()
    return f"""
    <form method="POST">
        <!-- CSRF token hidden field, must match session -->
        <input type="hidden" name="csrf_token" value="{token}">
        <input name="amount" placeholder="Amount">
        <input name="to_account" placeholder="Account">
        <button>Transfer</button>
    </form>
    """

@app.route("/transfer", methods=["POST"])
def transfer_submit():
    # ✅ Validate CSRF token before processing
    submitted_token = request.form.get("csrf_token", "")
    if not validate_csrf_token(submitted_token):
        return "CSRF validation failed", 403

    # Process legitimate request
    amount = request.form.get("amount")
    return f"Transfer of ${amount} processed"

print("CSRF Protection Summary:")
print("  1. Generate unique token per session")
print("  2. Include token in every state-changing form")
print("  3. Verify token on every POST/PUT/DELETE")
print("  4. Use SameSite=Strict cookies (next section)")
print("  5. Flask-WTF does all this automatically")

# security_headers.py, Flask middleware for security headers
from flask import Flask, make_response

app = Flask(__name__)

@app.after_request
def apply_security_headers(response):
    """Add comprehensive security headers to every response."""

    # Prevent MIME type sniffing
    response.headers["X-Content-Type-Options"] = "nosniff"

    # Prevent clickjacking, don't allow embedding in iframes
    response.headers["X-Frame-Options"] = "DENY"

    # Enable browser XSS filter (legacy, but harmless)
    response.headers["X-XSS-Protection"] = "1; mode=block"

    # Force HTTPS for 1 year (only on HTTPS sites)
    response.headers["Strict-Transport-Security"] = (
        "max-age=31536000; includeSubDomains; preload"
    )

    # Content Security Policy, restrict resource loading
    response.headers["Content-Security-Policy"] = (
        "default-src 'self'; "
        "script-src 'self'; "
        "style-src 'self' https://cdn.jsdelivr.net; "
        "font-src 'self' https://fonts.gstatic.com; "
        "img-src 'self' data: https:; "
        "connect-src 'self'; "
        "frame-ancestors 'none'; "
        "base-uri 'self'; "
        "form-action 'self'"
    )

    # Referrer policy, don't leak full URLs
    response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"

    # Permissions policy, disable unused browser features
    response.headers["Permissions-Policy"] = (
        "camera=(), microphone=(), geolocation=(), "
        "interest-cohort=()"
    )

    return response

# ── Secure cookie configuration ──────────────────────────────
@app.route("/login", methods=["POST"])
def login():
    response = make_response({"status": "logged in"})

    response.set_cookie(
        "session_id",
        value="abc123xyz",
        httponly=True,       # Not accessible via JavaScript, prevents XSS theft
        secure=True,         # Only sent over HTTPS
        samesite="Strict",   # Not sent in cross-origin requests, prevents CSRF
        max_age=3600,        # Expires in 1 hour
        path="/",
    )
    return response

print("✅ Security headers add browser-enforced protections")
print("✅ HttpOnly + Secure + SameSite=Strict is the gold standard for cookies")