Security in Donation Store

HTTPS and SSL Certificate

The first step in ensuring security on your Donation Store webstore is to install an SSL certificate. Please follow our SSL Certificate Installation Doc to get more information on how to setup an SSL cert on your webstore.

CSRF, XSS, SQL Injection and Clickjacking Protection

Donation Store is built on the Django framework meaning that it has built in security for CSRF (Cross Site Request Forgery), XSS (Cross Site Scripting), SQL Injection and Clickjacking.

CSRF protection works by checking for a secret in each POST request. This ensures that a malicious user cannot simply “replay” a form POST to your website and have another logged in user unwittingly submit that form. The malicious user would have to know the secret, which is user specific (using a cookie). Each form on Donation Store generates a unique token that is used for verification.

When using the templates found in Donation Store, most of the content is escaped to prevent people injection malicious code into it using XSS. This is why all template code, e.g {{ webstore.name }} should not have any custom tags or filters on it.

Donation Stores querysets are protected from SQL injection since their queries are constructed using query parameterisation. A query’s SQL code is defined separately from the query’s parameters. Since parameters may be user-provided and therefore unsafe, they are escaped by the underlying database driver.

Donation Store contains clickjacking protection in the form of the X-Frame-Options middleware which in a supporting browser can prevent a site from being rendered inside a frame. It is possible to disable the protection on a per view basis or to configure the exact header value sent.

Password Hashing

Donation Store uses the PBKDF2 algorithm with a SHA256 hash, a password stretching mechanism recommended by NIST. This is very secure and would require massive amounts of computing time to break.