Small security checklist for public backend services

Django

• Never use Meta.exclude because you may include fields in a form by accident. For the same reason, don't use the __all__ shortcut in fields.
• Django automatically escapes data dynamically inserted in templates. But you still need to quote all HTML attribute. For example, replace <a href={{link}}> with <a href="{{link}}">.
• Avoid the extra and execute functions of the ORM. The ORM will prevent SQL injection by default but with these you need to do the work manually.
• You can use secure.py to use standard security headers.
• Change the default admin URL to something else so it is harder to find for an attacker.
• Don't keep SECRET_KEY in version control. As a best practice, pick SECRET_KEY from the environment. Check out the django-environ package.

Django

This relies on django-cors-headers

from corsheaders.defaults import default_headers

# Security
# See https://github.com/adamchainz/django-cors-headers
CORS_ALLOW_HEADERS = default_headers
CORS_ORIGIN_WHITELIST = [FRONTEND_BASE_URL]
CORS_ALLOW_CREDENTIALS = True
# Both of these must be False so we can correctly use the CSRF token in
# our AJAX request.
# See: https://docs.djangoproject.com/en/3.1/ref/csrf/#ajax
# and https://www.django-rest-framework.org/topics/ajax-csrf-cors/
CSRF_USE_SESSIONS = False
CSRF_COOKIE_HTTPONLY = False
CSRF_TRUSTED_ORIGINS = env.tuple("CSRF_TRUSTED_ORIGINS", default=("localhost",))
CSRF_COOKIE_DOMAIN = env.str("CSRF_COOKIE_DOMAIN", "localhost")
# https://docs.djangoproject.com/en/dev/ref/settings/#x-frame-options
X_FRAME_OPTIONS = "DENY"
# https://docs.djangoproject.com/en/dev/ref/middleware/#x-content-type-options-nosniff
SECURE_CONTENT_TYPE_NOSNIFF = True
# https://docs.djangoproject.com/fr/3.1/ref/settings/#password-reset-timeout
PASSWORD_RESET_TIMEOUT = 1 * 24 * 60 * 60
# https://docs.djangoproject.com/en/3.2/ref/middleware/#module-django.middleware.security
SECURE_REFERRER_POLICY = "strict-origin-when-cross-origin"
# CSP settings
# https://django-csp.readthedocs.io/en/latest/configuration.html
CSP_DEFAULT_SRC = ("'self'",)
CSP_CONNECT_SRC = ("'self'",)
# To use for JS, CSS, images and fonts.
CUSTOM_CSP_STATIC_SRC = env.tuple("CUSTOM_CSP_STATIC_SRC", default=("'self'",))
CSP_SCRIPT_SRC = CUSTOM_CSP_STATIC_SRC
CSP_IMG_SRC = CUSTOM_CSP_STATIC_SRC
CSP_MEDIA_SRC = CUSTOM_CSP_STATIC_SRC
CSP_FONT_SRC = CUSTOM_CSP_STATIC_SRC
CSP_STYLE_SRC = CUSTOM_CSP_STATIC_SRC
CSP_BLOCK_ALL_MIXED_CONTENT = True
CSP_UPGRADE_INSECURE_REQUESTS = True
# https://docs.djangoproject.com/en/3.2/ref/settings/#secure-browser-xss-filter
SECURE_BROWSER_XSS_FILTER = True
# Secure connection
SECURE_REDIRECT_EXEMPT = [r"/?health/?"]
SECURE_SSL_REDIRECT = True
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True

NextJS

You can have the code below in your next.config.js:

const production = process.env.NODE_ENV === "production";

const getCsp = () => {
    let csp = ``;
    csp += `base-uri 'self';`;
    csp += `form-action 'self';`;
    csp += `default-src 'self';`;
    csp += `frame-src DOMAIN;`;
    // NextJS requires 'unsafe-eval' in dev (faster source maps)
    // sha256-XXXX is for XX service.
    csp += `script-src 'self' ${
        production ? "" : "'unsafe-eval'"
    } https://maps.googleapis.com 'sha256-XXX'`;
    // NextJS requires 'unsafe-inline'. Hash are not supported. Neither are nonce (the style tags are
    // not updated correctly. This can also be limited to our usage of MaterialUI.
    // Furthermore, since nonce must be generated at each request, we could get into issues with
    // caching for these public pages.
    csp += `style-src 'self' 'unsafe-inline' data: https://fonts.google.com https://fonts.googleapis.com https://client.crisp.chat;`;
    csp += `img-src 'self' data: blob: https://maps.googleapis.com https://maps.gstatic.com https://maps.googleapis.com https://storage.googleapis.com ${process.env.NEXT_PUBLIC_BACKEND_API_DOMAIN_URL};`;
    // noembed.com is required for ReactPlayer to work correctly.
    csp += `connect-src 'self' https://noembed.com wss://client.relay.crisp.chat;`;
    csp += `font-src 'self' https://fonts.gstatic.com https://client.crisp.chat;`;
    csp += `media-src 'self' https://storage.googleapis.com`;
    return csp;
};

const headers = [
    {
        key: "X-Content-Type-Options",
        value: "nosniff"
    },
    {
        key: "X-Frame-Options",
        value: "DENY"
    },
    {
        key: "X-XSS-Protection",
        value: "1; mode=block"
    },
    {
        key: "Content-Security-Policy",
        value: getCsp()
    }
];

let moduleExports = {
    async headers() {
        return [
        {
            source: "/(.*)",
            headers
        },
        {
            source: "/:path*",
            headers
        }
        ];
    },
};

nginx

I suppose that CSP in handled by the app itself (eg with Django's configuration).

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Permissions-Policy "interest-cohort=()" always;
add_header Cross-Origin-Opener-Policy  same-origin always;
add_header Cross-Origin-Resource-Policy same-site always;
add_header Cross-Origin-Embedder-Policy unsafe-none always;

csp-html-webpack-plugin

new cspHtmlWebpackPlugin(
    // We still need to have unsafe-inline to support old browser. Modern browser will just
    // ignore it if nonce or hash is set.
    {
    'default-src': ["'self'"],
    'connect-src': [
        `${apiUrl.host}`,
        '*.sentry.io',
        'o552216.ingest.sentry.io',
        'sentry.io',
    ],
    'style-src': ["'self'", "'unsafe-inline'", 'fonts.googleapis.com'],
    'font-src': ["'self'", 'fonts.gstatic.com'],
    'img-src': [
        "'self'",
        'data:',
        'maps.gstatic.com',
        'storage.googleapis.com',
        `${apiUrl.host}`,
    ],
    'script-src': [
        "'unsafe-inline'",
        "'self'",
        "'unsafe-eval'",
        'o552216.ingest.sentry.io',
        'sentry.io',
        'maps.googleapis.com',
    ],
    // report-uri is not supported in the meta tag.
    },
    // We must disable nonce and hash for styles. It's supported by styled-components
    // (see https://github.com/styled-components/styled-components/issues/887) but not easily
    // by material-ui (see https://material-ui.com/styles/advanced/#how-does-one-implement-csp)
    // Since all this is statically generated anyway, it defeats the purpose on nonce anyway
    // (see https://stackoverflow.com/questions/42922784/what-s-the-purpose-of-the-html-nonce-attribute-for-script-and-style-elements).
    // We leave hash for script since they won't budge after generation.
    {
        enabled: true,
        hashEnabled: {
            'script-src': true,
            'style-src': false,
        },
        nonceEnabled: {
            'script-src': false,
            'style-src': false,
        },
    },
)