Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

create authentication system for "setRoomStatus()" function calls #3

Open
Jacob-Hunt opened this issue Jul 11, 2019 · 0 comments
Open
Labels

Comments

@Jacob-Hunt
Copy link

Jacob-Hunt commented Jul 11, 2019

Basically, make it so that each Raspberry Pi has its own login account/key. This could probably be done most effectively using the "Flask-Session" Python library (https://pythonhosted.org/Flask-Session/).

Also, HTTPS support should be added to the app, as this authentication-related communication should take place over an encrypted connection.

The way the app is coded right now, anyone with an internet connection can invoke the "setRoomStatus()" function in "flask_app.py" and add rooms that don't exist or interfere with the status of rooms that the Pi sensors are monitoring. A more serious implication of this is that it makes the site very vulnerable to cross-site scripting (basically, an attacker injecting malicious scripts into the HTML that gets sent to end-users).

Furthermore, to make development/debugging easier during the hackathon, HTTP "GET" requests were enabled; however, from a security perspective, this means that the "setRoomStatus()" function can be invoked from the URL address bar of Chrome, Firefox, or any other web-browser. The lines of code which allow for this should be commented out when not in use for development/debugging purposes.

@Jacob-Hunt Jacob-Hunt changed the title Security: create authentication system for "setRoomStatus()" function calls create authentication system for "setRoomStatus()" function calls Jul 11, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant