You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Basically, make it so that each Raspberry Pi has its own login account/key. This could probably be done most effectively using the "Flask-Session" Python library (https://pythonhosted.org/Flask-Session/).
Also, HTTPS support should be added to the app, as this authentication-related communication should take place over an encrypted connection.
The way the app is coded right now, anyone with an internet connection can invoke the "setRoomStatus()" function in "flask_app.py" and add rooms that don't exist or interfere with the status of rooms that the Pi sensors are monitoring. A more serious implication of this is that it makes the site very vulnerable to cross-site scripting (basically, an attacker injecting malicious scripts into the HTML that gets sent to end-users).
Furthermore, to make development/debugging easier during the hackathon, HTTP "GET" requests were enabled; however, from a security perspective, this means that the "setRoomStatus()" function can be invoked from the URL address bar of Chrome, Firefox, or any other web-browser. The lines of code which allow for this should be commented out when not in use for development/debugging purposes.
The text was updated successfully, but these errors were encountered:
Jacob-Hunt
changed the title
Security: create authentication system for "setRoomStatus()" function calls
create authentication system for "setRoomStatus()" function calls
Jul 11, 2019
Basically, make it so that each Raspberry Pi has its own login account/key. This could probably be done most effectively using the "Flask-Session" Python library (https://pythonhosted.org/Flask-Session/).
Also, HTTPS support should be added to the app, as this authentication-related communication should take place over an encrypted connection.
The way the app is coded right now, anyone with an internet connection can invoke the "setRoomStatus()" function in "flask_app.py" and add rooms that don't exist or interfere with the status of rooms that the Pi sensors are monitoring. A more serious implication of this is that it makes the site very vulnerable to cross-site scripting (basically, an attacker injecting malicious scripts into the HTML that gets sent to end-users).
Furthermore, to make development/debugging easier during the hackathon, HTTP "GET" requests were enabled; however, from a security perspective, this means that the "setRoomStatus()" function can be invoked from the URL address bar of Chrome, Firefox, or any other web-browser. The lines of code which allow for this should be commented out when not in use for development/debugging purposes.
The text was updated successfully, but these errors were encountered: