Security

Password Management

Password Hashing

• Django's Default Hashing:
  Passwords are hashed using PBKDF2 by default, as per Django's configuration. This ensures strong security for storing user credentials.
  • Salting: Django automatically salts passwords.
  • Customization: If needed, we can switch to other strong algorithms like bcrypt or argon2

Password Validators

• The following validators are enforced for secure password management:
  • Minimum Length Validator: Ensures passwords meet a minimum length for strength.
  • Common Password Validator: Prevents commonly used passwords.
  • Numeric Password Validator: Avoids passwords that are entirely numeric.

---

Authentication and Authorization

JWT Tokens

• Implementation:
  The project uses Simple JWT for token-based authentication.

  • Access Token Lifetime: 30 minutes.
  • Refresh Token Lifetime: 1 day.
  • Header Type: Bearer.
  • User Claim: The user_id field is included in JWT claims for identification.

• Endpoints:
  Protected endpoints require the Authorization: Bearer <token> header to access.

Role-Based Access Control

• Define roles and permissions for different user types (e.g. administrators, warehouse staff, QA personnel).
• Restrict access to APIs and UI elements based on user roles.
• Validate roles on both the backend and frontend.

---

API Security

Input Validation

• Input data is validated using Django REST Framework's serializers to ensure proper formatting and prevent injection attacks.

Rate Limiting

• Add rate limiting on sensitive endpoints in future iterations to prevent brute force attacks.

CSRF Protection

• Django’s built-in CSRF middleware is enabled for non-API endpoints to secure against cross-site request forgery.

---

Secure Communication

HTTPS

• All client-server communication will use HTTPS with TLS to encrypt data in transit. This will be enabled when moving to production.

Environment Variables

• Secrets like SECRET_KEY, database credentials, and JWT signing keys are securely stored in a .env file.
  • The .env file is excluded from version control using .gitignore.

---

Logging and Monitoring

Error Logging

• Use Django's logging framework to log security events, such as failed login attempts or invalid token usage.

Monitoring

• Integrate monitoring tools (e.g., Sentry) to track and respond to suspicious activities.

---

Development Practices

GitHub Security

• Branch Protection: Protect the main branch to prevent unauthorized changes.

---