This week i focus to web security. I read blogposts watch videos . As far as i know ecto queries protect us from SQL injection, changesets filters forms, phoenix sanitizes user inputs to prevent XSS. In additon to these never fetch a file from a url param, sanitize inputs in frontends too, never har…

See Securing Rails Application . I know it’s neither Elixir nor Phoenix, but the basic ideas about security are the same. You just need to implement these ideas with Elixir/Plug/Phoenix if they are not implemented by default.

Make sure you don’t log sensitive things like passwords or PII. I added opt in logging for query parameters to Phoenix a while ago, where you have to be explicit about which things you allow to be logged. config :phoenix, :filter_parameters, {:keep, ["id", "order"]}

Also don’t forget… [image] Sobelow - Uncover vulnerabilities in your Phoenix projects Discussions Sobelow Sobelow is a security-focused static analysis tool for the Phoenix framework. For security researchers, it is a useful tool for getting a quick view of po…

@aethereus rails guide is good thanks @blatyo I never thought about logs, really important thing. @AstonJ @griffinbyatt having a elixir library is really nice.

“Secure” distribution If your app is distributed over multiple machines, make sure the nodes communicate over a secure channel like vpn (almost every cloud provider supports some sort of private networking) or tls [1, 2] (if you use several cloud providers for your app and it needs to keep a shared …

A good resource is OWASP. Here’s a checklist of good coding practices: [image] OWASP Secure Coding Practices-Quick Reference Guide | OWASP Foundation OWASP Secure Coding Practices-Quick Reference Guide on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that wo…

In addition to the application, there is a lot that you can do to add security when deploying it: Improving app security with the principle of least privilege Phoenix’s ability to proxy connections efficiently allows some very interesting architectures for better security: Secure web applications w…

Happily working my way through this thread and all the suggestions and resources posted in it. It has been a few years since the last posts. Any new suggestions and resources for those of us (including me) that are trying to learn the ins and outs of applied web/Phoenix security in 2022?

We are migrating our SaaS application to LiveView and this documentation helped a lot. https://hexdocs.pm/phoenix_live_view/security-model.html In our case we use Guardian + Ueberauth.

Don’t forget to secure on a server level too, disable root login or use passwordless authentication, change SSH ports, block unused ports in your firewall, consider installing software like fail2ban/Denyhosts etc. Usually your host will have tips/guides on how to do it for your OS, or they may even…

How to secure a Phoenix app?

Questions & Help Questions

AstonJ June 9, 2018, 1:10am 4

Also don’t forget…