{"action":"created","issue":{"url":"https://api.github.com/repos/carljm/django-secure/issues/31","labels_url":"https://api.github.com/repos/carljm/django-secure/issues/31/labels{/name}","comments_url":"https://api.github.com/repos/carljm/django-secure/issues/31/comments","events_url":"https://api.github.com/repos/carljm/django-secure/issues/31/events","html_url":"https://github.com/carljm/django-secure/issues/31","id":58897103,"number":31,"title":"Possible features: Check database security?","user":{"login":"puterleat","id":368269,"avatar_url":"https://avatars.githubusercontent.com/u/368269?v=3","gravatar_id":"","url":"https://api.github.com/users/puterleat","html_url":"https://github.com/puterleat","followers_url":"https://api.github.com/users/puterleat/followers","following_url":"https://api.github.com/users/puterleat/following{/other_user}","gists_url":"https://api.github.com/users/puterleat/gists{/gist_id}","starred_url":"https://api.github.com/users/puterleat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/puterleat/subscriptions","organizations_url":"https://api.github.com/users/puterleat/orgs","repos_url":"https://api.github.com/users/puterleat/repos","events_url":"https://api.github.com/users/puterleat/events{/privacy}","received_events_url":"https://api.github.com/users/puterleat/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-02-25T12:56:11Z","updated_at":"2015-11-20T19:45:33Z","closed_at":"2015-11-20T19:45:33Z","body":"I wonder if you've considered checking whether the user to which the app connects has \"too many\" privileges in the database, and whether the DB connection itself is secure. \r\n\r\nI just went through the process of testing whether my app on heroku was connecting to an Amazon RDS instance over SSL or not. It turns out that you can check this with the following code:\r\n\r\n    from django.db import connection\r\n    cursor = connection.cursor()\r\n    cursor.execute(\"show ssl\")\r\n    assert  cursor.fetchone()[0] ==  \"on\"\r\n\r\nProvided the sslinfo extension is running (see http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_PostgreSQL.html#PostgreSQL.Concepts.General.SSL) \r\n\r\nIt did also make me thing whether there are easy pickings, eg. to check that the app is not connecting to the DB as an admin user? It's kind of relevant when many people are doing their own sysadmin and dbadmin for small hobby projects.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/carljm/django-secure/issues/comments/158506002","html_url":"https://github.com/carljm/django-secure/issues/31#issuecomment-158506002","issue_url":"https://api.github.com/repos/carljm/django-secure/issues/31","id":158506002,"user":{"login":"carljm","id":61586,"avatar_url":"https://avatars.githubusercontent.com/u/61586?v=3","gravatar_id":"","url":"https://api.github.com/users/carljm","html_url":"https://github.com/carljm","followers_url":"https://api.github.com/users/carljm/followers","following_url":"https://api.github.com/users/carljm/following{/other_user}","gists_url":"https://api.github.com/users/carljm/gists{/gist_id}","starred_url":"https://api.github.com/users/carljm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/carljm/subscriptions","organizations_url":"https://api.github.com/users/carljm/orgs","repos_url":"https://api.github.com/users/carljm/repos","events_url":"https://api.github.com/users/carljm/events{/privacy}","received_events_url":"https://api.github.com/users/carljm/received_events","type":"User","site_admin":false},"created_at":"2015-11-20T19:45:33Z","updated_at":"2015-11-20T19:45:33Z","body":"Closing all open issues - I've decided not to continue maintaining django-secure as an external project, since all of its functionality was merged into Django 1.8, which is now (or will shortly be) the lowest supported Django version."}}