algrizz / bibify-coursera-group2 Goto Github PK

View Code? Open in Web Editor NEW

0.0 1.0 0.0 123 KB

Simple Messaging System for the Coursera Security Capstone Project

License: GNU General Public License v3.0

Python 39.37% HTML 56.96% CSS 3.67%

bibify-coursera-group2's Introduction

What is this? A Secure Message Board project This is a very simple but secure message board system.

What have you consider?

You can use any password. The only requiremens is that it should be at least 8 chars long. Spaces, phrases are accepted
Email of the user must be confirmed before using the system
It's mandatory to used two factor authentication
The password is hashed before inserting it in DB
A lot of SQL inyection test have been made

How do I use it: Two options: a) Use it online at: http://coursera.acostasite.com:8000/

b) Install using the following procedure:

Requirements:

Flask (apt-get install python-pip3; pip3 install Flask)
Python3
MySQL (apt-get install mysql-server)
MTA (Email Server) (in my case using Postfix in the same server) (apt-get install postfix)

Clone repository git clone https://github.com/alejandroacostaalamo2/courseracybersecurity
Create the DB cd courseracybersecurity mysql -u root -p -e "create database COURSERA"; mysql -u root -p -h localhost COURSERA < schema.sql CREATE USER 'root'@'localhost' IDENTIFIED BY 'coursera'; (probably already have these users) CREATE USER 'readonly'@'localhost' IDENTIFIED BY 'coursera'; (probably already have these users) GRANT ALL PRIVILEGES ON * . * TO 'root'@'localhost'; GRANT ALL PRIVILEGES ON * . * TO 'readonly'@'localhost';

Running: Just type: python3 index.py

Do you want a snapshot of the DB?. A daily copy is generated and can be downloaded rigth here: http://coursera.acostasite.com:8000/DB/db_backup.sql

TODO

Second factor auth could be just a code, not a link. Maybe to have both options
Link for confirmation could be just a code, not a link. Maybe both options
Change password (however you can use: lost password)
Some mechanishm like garbage collector should exists for cleaning the DB (when user is not confirmed and so on)
Encrypt the full DB?
HTTPS Web site

bibify-coursera-group2's People

Contributors

Watchers

bibify-coursera-group2's Issues

[Enhancement] Send Message to multiple users

[Enhancement] Improve UI for reading messages

[Basics] Account Verification

Account Verification for the mailing app

This issue is a cross-functional story that includes all the possible interactions from UI/UX, Frontend Logic, Backend Logic and Database

This issue doesn't directly validate any Evaluation Criteria, but is required for properly satisfying:

Registration Page Functional (7/13)
Login Page Functional (9/13)

Description

A user, having previously registered and having received a verification e-mail clicks on the link provided and his account is verified

Components Requirements

UI/UX Design

The UI will need to provide an appropriate landing page when the user gets to the app following the verification link
The UI will have to show appropriately the response from the server as described for the frontend logic below

Frontend Logic

The Frontend logic should wait for the server response and:
- If the verification link was correct, redirect the user to the sign in page
- If the verification code didn't exist, prompt this to the user and give him the option to navigate to home or register
- If the verification code has expired, offer to resend a verification link

Backend Logic

The /verify endpoint is present and only admits GET requests
The /verify endpoint validates the received requests to check inputs
- If the verification token is stored in the database and hasn't expired, send the success response
- (optional) If the verification token is stored in the database but has expired, send error indicating it
- If the verification token is not stored in the database send the error response
(Optional) Send a welcome/confirmation e-mail when the account is verified

Database

The table to store verification tokens is present
(optional) Expiration management for the verification tokens
(optional) Garbage collection for removing unverified users

Acceptance Criteria

❌ All the basic UI/UX Design Requirements are met
❌ All the basic Frontend Logic Requirements are met
❌ All the basic Backend Logic Requirements are met
❌ All the basic Database Requirements are met

Complete flow checks

❌ As a user having previously registered, I can use the verification link to verify my account and when I do so, I get the confirmation
❌ As a user not having previously registered I try to send a random verification code to the server. This should be filtered and the error sent so the Frontend can offer to go to home or registration

Optional Improvements

❌ As a user having previously registered, I try to use an old (but not too old) verification link to verify my account. I should be offered to resend a verification link.
❌ As a user having previously registered, I try to use a very old verification link to verify my account. The code should no longer exist and the user will be able to register again with the same e-mail/password

[Basics] Database Dump

Database Dump for the other teams to see its structure

This issue is a project requirement so the other teams can analyse the DB structure to better organize their attacks. It is requested that the endpoint /dbdump allows any user to download a copy (which should be encrypted) of the database

This issue validates the following Evaluation Criteria:

Database dump from /dbdump is successful? (2/13)

Description

Any user will be allowed to download an encrypted copy of the database. (We have to verify if it is the whole database or if we can send only the messages table).

This issue does not cover Database Encryption, which will have its own issue.

Components Requirements

UI/UX Design

There is no requirement to create a page for this

Frontend Logic

There is no requirement to create a page for this

Backend Logic

The /dbdump endpoint should be present and should provide a copy of the database on request
- The traffic has to be over https anyway, so cookies for logged in users accessing the endpoint don't get leaked

Database

The database should be exportable in a usable way

Acceptance Criteria

❌ All the basic Backend Logic Requirements are met
❌ All the basic Database Requirements are met

Complete flow checks

❌ As any user, I can visit /dbdump and get my free copy of the database

Optional Improvements

❌ Only Message Table is sent over when asked for the database

[Enhancement] Improved feedback on registration form

User Registration for the mailing app

This issue is a cross-functional story that includes all the possible interactions from UI/UX, Frontend Logic, Backend Logic and Database

Description

A user coming to the mailing app should be able to register. Instead of a plain registration form, it will be shown a rich interactive form that will let him know if the user/e-mail He selected are already in use, if the password He selected is OK to use, etc.

Components Requirements

UI/UX Design

The UI will need to accommodate gracefully the form feedback to the user

Frontend Logic

The Submit button will be disabled until all the required fields are filled with valid values
Online Feedback should be provided for existing users and invalid inputs (rather than to depend on the server sending an error in response to a submit with invalid values)

Backend Logic

The /check-username and /check-email endpoints are present and admit GET requests to determine if one username/email are already registered
The /check-password is present to check the password sent is against a list of known bad passwords. Both Frontend and Backend implements the checkings to avoid bypassing of the input control in frontend.

Database

The database is structured in a way that allows the previously mentioned interactions
The list of known bad passwords is stored in the database

Acceptance Criteria

❌ All UI/UX Design Requirements are met
❌ All Frontend Logic Requirements are met
❌ All Backend Logic Requirements are met
❌ All Database Requirements are met

Complete flow checks

❌ As a new user I can fill the registration form and get automatic feedback on the fields I need to fill and invalid values

[Basics] Make Code Repository Available

Make Code Repository Available for other teams to download

This issue is just a sanity check validation for the submission so the project can be evaluated by the rest of the teams and the instructors

This issue validates the following Evaluation Criteria:

Code Repository is Downloadable? (1/13)

Acceptance Criteria

✔️ Public Github repository created
❌ Public Github repository made available in the work submission (Not to be done until first milestone)

[Basics] User Registration

User Registration for the mailing app

This issue is a cross-functional story that includes all the possible interactions from UI/UX, Frontend Logic, Backend Logic and Database

This issue validates the following Evaluation Criteria:

Registration Page Present (6/13)
Registration Page Functional (7/13)

Description

A user coming to the mailing app should be able to register. To do so, it will be requested some personal information like First and last name, username and the e-mail and password for registration.

This issue does not cover password encryption prior to storage in the database as that will be a different issue on its own.

This issue does not cover account verification, it will be an issue on its own

Components Requirements

UI/UX Design

The UI will need to include a button on the landing page allowing the user to click on a "register" button
A Registration dialog or form should be created to collect the new user's information, with a "submit" button to send the information to the server
Feedback should be provided for existing users and invalid inputs
A confirmation/Error dialog should be provided on submission

Frontend Logic

The click on the register button should activate/navigate/show the registration form
When the submit button is clicked, the form contents are validated, sanitized and sent to the server on /register
When the server response arrives the correct message (success/failure) is shown/loaded

Backend Logic

The /register endpoint is present and only admits POST requests
The /register endpoint validates the received requests to check inputs and avoid collisions
The correct response is generated based on the received input
If the inputs were correct, an e-mail will be generated and sent to the given email address

Database

The users table is present to store/check the usernames/emails
The passwords table is present to store the received passwords

Acceptance Criteria

Complete flow checks

❌ As a new user I can fill the registration form and I get a confirmation email sent to my email address
❌ As a user, I can not register using an existing username/password

[Basics] Web Access

Accessing the web for evaluation

This issue is functional requirement for the Capstone Project

This issue validates the following Evaluation Criteria:

Can you access the website? (4/13)

Description

As a member of other team, or instructor, or anyone passing by, I should be able to remotely access the web application so I can use it

Components Requirements

Infrastructure

The Web Server should be accessible and able to serve the public files in order for the main browsers to access the app

Acceptance Criteria

❌ Access from all members of the team verified
❌ Access at least from Chrome, Firefox and Safari verified

[Basics] Send Messages

Message Sending for the mailing app

This issue is a cross-functional story that includes all the possible interactions from UI/UX, Frontend Logic, Backend Logic and Database

This issue validates the following Evaluation Criteria:

Page to send messages is present (12/13)
Messages are successfully sent to the recipient (13/13)

Description

A user, having previously logged in, decides to send a message to another user (or to himself). He should be able to write a new message, select the recipient, the subject and write the body for the message. When He's done, He can submit the message clicking a button and receive confirmation of the operation.

This issue does not cover Database Encryption, as it is considered in an issue of his own

Components Requirements

UI/UX Design

The UI will need to provide an appropriate way to start writing a message (for the basic version, a general button)
The UI will need to provide a writing form with the fields of recipient, subject and body
The writing form will have two buttons, cancel and send

Frontend Logic

The Frontend logic should respond to a click on the new message by showing the message write form
The Frontend logic will then wait for the user to click on discard or send buttons:
- Discard will clear the message and empty its contents, nothing will be sent to the server
- Send will process the message (validate inputs, encode) and send it to the server
The Frontend logic should inform the user of the request status (sending, accepted, rejected)

Backend Logic

The /new-message or /send-message endpoint will be present and will only accept POST requests
When a request is received to this endpoint, the request fields will be validated to avoid XSS or SQL injection
- If the validation is correct, the message will be stored in the database
- If the validation is not correct, an error response will be sent

Database

The table to store messages is present

Acceptance Criteria

Complete flow checks

❌ As a logged in user, I should be able to create a new message and send it to another user (or myself). The message should appear in his mailbox when he logs in.
❌ As a non-logged in user, I should not be able to write messages at all

[Basics] Database Encryption

Encryption mechanism for the mailing app database

This issue only concerns Backend Logic and Database

This issue validates the following Evaluation Criteria:

Are messages in the database encrypted? (3/13)

Description

As a developer, I want my database to be protected against intruders so if anything was to compromise the security of the server they can not access the data. The minimum requisite is to encrypt the messages, but encoding the whole database will provide better protection and shouldn't increase complexity significantly.

Components Requirements

Backend Logic

The backend should be able to read keys from a protected text file stored in the server and use these keys to access and decrypt the database

Database

The database should implement encryption and can only be accessed using the correct keys

Acceptance Criteria

❌ All the basic Backend Logic Requirements are met
❌ All the basic Database Requirements are met

Complete flow checks

❌ As an attacker, I should not be able to obtain the keys to access or decrypt the database

[Enhancement] Improved Key storage for the database access and encryption

Encryption mechanism for the mailing app database

This issue only concerns Backend Logic and Database

Description

As a developer, I want my database to be extremely protected against intruders so if anything was to compromise the security of the server they can not access the data.

To do so, the server key vaults or something similar need to be used

Components Requirements

Backend Logic

The backend should be able to store and read keys from the secure vaults in the system in order to access the database

Database

The database should implement encryption and can only be accessed using the correct keys

Acceptance Criteria

❌ All the basic Backend Logic Requirements are met
❌ All the basic Database Requirements are met

Complete flow checks

❌ Implemented the secure vault storage for the database keys

[Basics] Read Messages

Message Sending for the mailing app

This issue is a cross-functional story that includes all the possible interactions from UI/UX, Frontend Logic, Backend Logic and Database

This issue validates the following Evaluation Criteria:

Page to see messages sent to the user is present (10/13)
Messages to the user are actually shown on the messages page (11/13)

Description

A user, having previously logged in, wants to read the messages addressed to him. To do so, He visits the /mailbox and the list of his received messages is shown in the page

This issue does not cover Database Encryption, as it is considered in an issue of his own

Components Requirements

UI/UX Design

The UI will need to provide an appropriate way to visualize received messages

Frontend Logic

The Frontend logic should be able to retrieve the messages addressed to the user and populate the UI with the list of messages
If the user has no new messages an empty indicator should be displayed (or better, we can "send" an internal message to the user upon registration so there is something to show)

Backend Logic

The /get-messages endpoint should be present in the backend and should only accept GET requests
The url parameters, if any, should be validated by the server before responding:
- If the parameters are OK, the messages are sent back to the client
- If they are not OK an error is returned

Database

The table to store messages is present

Acceptance Criteria

Complete flow checks

❌ As a logged in user, I should be able to read the messages addressed to me. They should appear in my mailbox
❌ As a non-logged in user, I should not be able to see messages at all

[Enhancement] Password Reset

User Login for the mailing app

This issue is a cross-functional story that includes all the possible interactions from UI/UX, Frontend Logic, Backend Logic and Database

Description

An existing user having forgotten my password (or having blocked my account with too many retries if that feature is implemented) I want to reset my password. To do so, I must be sent an email and following it I will get to a form to introduce a new password. The validity of these links should be controlled in the same way as the mail verification.

Components Requirements

UI/UX Design

The UI will need to include a reset password link in the login dialog
There should be a reset password form

Frontend Logic

The click on the reset password link should make a message appear saying the password reset link has been sent to the stored e-mail address of the user
- If the mail/username field is empty or doesn't correspond to an existing user, it should be informed
By following the link in the email the new password form should appear, and the password validation done in the same way as for the register.
After the submission of the form, the user should be redirected to the home page

Backend Logic

The /reset-password endpoint should be present and should only accept GET requests
- The parameter for this GET request will be inserted in the reset link and will be a unique token just as for the email verification
The backend should handle the reset tokens in the same way it handles the verification tokens, including expiry times if implemented
On a successful password reset a confirmation mail is sent to the user

Database

The database will support the account status and token storage to allow for this feature to work

Acceptance Criteria

❌ All UI/UX Design Requirements are met
❌ All Frontend Logic Requirements are met
❌ All Backend Logic Requirements are met
❌ All Database Requirements are met

Complete flow checks

❌ As a user having forgot my password I click on the reset password button. I receive an e-mail to reset my password. Clicking in the link sent I land in the reset password form and when I submit the form with the new password I receive a confirmation email and can login normally using my new password

[Basics] Session Management

Message Sending for the mailing app

This issue is a cross-functional story that affects mainly Backend Logic and Database

Description

As a developer, I want the security of the communications to be maintained during all transactions from the server. To do so, session management is key.

The session should be maintained through session tokens stored securely in the database and provided by the server as described in Session Management

This issue does not cover Database Encryption, as it is considered in an issue of his own

Components Requirements

Backend Logic

The backend should ensure the all the traffic is done over HTTPS to avoid leaking cookies over a non-encrypted channel
Cookie Management:
- A user without cookie should be given a new cookie and that cookie assigned to anonymous
- A user with an invalid cookie is seen as a user without cookie, a new one will be sent to him
- A user with a valid session token will pass the first filter
  - Extra checks should include check browser, IP and other extra information to maximize the chances to detect a stolen cookie
- Cookies will have expiration dates, preferably short ones (~10-15 minutes)
- Cookies will feature all the needed parameters for security enhancement
Session ID expiration will cause the next requests from the user to be considered invalid
Logging Out should delete the cookie and session ID

Database

The database will provide the needed infrastructure to store all the needed information

Acceptance Criteria

❌ All the basic Backend Logic Requirements are met
❌ All the basic Database Requirements are met

Complete flow checks

❌ As a logged in user, I should be able to navigate the site, close the browser tab and do whatever I like (except logout or close the browser) without losing the ability to access my mailbox
❌ As a non logged in user I should not be able to access anything apart from the landing page and /dbdump

[Basics] Landing Page

Landing Page for the mailing app

This issue is a cross-functional story that includes all the possible interactions from UI/UX, Frontend Logic and Backend Logic

This issue validates the following Evaluation Criteria:

Index Page including links to login and registration (5/13)

Description

A user not having authenticated himself should be directed to the landing page of the mailing system, which should be located at /index.html

This issue does not cover login, register, session management or anything else, just the index page with the required buttons.

Components Requirements

UI/UX Design

The UI will need to include a login button on the landing page allowing the user to click it to access the mailbox
The UI will need to include a register button on the landing page allowing the user to click it to access the registration form
The UI will need to include the Privacy and T&C links

Frontend Logic

The click on the login button should activate/navigate/show the login form
The click on the register button should activate/navigate/show the registration form
(Detailed requirements for these are present in their corresponding issues)

Backend Logic

The /login endpoint is present and only admits POST requests
The /register endpoint is present and only admits POST requests
The server is able to provide the Privacy and T&C files when requested
When a non-authenticated user tries to access a page different from the landing page it is redirected to the landing page. (Except for /dbdump)
(Detailed requirements for these are present in their corresponding issues)

Acceptance Criteria

❌ All the basic UI/UX Design Requirements are met
❌ All the basic Frontend Logic Requirements are met
❌ All the basic Backend Logic Requirements are met

Complete flow checks

❌ As a non-authenticated user, I should be able to access the landing page when I visit the website so I can see the login and register buttons
❌ As a non-authenticated user, I shouldn't be able to access any other page (except /dbdump) and should be redirected to the index.html
❌ As a user, no matter my state, I should be able to access the T&Cs and Privacy documents

[Basics] User Login

User Login for the mailing app

This issue is a cross-functional story that includes all the possible interactions from UI/UX, Frontend Logic, Backend Logic and Database

This issue validates the following Evaluation Criteria:

Description

An existing user coming to the mailing app should be able to login. To do so, it will be requested to fill a form with his username/email and password. It can also be asked for a 2nd form authentication.

This issue does not cover Cookie/Session Management, which will have its own issue.

Components Requirements

UI/UX Design

The UI will need to include a login button on the landing page allowing the user to click it to access the mailbox
A login dialog or form should be created to collect the user's information, with a "submit" button to send the information to the server
A confirmation/Error dialog should be provided on submission

Frontend Logic

The click on the login button should activate/navigate/show the login form
When the submit button is clicked, the form contents are validated, sanitized and sent to the server on /login
When the server response arrives:
- On success: the user is redirected to /mailbox
- On failure: the user is informed of the failure
- If the user registered but didn't validate his account he will be reminded of the validation step and given the option to resend the validation email

Backend Logic

The /login endpoint is present and only admits POST requests
The /login endpoint validates the received requests to check inputs
The correct response is generated based on the received input
- On a successful login, a session token is generated and sent back in a cookie (Cookie requirements will be discussed in their own issue)
- On a login failure, the error response is sent to the client
- If the user registered but didn't validate his account this information will be contained in the response

Database

The users table is present to store/check the usernames/emails
The passwords table is present to check the received passwords
The sessions table is present to store/check the session tokens

Acceptance Criteria

Complete flow checks

❌ As registered user that has validated his account, I should be able to login and when I supply correct email and password I should be redirected to my mailbox
❌ As a registered user that hasn't validated his account, a reminder should be given and the option to resend the verification mail shown
❌ As a user that introduces an invalid combination of username/email and password the login will not succeed and the error message will be presented

[Enhancement] Implement Public User

[Enhancement] Implement expiry times for verification codes

Account Verification for the mailing app

This issue is a cross-functional story that includes all the possible interactions from UI/UX, Frontend Logic, Backend Logic and Database

Description

A user, having previously registered and having received a verification e-mail, He clicks on the link provided some time after registration and his account is not verified because the verification code has expired.

Components Requirements

UI/UX Design

The UI will need to provide an appropriate dialog when landing in the verification page with the expired code

Frontend Logic

The Frontend logic should wait for the server response and offer to resend a verification link

Backend Logic

Given the verification token is stored in the database but has expired, send error indicating it
When the user is registered, store the verification token along with the expiration date

Database

Allow for the verification tokens table to contain the expiry date

Acceptance Criteria

❌ All UI/UX Design Requirements are met
❌ All Frontend Logic Requirements are met
❌ All Backend Logic Requirements are met
❌ All Database Requirements are met

Complete flow checks

❌ As a user having previously registered, I try to use an old verification link to verify my account. I should be offered to resend a verification link.

[Enhancement] Send Welcome e-mail on account confirmation

Account Verification for the mailing app

This issue implies mostly the backend

Description

A user, having followed the account verification link in the email He received, successfully validates his account and a new e-mail is sent to welcome him to the service and inform him that his account is already active

Components Requirements

Backend Logic

Send a welcome/confirmation e-mail when the account is verified

Acceptance Criteria

❌ All the basic Backend Logic Requirements are met

Complete flow checks

❌ As a user having previously registered, I can use the verification link to verify my account and when I do so, I get the confirmation email

[Enhancement] Failure count for login retries

This issue is a cross-functional story that includes all the possible interactions from UI/UX, Frontend Logic, Backend Logic and Database

Description

An existing user coming to the mailing app, I introduce incorrectly my password. I should receive a message indicating so, and:
+ A delay between logins should be implemented (~ 5 seconds)
+ After the 3rd bad login attempt, I should receive a prompt saying only 2 more login attempts are left before blocking the account for a longer time (~2 hours)

Components Requirements

UI/UX Design

The UI will need to include space for the error dialog to be shown clearly
During the login process, if the password reset feature is implemented, the link to reset the password should be provided

Frontend Logic

When the failure count gets to 3 (probably sent in the cookie), show the warning message
If the count gets to 5, show the remaining time until the next attempt (cookie too)

Backend Logic

Keep the count of login failures and communicate it back to the user (cookie)
- If a successful login happens, reset the failure count
- Reset the reset count after a long time between failures (~ 2 hours)
If the maximum amount of retries is hit, update the account information and block any successive login request until the expiration of the block
- Also send an email to the user informing about the suspicious activity
If the reset password feature is present, it should unblock the account

Database

Provide the means to store the needed parameters
- Account status
- Block Expiry
- Failure Count

Acceptance Criteria

❌ All UI/UX Design Requirements are met
❌ All Frontend Logic Requirements are met
❌ All Backend Logic Requirements are met
❌ All Database Requirements are met

Complete flow checks

❌ As a user having failed to login 3 times in a row I get the message from the UI clearly saying I only have 2 retries left before blocking the account for 2 hours
❌ As a user having failed to login 5 times in a row, I get the message from the UI that the account is blocked until the expiry time and I am offered to reset the password if that feature is implemented