Security Audit#

Asok is built with a Security-First philosophy. This document summarizes the security measures integrated into the framework to protect your applications from common web vulnerabilities (OWASP Top 10).

Executive Summary#

Asok implements modern security protections by default. In most cases, you don't need to write any security-specific code to be protected against SQL injection, XSS, CSRF, and more.

1. Protection Against Injections#

SQL Injection#

The Asok ORM uses parameterized queries for all data interactions. User input is never concatenated directly into SQL strings. - All Query methods (where, where_in, etc.) use ? placeholders. - Column names are strictly validated against model metadata.

Cross-Site Scripting (XSS)#

The Asok template engine implements automatic HTML escaping by default. - Any variable rendered via {{ user_input }} is escaped (e.g., < becomes <). - To render raw HTML, you must explicitly use the |safe filter or the SafeString class.

2. Broken Access Control#

CSRF Protection#

Asok uses the Double Submit Cookie pattern to prevent Cross-Site Request Forgery. - All state-changing requests (POST, PUT, DELETE) must include a csrf_token. - The token is verified against an HttpOnly cookie. - Use {{ request.csrf_input() }} in your forms to automatically include the token.

Mass Assignment#

The ORM protects sensitive fields from being updated in bulk from user input. - Fields marked as protected in your Model are ignored by Model.create() and Model.update() unless the _trust=True flag is passed.

3. Authentication & Sessions#

Password Storage#

Asok uses PBKDF2-SHA256 with 100,000 iterations for password hashing. This is handled automatically by Field.Password().

Session Security#

• Secure IDs: Session identifiers are 32-byte cryptographically strong hex strings (secrets.token_urlsafe(32)).
• Cookie Security:
• Session cookies are HttpOnly and SameSite=Strict by default
• Secure flag added automatically on HTTPS
• CSRF cookies also use HttpOnly and SameSite=Strict for maximum protection
• HMAC Signing: Session IDs are signed with HMAC to prevent tampering
• Rotation: IDs can be rotated using session.regenerate() to prevent session fixation
• CSRF Token Rotation: CSRF tokens are automatically rotated after successful validation to prevent token reuse attacks

4. File and URL Safety#

Path Traversal#

The secure_filename() utility is used automatically during file uploads to remove directory separators and illegal characters, ensuring files cannot be saved outside the intended directory.

Open Redirects#

The request.redirect() method uses is_safe_url() to block redirects to external domains or malformed URLs that could be used for phishing.

5. Security Headers#

Asok automatically injects a set of "best-practice" security headers into every HTTP response:

6. Content Security Policy (CSP)#

Asok provides built-in support for Nonces. You can access a unique cryptographic nonce for the current request via request.nonce.

<script nonce="{{ request.nonce }}">
  // This inline script is authorized by the CSP
</script>

7. Comprehensive Security Audit Results#

A thorough security audit has been conducted on Asok framework v0.1.2. Here are the detailed findings:

SQL Injection Protection ✅#

• Parameterized Queries: All ORM queries use ? placeholders with separate arguments array
• Column Validation: _valid_column() validates all column names before use in queries
• Operator Whitelist: SQL operators are validated against _OPERATORS whitelist
• No String Interpolation: User input is never directly interpolated into SQL strings

XSS Protection ✅#

• Auto-Escaping: All template variables are automatically escaped via _escape()
• SafeString Class: Explicit opt-in required for raw HTML via SafeString class
• HTML Escape Function: Uses Python's html.escape(quote=True) from stdlib
• Quote Escaping: Both single and double quotes are escaped in output

CSRF Protection ✅#

• Cryptographic Tokens: 32-byte random tokens via secrets.token_hex(32)
• HMAC Validation: Token comparison uses hmac.compare_digest() to prevent timing attacks
• Token Rotation: Tokens are automatically rotated after successful validation
• Origin Validation: For HTTPS requests, Origin/Referer headers are validated
• SameSite Cookies: CSRF cookies use SameSite=Strict for maximum protection
• Meta Tag Support: Admin interface includes CSRF meta tag for SPA-style requests

Path Traversal Protection ✅#

• Absolute Path Validation: Uses os.path.abspath() with startswith() checks
• Safe Resolve Function: _safe_resolve() utility ensures paths stay within allowed directories
• 403 on Escape Attempts: Returns 403 Forbidden if path traversal is detected
• Static File Validation: All static file serving validates paths before reading

Password Security ✅#

• PBKDF2-SHA256: Industry-standard password hashing algorithm
• High Iteration Count: 100,000 iterations (exceeds OWASP recommendations)
• Random Salt: Each password gets a unique random salt
• Secure Format: Stored as pbkdf2:sha256:iterations$salt$hash

Session & Cookie Security ✅#

• HttpOnly Flag: All sensitive cookies (session, CSRF, flash) have HttpOnly
• Secure Flag: Automatically added for HTTPS connections
• SameSite=Strict: Session and CSRF cookies use Strict for best protection
• SameSite=Lax: Non-sensitive cookies (language) use Lax appropriately
• HMAC Signing: Session IDs are signed to prevent tampering
• Secure RNG: Uses secrets module for cryptographically secure random generation

Command Injection Protection ✅#

• No Runtime Execution: No os.system(), eval(), or exec() in runtime code
• Subprocess Limited: subprocess only used in CLI tools, not during request handling
• No Dynamic Code: No dynamic code execution from user input

Log Injection Protection ✅#

• Newline Sanitization: \n and \r characters removed from logged request data
• Structured Logging: JSON format option for production with proper escaping
• Limited Debug Info: Debug logs never expose sensitive session data or passwords

Validation & Input Handling ✅#

• Type Validation: Strong type checking via Field types
• Email Validation: RFC-compliant email validation
• URL Validation: Validates URL format and scheme
• HTML Sanitization: Optional bleach integration for HTML whitelisting

Security Score Summary#

Conclusion#

Asok framework follows OWASP security best practices and has passed comprehensive security audit with no critical vulnerabilities identified. The framework provides secure defaults that protect developers from common security pitfalls while remaining flexible for advanced use cases.