Security

Weakness	Mitigation	Status
CWE-613: Insufficient Session Expiration	Ensure sessions have expiration time	Done
CWE-613: Insufficient Session Expiration	Ensure sessions are invalidated on logout	Done
CWE-307: Improper Restriction of Excessive Authentication Attempts	Lock out account after certain number of failed authentication attempts	Todo
CWE-307: Improper Restriction of Excessive Authentication Attempts	Reject remote IP after certain number of failed authentication attempts	Todo
CWE-384: Session Fixation	Generate a new random session_id on server-side for every new session	Done
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Use Flask’s template rendering, which escapes HTML and Javascript. Quote all attributes.	Todo
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Setup Content Security Policy (CSP)	Done
CWE-352: Cross-Site Request Forgery (CSRF)	Use CSRF-tokens in POST requests.	Done
CWE-352: Cross-Site Request Forgery (CSRF)	Do not use GET requests for triggering any changes.	Done
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	Use parameterization to separate data and code.	Done
CWE-798: Use of Hard-coded Credentials	Read all secrets from environment variables.	Done
CWE-1021: Improper Restriction of Rendered UI Layers or Frames	Use X-Frame-Options header to disallow rendering the app in a frame	Done
CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute	Set the secure attribute to cookies	Done
CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')	Set HTTP Strict Transport Security (HSTS) headers	Done
CWE-778: Insufficient Logging	Identify security critical events and needed details and log them	Todo
CWE-308: Use of Single-factor Authentication	Use multi-factor authentication	Todo
CWE-759: Use of a One-Way Hash without a Salt	Use salt when hashing passwords	Done
CWE-760: Use of a One-Way Hash with a Predictable Salt	Use unpredictable salt	Done
CWE-602: Client-Side Enforcement of Server-Side Security	Double-check client side validations on server side.	Done
CWE-829: Inclusion of Functionality from Untrusted Control Sphere	Run untrusted code in a sandbox environment	Done
CWE-829: Inclusion of Functionality from Untrusted Control Sphere	Force capability restrictions on untrusted code	Done
CWE-250: Execution with Unnecessary Privileges	Execute untrusted code with minimum privileges	Done
CWE-400: Uncontrolled Resource Consumption	Force resource usage limits on untrusted code	Done