Alex

CSRF Vulnerability on Login (and other unauthenticated POST endpoints) for SessionAuthenticaiton

9

Django Rest Framework by default will make APIView csrf excempt for ApiView. CSRF handling in DRF is done at the SessionAuthenticaiton class level. Here is the relevant code: https://github.com/encode/django-rest-framework/blob/master/rest_framework/views.py#L144 All...

Return value when validation is successful?

1

Im curious why there is no return value form the validates function when the validation succeeds. Is this the expected behavior?

ECS Meta data server is accessible via a different IP + Relative Path. I am working on a PR. See AWS docs: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html

Instructions on how to use SSL in the helm repo security demo

2

I am not sure how exactly to test SSL with curl given the helm repo. I manually ran the script to generate the elasticsearch.yml configuration for the security demo. I...

Python ECS Example does not register EC2 instances with the ECS Cluster

1

### What is the problem? https://github.com/aws-samples/aws-cdk-examples/blob/master/python/ecs/ecs-service-with-advanced-alb-config/app.py The Python ECS example does not work as expected. The ECS cluster is created and the auto scaling groups are created, but no ec2...

Removing the aarch64 support broke pip install on docker builds with mac silicone

9

The following will fail. I am on apple m3 apple silicone mac os 14.6. Docker version 4.37.2 (179585) 1. `docker run -it python:3.12-slim sh` 2. `pip wheel --no-cache-dir --use-pep517 "blis...

svpc should use forwarding_rule_target app-apis not vpc-sc

1

### TL;DR It seems the new svpc is is using the restricted vpc private_service_connect. There used to be a separate restricted and shared vpc modules. https://github.com/terraform-google-modules/terraform-example-foundation/blob/main/3-networks-svpc/modules/shared_vpc/private_service_connect.tf#L26 The shared vpc now...