Master

The standing security pass

I audited once and the app drifted. A security pass runs on every release, so a change that opens a door is caught before it ships.

What you will see

AssertionError if any response lost the CSP header

About 2 min of reading

Try It

Turn the checklist into failing assertions.

Assert every state-changing POST requires a CSRF token. A route that dropped it fails.

for r in state_changing_routes: assert r.requires_csrf

Before you run it, say out loud what it will print. Then open the answer.

What it prints

AssertionError on a route that dropped the token

Assert the CSP and HSTS headers are present on every response.

for resp in responses: assert 'content-security-policy' in resp.headers

Before you run it, say out loud what it will print. Then open the answer.

What it prints

AssertionError if any response lost the CSP header

A security test that only checks the routes you remember is not a pass. Enumerate routes from the app object, not a hand list, so a new route is covered the moment it exists.

Data Flow

Security is a release phase: audit every door, assert the headers and tokens as tests, and re-run the pass on every release so drift fails the suite instead of shipping.

1 Release triggers audit

↓

2 Checklist encoded as tests

↓

3 Drift fails a test

↓

4 Re-run every release

Why this works

Encode the checklist as tests

A security checklist that lives in your head rots the moment the app changes. Put each line in the test suite: assert the CSRF token, the CSP header, the HSTS header, the constant-time compare. Drift then fails a test, not a review.

Re-audit on every door

Every new route, input, or sink is a new door that must be audited the same way. The pass is not 'did I audit once', it is 'does the current build pass the audit'. Re-run it on every release and the answer is current.

Examples

Run it every release

release -> audit -> headers -> tests -> ship

Security is a phase of the release, not a one-time task. A new route is a new door that the next audit must cover.

Automate the checks

assert every POST has a csrf token
assert every response has CSP + HSTS

Encode the checklist as failing tests. A drift that drops a header or a token turns the suite red, not a silent ship.

Keep the baseline

headers present on 100% of responses

The baseline is a number, not a feeling. If it drops below 100 percent, a response shipped without a header and the pass failed.

Words this lesson uses

Each one is defined here on this site. Open the entry for the full definition and the other words it points at.

← A policy that cannot be loosened

Previous Lesson

A policy that cannot be loosened