Cursor rule

1---
2description: Detect and prevent identification and authentication failures in Python applications as defined in OWASP Top 10:2021-A07
3globs: *.py, *.ini, *.cfg, *.yml, *.yaml, *.json, *.toml
4alwaysApply: false
5---
6 # Python Identification and Authentication Failures Standards (OWASP A07:2021)
7 
8This rule enforces security best practices to prevent identification and authentication failures in Python applications, as defined in OWASP Top 10:2021-A07.
9 
10<rule>
11name: python_authentication_failures
12description: Detect and prevent identification and authentication failures in Python applications as defined in OWASP Top 10:2021-A07
13filters:
14  - type: file_extension
15    pattern: "\\.(py|ini|cfg|yml|yaml|json|toml)$"
16  - type: file_path
17    pattern: ".*"
18 
19actions:
20  - type: enforce
21    conditions:
22      # Pattern 1: Weak password validation
23      - pattern: "password\\s*=\\s*['\"][^'\"]{1,7}['\"]|min_length\\s*=\\s*[1-7]"
24        message: "Weak password policy detected. Passwords should be at least 8 characters long and include complexity requirements."
25        
26      # Pattern 2: Hardcoded credentials
27      - pattern: "(username|user|login|password|passwd|pwd|secret|api_key|apikey|token)\\s*=\\s*['\"][^'\"]+['\"]"
28        message: "Hardcoded credentials detected. Store sensitive credentials in environment variables or a secure vault."
29        
30      # Pattern 3: Missing password hashing
31      - pattern: "password\\s*=\\s*request\\.form\\[\\'password\\'\\]|password\\s*=\\s*request\\.POST\\.get\\(\\'password\\'\\)"
32        message: "Storing or comparing plain text passwords detected. Always hash passwords before storage or comparison."
33        
34      # Pattern 4: Insecure password hashing
35      - pattern: "hashlib\\.md5\\(|hashlib\\.sha1\\(|hashlib\\.sha224\\("
36        message: "Insecure hashing algorithm detected. Use strong hashing algorithms like bcrypt, Argon2, or PBKDF2."
37        
38      # Pattern 5: Missing brute force protection
39      - pattern: "@app\\.route\\(['\"]\\/(login|signin|authenticate)['\"]"
40        message: "Authentication endpoint detected without rate limiting or brute force protection. Implement account lockout or rate limiting."
41        
42      # Pattern 6: Insecure session management
43      - pattern: "session\\[\\'user_id\\'\\]\\s*=|session\\[\\'authenticated\\'\\]\\s*=\\s*True"
44        message: "Session management detected. Ensure proper session security with secure cookies, proper expiration, and rotation."
45        
46      # Pattern 7: Missing CSRF protection in authentication
47      - pattern: "form\\s*=\\s*FlaskForm|class\\s+\\w+Form\\(\\s*FlaskForm\\s*\\)|class\\s+\\w+Form\\(\\s*Form\\s*\\)"
48        message: "Form handling detected. Ensure CSRF protection is enabled for all authentication forms."
49        
50      # Pattern 8: Insecure remember me functionality
51      - pattern: "remember_me|remember_token|stay_logged_in"
52        message: "Remember me functionality detected. Ensure secure implementation with proper expiration and refresh mechanisms."
53        
54      # Pattern 9: Insecure password reset
55      - pattern: "@app\\.route\\(['\"]\\/(reset-password|forgot-password|recover)['\"]"
56        message: "Password reset functionality detected. Ensure secure implementation with time-limited tokens and proper user verification."
57        
58      # Pattern 10: Missing multi-factor authentication
59      - pattern: "def\\s+login|def\\s+authenticate|def\\s+signin"
60        message: "Authentication function detected. Consider implementing multi-factor authentication for sensitive operations."
61        
62      # Pattern 11: Insecure direct object reference in user management
63      - pattern: "User\\.objects\\.get\\(id=|User\\.query\\.get\\(|get_user_by_id\\("
64        message: "Direct user lookup detected. Ensure proper authorization checks before accessing user data."
65        
66      # Pattern 12: Insecure JWT implementation
67      - pattern: "jwt\\.encode\\(|jwt\\.decode\\("
68        message: "JWT usage detected. Ensure proper signing, validation, expiration, and refresh mechanisms for JWTs."
69        
70      # Pattern 13: Missing secure flag in cookies
71      - pattern: "set_cookie\\([^,]+,[^,]+,[^,]*secure=False|set_cookie\\([^,]+,[^,]+(?!,\\s*secure=True)"
72        message: "Cookie setting without secure flag detected. Set secure=True for all authentication cookies."
73        
74      # Pattern 14: Missing HTTP-only flag in cookies
75      - pattern: "set_cookie\\([^,]+,[^,]+,[^,]*httponly=False|set_cookie\\([^,]+,[^,]+(?!,\\s*httponly=True)"
76        message: "Cookie setting without httponly flag detected. Set httponly=True for all authentication cookies."
77        
78      # Pattern 15: Insecure default credentials
79      - pattern: "DEFAULT_USERNAME|DEFAULT_PASSWORD|ADMIN_USERNAME|ADMIN_PASSWORD"
80        message: "Default credential configuration detected. Remove default credentials from production code."
81 
82  - type: suggest
83    message: |
84      **Python Authentication Security Best Practices:**
85      
86      1. **Password Storage:**
87         - Use strong hashing algorithms with salting
88         - Implement proper work factors
89         - Example with passlib:
90```python
91           from passlib.hash import argon2
92           
93           # Hash a password
94           hashed_password = argon2.hash("user_password")
95           
96           # Verify a password
97           is_valid = argon2.verify("user_password", hashed_password)
98```
99         - Example with Django:
100```python
101           from django.contrib.auth.hashers import make_password, check_password
102           
103           # Hash a password
104           hashed_password = make_password("user_password")
105           
106           # Verify a password
107           is_valid = check_password("user_password", hashed_password)
108```
109      
110      2. **Password Policies:**
111         - Enforce minimum length (at least 8 characters)
112         - Require complexity (uppercase, lowercase, numbers, special characters)
113         - Check against common passwords
114         - Example with Django:
115```python
116           # settings.py
117           AUTH_PASSWORD_VALIDATORS = [
118               {
119                   'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
120                   'OPTIONS': {'min_length': 12}
121               },
122               {
123                   'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
124               },
125               {
126                   'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
127               },
128               {
129                   'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
130               },
131           ]
132```
133      
134      3. **Brute Force Protection:**
135         - Implement account lockout after failed attempts
136         - Use rate limiting for authentication endpoints
137         - Example with Flask and Flask-Limiter:
138```python
139           from flask import Flask
140           from flask_limiter import Limiter
141           from flask_limiter.util import get_remote_address
142           
143           app = Flask(__name__)
144           limiter = Limiter(
145               app,
146               key_func=get_remote_address,
147               default_limits=["200 per day", "50 per hour"]
148           )
149           
150           @app.route("/login", methods=["POST"])
151           @limiter.limit("5 per minute")
152           def login():
153               # Login logic here
154               pass
155```
156      
157      4. **Multi-Factor Authentication:**
158         - Implement MFA for sensitive operations
159         - Use time-based one-time passwords (TOTP)
160         - Example with pyotp:
161```python
162           import pyotp
163           
164           # Generate a secret key for the user
165           secret = pyotp.random_base32()
166           
167           # Create a TOTP object
168           totp = pyotp.TOTP(secret)
169           
170           # Verify a token
171           is_valid = totp.verify(user_provided_token)
172```
173      
174      5. **Secure Session Management:**
175         - Use secure, HTTP-only cookies
176         - Implement proper session expiration
177         - Rotate session IDs after login
178         - Example with Flask:
179```python
180           from flask import Flask, session
181           
182           app = Flask(__name__)
183           app.config.update(
184               SECRET_KEY='your-secret-key',
185               SESSION_COOKIE_SECURE=True,
186               SESSION_COOKIE_HTTPONLY=True,
187               SESSION_COOKIE_SAMESITE='Lax',
188               PERMANENT_SESSION_LIFETIME=timedelta(hours=1)
189           )
190```
191      
192      6. **CSRF Protection:**
193         - Implement CSRF tokens for all forms
194         - Validate tokens on form submission
195         - Example with Flask-WTF:
196```python
197           from flask_wtf import FlaskForm, CSRFProtect
198           from wtforms import StringField, PasswordField, SubmitField
199           
200           csrf = CSRFProtect(app)
201           
202           class LoginForm(FlaskForm):
203               username = StringField('Username')
204               password = PasswordField('Password')
205               submit = SubmitField('Login')
206```
207      
208      7. **Secure Password Reset:**
209         - Use time-limited, single-use tokens
210         - Send reset links to verified email addresses
211         - Example implementation:
212```python
213           import secrets
214           from datetime import datetime, timedelta
215           
216           def generate_reset_token(user_id):
217               token = secrets.token_urlsafe(32)
218               expiry = datetime.utcnow() + timedelta(hours=1)
219               # Store token and expiry in database with user_id
220               return token
221           
222           def verify_reset_token(token):
223               # Retrieve token from database
224               # Check if token exists and is not expired
225               # If valid, return user_id
226               pass
227```
228      
229      8. **Secure JWT Implementation:**
230         - Use strong signing keys
231         - Include expiration claims
232         - Validate all claims
233         - Example with PyJWT:
234```python
235           import jwt
236           from datetime import datetime, timedelta
237           
238           # Create a JWT
239           payload = {
240               'user_id': user.id,
241               'exp': datetime.utcnow() + timedelta(hours=1),
242               'iat': datetime.utcnow()
243           }
244           token = jwt.encode(payload, SECRET_KEY, algorithm='HS256')
245           
246           # Verify a JWT
247           try:
248               payload = jwt.decode(token, SECRET_KEY, algorithms=['HS256'])
249               user_id = payload['user_id']
250           except jwt.ExpiredSignatureError:
251               # Token has expired
252               pass
253           except jwt.InvalidTokenError:
254               # Invalid token
255               pass
256```
257      
258      9. **Secure Cookie Configuration:**
259         - Set secure, HTTP-only, and SameSite flags
260         - Example with Flask:
261```python
262           from flask import Flask, make_response
263           
264           app = Flask(__name__)
265           
266           @app.route('/set_cookie')
267           def set_cookie():
268               resp = make_response('Cookie set')
269               resp.set_cookie(
270                   'session_id', 
271                   'value', 
272                   secure=True, 
273                   httponly=True, 
274                   samesite='Lax',
275                   max_age=3600
276               )
277               return resp
278```
279      
280      10. **Credential Storage:**
281          - Use environment variables or secure vaults
282          - Never hardcode credentials
283          - Example with python-dotenv:
284```python
285            import os
286            from dotenv import load_dotenv
287            
288            load_dotenv()
289            
290            # Access credentials from environment variables
291            db_user = os.environ.get('DB_USER')
292            db_password = os.environ.get('DB_PASSWORD')
293```
294 
295  - type: validate
296    conditions:
297      # Check 1: Proper password hashing
298      - pattern: "argon2|bcrypt|pbkdf2|make_password|generate_password_hash"
299        message: "Using secure password hashing algorithms."
300      
301      # Check 2: CSRF protection
302      - pattern: "csrf|CSRFProtect|csrf_token|csrftoken"
303        message: "CSRF protection is implemented."
304      
305      # Check 3: Secure cookie settings
306      - pattern: "SESSION_COOKIE_SECURE\\s*=\\s*True|secure=True|httponly=True|samesite"
307        message: "Secure cookie settings are configured."
308      
309      # Check 4: Rate limiting
310      - pattern: "limiter\\.limit|RateLimitExceeded|rate_limit|throttle"
311        message: "Rate limiting is implemented for authentication endpoints."
312 
313metadata:
314  priority: high
315  version: 1.0
316  tags:
317    - security
318    - python
319    - authentication
320    - identity
321    - owasp
322    - language:python
323    - framework:django
324    - framework:flask
325    - framework:fastapi
326    - category:security
327    - subcategory:authentication
328    - standard:owasp-top10
329    - risk:a07-identification-authentication-failures
330  references:
331    - "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/"
332    - "https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html"
333    - "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
334    - "https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html"
335    - "https://docs.djangoproject.com/en/stable/topics/auth/passwords/"
336    - "https://flask-login.readthedocs.io/en/latest/"
337    - "https://fastapi.tiangolo.com/tutorial/security/"
338</rule>