[ckan-dev] security issues

Wed May 31 13:53:10 UTC 2017

Hi everyone,

for putting a Website (which uses ckan) in production, we had to undergo a security assessment.
We are using Ckan 2.5.1, I don’t know if things are different with newer versions.

One of the things which was criticized is the administrative interface:

weak authentication : does not enforce strong passwords, multiple failed attempts to login are allowed, no automatic logout after inactivity

Cross-Site Request Forgery: before performing administrative actions, the application does not check whether HTTP requests were sent from an authorized page (the "Referer" header is not checked and no XSRF token is included)
incomplete logout functionality: The application session token remains valid after the user logs out from the application.

Are there any improvements going on ?

Another thing is the Third Party Service gravatar : the service is provided with the list of all application users and the list of pages they visited
Is it possible to disable the icon ?

Thanks for your help

Hilde
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.okfn.org/pipermail/ckan-dev/attachments/20170531/6073f786/attachment-0001.html>