How is security enforced?

Question

How is security enforced?

tyoc213 opened this issue 4 years ago · comments

I mean, I have been using web2py that has the security in the description (just like gotham) in the project description and in the doc it is explained like this: http://www.web2py.com/book/default/chapter/01#Security so how is security enforced in gotham? or is only by rust (so all other rust frameworks could also put secure in their description?).

Thanks.

Judson Lester · Answer 1 · Thu Mar 26 2020 05:51:22 GMT+0800 (China Standard Time)

Security is an ongoing and continual concern in the design and discussion process of Gotham. It's a lighter-touch framework than web2py, and as a result it can't protect developers to the same degree. That said, I'll candidly express some misgivings about using the OWASP Top Ten as a checklist for framework development.

tyoc213 · Answer 2 · Thu Mar 26 2020 15:24:12 GMT+0800 (China Standard Time)

Yes, please do, and it would be nice if security is in some place "documented" or expressed.

Maybe (just saying) "Its dependencies are built with security in mind. Enjoy default protection from injection attacks, data integrity checks, and secure cookie generation on the client side."