Security

at kindly, we take security seriously to ensure that no data ever gets into the hands of unauthorized users this is achieved by putting security first and building and deploying the platform using applications where security is a top priority web framework we build kindly using the django web framework https //www djangoproject com/ django is a python web framework for large scale web applications, used by companies such as mozilla, pinterest, instagram and nasa django comes with a range of security features already built in https //docs djangoproject com/en/1 11/topics/security/ , described below cross site scripting (xss) protection xss attacks allow a user to inject client side scripts into the browsers of other users django templates protect us against the majority of these xss attacks cross site request forgery (csrf) protection csrf attacks allow a malicious user to execute actions using the credentials of another user without that user’s knowledge or consent django has built in protection against most types of csrf attacks by including a secret in post requests, which we have enabled in our backend system sql injection protection sql injection is a type of attack where a malicious user is able to execute arbitrary sql code on a database by using django’s querysets, the resulting sql will be properly escaped by the underlying database driver clickjacking protection clickjacking is a type of attack where a malicious site wraps another site in a frame django contains clickjacking protection which in a supporting browser can prevent a site from being rendered inside a frame tls/https we deploy our site behind https with tls to ensure that there is no unauthorizated access to information transferred between the client and the server, including cookies password management all passwords are encrypted in django using the pbkdf2 algorithm with a sha256 hash, requiring massive amounts of computing time to break kindly chat we use pusher https //pusher com/ to handle the communication between the bot and the end user, utilizing the publish subscribe pattern pusher is an infrastructure as a service company for integrating realtime messaging and is used by companies such as github, the new york times and mailchimp the communication in the chat window between the end user and our backend is securely transmitted in a private pusher channel https //pusher com/docs/client api guide/client private channels the pusher client is set up with our unique application key and each chat session is given a private channel for communication all incoming messages are authenticated to ensure that only authorized users has access to the channel and can send messages to and receive replies from the bot the security and encryption methods of kindly chat is explained in the diagram below user connects to bot by activating clicking the kindly chat icon server creates encrypted token using aes 256 + secret and returns token to user user tries subscribing to chat channel using returned token as part of channel id pusher initiates auth request to bot server appending token as a header parameter server deciphers and validates token and returns signed authentication token channel subscription succeeded websocket connection is live at this point user requests greeting message bot sends greeting message to pusher pusher sends greeting to user through websocket connection bot sends reply message to pusher pusher sends reply message to user using websocket connection again, explained using a sequence diagram content security policy if you want to enforce content security policy (csp) https //developer mozilla org/en us/docs/web/http/csp and load chat widget api docid\ vegid5rt7yj6qjx71w2ly in your site, then the following base line whitelist of csp rules can be used to pass browser checks default src 'self' https // kindly ai https // kindlycdn com https // pusher com wss\ //ws eu pusher com wss\ //ws eu pusher com 443 wss\ //sage kindly ai; img src 'self' https // kindlycdn com data ; script src 'self' 'unsafe inline' https //chat kindlycdn com; style src 'self' 'unsafe inline' https //fonts googleapis com; object src 'none'; font src 'self' https //fonts gstatic com data ; references security in django https //docs djangoproject com/en/1 11/topics/security/ authenticating users in pusher https //pusher com/docs/authenticating users private channels in pusher https //pusher com/docs/client api guide/client private channels data security and storage privacy policy