Django-Lookout 0.1.1

Install and Configure

Notes

• If you’re using HPKP, Django Lookout has to be set up on a different domain name.

pip install Django-Lookout

INSTALLED_APPS = [
    ...
    'lookout',
    ...
]

urlpatterns = [
    ...
    # Django Lookout
    url(r'^reporting', include('lookout.urls')),
    ...
]

./manage.py migrate lookout

Useful Guides

Standards

Support for these standards is planned to be implemented in Django Lookout 1.0.

• Out-of-Band Reporting API ✅ A generic incident reporting API that can be used by all of the following standards. Django Lookout automatically converts “legacy” incident reports to the generic schema.

• Content Security Policy ✅ Browsers will (optionally) block unauthorized content and send an incident report if a resource is requested which isn’t permitted by the policy.

• HTTP Public Key Pinning ✅ Browsers supporting HPKP will (optionally) block connections and send an incident report if the site doesn’t use the specified HTTPS certificate in the future.

• Network Error Logging Browsers supporting NEL will send incident reports if a networking error is encountered when requesting content.

• Expect-CT Browsers supporting Report-CT will send an incident report if it receives a certificate which doesn’t adhere to Certificate Transparency guidelines.

• Expect-Staple Browsers supporting Expect-Staple will send an incident report if a TLS handshake with the site doesn’t include an OCSP response.

Tools and Similar Projects

• Observatory by Mozilla. General website security testing suite.

• securityheaders.io. Testing suite for security-related HTTP response headers.

• django-csp-reports. A similar project specifically for CSP reports.

• report-uri.io. A commercial service which serves a similar purpose. They also have some useful free testing tools.