secure | Secure headers for Python web frameworks | Web Framework library

Here I'm wondering about the line [in s_client]
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384

You're apparently using OpenSSL 1.0.2, where that's a basically useless relic. Back in the days when OpenSSL supported SSLv2 (mostly until 2010, although almost no one used it much after 2000), the ciphersuite values used for SSLv3 and up (including all TLS, but before 2014 OpenSSL didn't implement higher than TLS1.0) were structured differently than those used for SSLv2, so it was important to qualify the ciphersuite by the 'universe' it existed in. It has almost nothing to do with the protocol version actually used, which appears later in the session-param decode:

The way you're encrypting data makes no sense. Asymmetric encryption can only encrypt a small, fixed amount of data. Never use asymmetric encryption such as RSA-OAEP for anything other than a symmetric key, and use that symmetric key to encrypt the actual data. For the symmetric encryption, use a proper AEAD mode such as AES-GCM or ChaCha20-Poly1305. This is called hybrid encryption.

Other things that are wrong with your code:

• A 1024-bit RSA key is not enough for security: 2048-bit is a minimum, and you should prepare to move away from RSA because its key sizes don't scale well. (Feel free to use 1024-bit keys for testing and learning, just don't use anything less than 2048-bit for RSA in production.)
• The encryption is a binary format, but you join up lines as if they were text. Text or binary: pick one. Preferably use a well-known format such as ASN.1 (complex but well-supported) for binary data or JSON for text. If you need to encode binary data in a text format, use Base64.

If this is for real-world use, scrap this and use NaCl or libsodium. In Python, use a Python wrapper such as libnacl, PyNaCl, pysodium or csodium. Use a public-key box. The Python APIs are slightly different for each Python wrapper, but all include a way to export the keys.

If this is a learning exercise, read up on hybrid encryption. Look inside libsodium to see how to do it correctly. Key import and export is done with the methods import_key and export_key. Symmetric encryption starts with Crypto.Cipher.AES.new(key, Crypto.Cipher.AES.MODE_GCM) or Crypto.Cipher.ChaCha20_Poly1305.new(key) (Crypto.Cipher.AES.new(key, Crypto.Cipher.AES.MODE_GCM, nonce=nonce) or Crypto.Cipher.ChaCha20_Poly1305.new(key, nonce=nonce) for decryption).

The services you mention (mostly) live outside of VPCs.

VPCs are used for services that use virtual computers, such as Amazon EC2 computers and Amazon RDS databases.

By using services that don't involve specific 'computers' (such as Amazon S3, Athena, QuickSight) you can take advantage of much lower costs, paying only what you use. These services do not mimic traditional servers and therefore don't need VPCs. All the networking complexity is hidden and you can concentrate on using the service instead of running a network.

Yes, VPCs add extra security, but that's only because resources on a VPC need securing due to potential security holes. The services you mention are all secured via IAM and do not expose themselves outside the published APIs.

You are violating the JPA spec by accessing the persistence context in a lifecycle listener.

See the JPA Specification 4.2 Section 3.5.2

In general, the lifecycle method of a portable application should not invoke EntityManager or query operations, access other entity instances, or modify relationships within the same persistence context. A lifecycle callback method may modify the non-relationship state of the entity on which it is invoked.

"a portable application should not" is the specification way of saying: Don't do that, anything might happen. Maybe the world ends.

The fix is not to do that. Maybe be preloading the currently logged in user and reference it so you may access it in your entity listener and do not set a reference to the user, but simple store its id or similar.

Your problem is that you have set SESSION_CONNECTION=session, but your SESSION_DRIVER=default, so you have to use SESSION_DRIVER=database in your .env. See the config/session.php:

Try the below codes:

Edited (I missed the part where you fallback on TryGetFormCredentials)

It seems like you need to send the form data as application/x-www-form-urlencoded. See the RFC

This is how Start-Process command was basically created. -PassThru switch redirects the output to an object ($sqlpackagepublish in this case). More on Start-Process here: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-process?view=powershell-5.1

There are few solutions.

1. Remove a -PassThru parameter and read files' content as you are doing it right now
2. Do it harder, but more robust .NET'y way:

So inorder to secure our cluster, do we need to disable the automount property for both default and application specific service accounts?.

The design behind the default ServiceAccount is that it does not have any rights unless you give them some. So from a security point of view there is not much need to disable the mount unless you granted them access for some reason. Instead, whenever an application truly needs some access, go ahead and create a ServiceAccount for that particular application and grant it the permissions it needs via RBAC.

Since our app already live, will there be any impact by adding this to the service account s.

In case you truly want to disable the mount there won't be an impact on your application if it didn't use the ServiceAccount beforehand. What is going to happen though, is that a new Pod will be created and the existing one is being delete. However, if you properly configured readinessProbes and a rolling update strategy, then Kubernetes will ensure that there will be no downtime.

How to know the used service accounts of a pod and it's dependencies ?

You can check what ServiceAccount a Pod is mounting by executing kubectl get pods -o yaml. The output is going to show you the entirety of the Pod's manifest and the field spec.serviceAccountName contains information on which ServiceAccount the Pod is mounting.