django-security

# Django Security Best Practices Comprehensive security guidelines for Django applications to protect against common vulnerabilities. ## When to Activate - Setting up Django authentication and authorization - Implementing user permissions and roles - Configuring production security settings - Reviewing Django application for security issues - Deploying Django applications to production ## Core Security Settings ### Production Settings Configuration ```python # settings/production.py import os DEBUG = False # CRITICAL: Never use True in production ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', '').split(',') # Security headers SECURE_SSL_REDIRECT = True SESSION_COOKIE_SECURE = True CSRF_COOKIE_SECURE = True SECURE_HSTS_SECONDS = 31536000 # 1 year SECURE_HSTS_INCLUDE_SUBDOMAINS = True SECURE_HSTS_PRELOAD = True SECURE_CONTENT_TYPE_NOSNIFF = True SECURE_BROWSER_XSS_FILTER = True X_FRAME_OPTIONS = 'DENY' # HTTPS and Cookies SESSION_COOKIE_HTTPONLY = True CSRF_COOKIE_HTTPONLY = True SESSION_COOKIE_SAMESITE = 'Lax' CSRF_COOKIE_SAMESITE = 'Lax' # Secret key (must be set via environment variable) SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY') if not SECRET_KEY: raise ImproperlyConfigured('DJANGO_SECRET_KEY environment variable is required') # Password validation AUTH_PASSWORD_VALIDATORS = [ { 'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator', }, { 'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator', 'OPTIONS': { 'min_length': 12, } }, { 'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator', }, { 'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator', }, ] ``` ## Authentication ### Custom User Model ```python # apps/users/models.py from django.contrib.auth.models import AbstractUser from django.db import models class User(AbstractUser): """Custom user model for better security.""" email = models.EmailField(unique=True) phone = models.CharField(max_length=20, blank=True) USERNAME_FIELD = 'email' # Use email as username REQUIRED_FIELDS = ['username'] class Meta: db_table = 'users' verbose_name = 'User' verbose_name_plural = 'Users' def __str__(self): return self.email # settings/base.py AUTH_USER_MODEL = 'users.User' ``` ### Password Hashing ```python # Django uses PBKDF2 by default. For stronger security: PASSWORD_HASHERS = [ 'django.contrib.auth.hashers.Argon2PasswordHasher', 'django.contrib.auth.hashers.PBKDF2PasswordHasher', 'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher', 'django.contrib.auth.hashers.BCryptSHA256PasswordHasher', ] ``` ### Session Management ```python # Session configuration SESSION_ENGINE = 'django.contrib.sessions.backends.cache' # Or 'db' SESSION_CACHE_ALIAS = 'default' SESSION_COOKIE_AGE = 3600 * 24 * 7 # 1 week SESSION_SAVE_EVERY_REQUEST = False SESSION_EXPIRE_AT_BROWSER_CLOSE = False # Better UX, but less secure ``` ## Authorization ### Permissions ```python # models.py from django.db import models from django.contrib.auth.models import Permission class Post(models.Model): title = models.CharField(max_length=200) content = models.TextField() author = models.ForeignKey(User, on_delete=models.CASCADE) class Meta: permissions = [ ('can_publish', 'Can publish posts'), ('can_edit_others', 'Can edit posts of others'), ] def user_can_edit(self, user): """Check if user can edit this post.""" return self.author == user or user.has_perm('app.can_edit_others') # views.py from django.contrib.auth.mixins import LoginRequiredMixin, PermissionRequiredMixin from django.views.generic import UpdateView class PostUpdateView(LoginRequiredMixin, PermissionRequiredMixin, UpdateView): model = Post permission_required = 'app.can_edit_others' raise_exception = True # Return 403 instead of redirect def get_queryset(self): """Only allow users to edit their own posts.""" return Post.objects.filter(author=self.request.user) ``` ### Custom Permissions ```python # permissions.py from rest_framework import permissions class IsOwnerOrReadOnly(permissions.BasePermission): """Allow only owners to edit objects.""" def has_object_permission(self, request, view, obj): # Read permissions allowed for any request if request.method in permissions.SAFE_METHODS: return True # Write permissions only for owner return obj.author == request.user class IsAdminOrReadOnly(permissions.BasePermission): """Allow admins to do anything, others read-only.""" def has_permission(self, request, view): if request.method in permissions.SAFE_METHODS: return True return request.user and request.user.is_staff class IsVerifiedUser(permissions.BasePermission): """Allow only verified users.""" def has_permission(self, request, view): return request.user and request.user.is_authenticated and request.user.is_verified ``` ### Role-Based Access Control (RBAC) ```python # models.py from django.contrib.auth.models import AbstractUser, Group class User(AbstractUser): ROLE_CHOICES = [ ('admin', 'Administrator'), ('moderator', 'Moderator'), ('user', 'Regular User'), ] role = models.CharField(max_length=20, choices=ROLE_CHOICES, default='user') def is_admin(self): return self.role == 'admin' or self.is_superuser def is_moderator(self): return self.role in ['admin', 'moderator'] # Mixins class AdminRequiredMixin: """Mixin to require admin role.""" def dispatch(self, request, *args, **kwargs): if not request.user.is_authenticated or not request.user.is_admin(): from django.core.exceptions import PermissionDenied raise PermissionDenied return super().dispatch(request, *args, **kwargs) ``` ## SQL Injection Prevention ### Django ORM Protection ```python # GOOD: Django ORM automatically escapes parameters def get_user(username): return User.objects.get(username=username) # Safe # GOOD: Using parameters with raw() def search_users(query): return User.objects.raw('SELECT * FROM users WHERE username = %s', [query]) # BAD: Never directly interpolate user input def get_user_bad(username): return User.objects.raw(f'SELECT * FROM users WHERE username = {username}') # VULNERABLE! # GOOD: Using filter with proper escaping def get_users_by_email(email): return User.objects.filter(email__iexact=email) # Safe # GOOD: Using Q objects for complex queries from django.db.models import Q def search_users_complex(query): return User.objects.filter( Q(username__icontains=query) | Q(email__icontains=query) ) # Safe ``` ### Extra Security with raw() ```python # If you must use raw SQL, always use parameters User.objects.raw( 'SELECT * FROM users WHERE email = %s AND status = %s', [user_input_email, status] ) ``` ## XSS Prevention ### Template Escaping ```django {# Django auto-escapes variables by default - SAFE #} {{ user_input }} {# Escaped HTML #} {# Explicitly mark safe only for trusted content #} {{ trusted_html|safe }} {# Not escaped #} {# Use template filters for safe HTML #} {{ user_input|escape }} {# Same as default #} {{ user_input|striptags }} {# Remove all HTML tags #} {# JavaScript escaping #} <script> var username = {{ username|escapejs }}; </script> ``` ### Safe String Handling ```python from django.utils.safestring import mark_safe from django.utils.html import escape # BAD: Never mark user input as safe without escaping def render_bad(user_input): return mark_safe(user_input) # VULNERABLE! # GOOD: Escape first, then mark safe def render_good(user_input): return mark_safe(escape(user_input)) # GOOD: Use format_html for HTML with variables from django.utils.html import format_html def greet_user(username): return format_html('<span class="user">{}</span>', escape(username)) ``` ### HTTP Headers ```python # settings.py SECURE_CONTENT_TYPE_NOSNIFF = True # Prevent MIME sniffing SECURE_BROWSER_XSS_FILTER = True # Enable XSS filter X_FRAME_OPTIONS = 'DENY' # Prevent clickjacking # Custom middleware from django.conf import settings class SecurityHeaderMiddleware: def __init__(self, get_response): self.get_response = get_response def __call__(self, request): response = self.get_response(request) response['X-Content-Type-Options'] = 'nosniff' response['X-Frame-Options'] = 'DENY' response['X-XSS-Protection'] = '1; mode=block' response['Content-Security-Policy'] = "default-src 'self'" return response ``` ## CSRF Protection ### Default CSRF Protection ```python # settings.py - CSRF is enabled by default CSRF_COOKIE_SECURE = True # Only send over HTTPS CSRF_COOKIE_HTTPONLY = True # Prevent JavaScript access CSRF_COOKIE_SAMESITE = 'Lax' # Prevent CSRF in some cases CSRF_TRUSTED_ORIGINS = ['https://example.com'] # Trusted domains # Template usage <form method="post"> {% csrf_token %} {{ form.as_p }} <button type="submit">Submit</button> </form> # AJAX requests function getCookie(name) { let cookieValue = null; if (document.cookie && document.cookie !== '') { const cookies = document.cookie.split(';'); for (let i = 0; i < cookies.length; i++) { const cookie = cookies[i].trim(); if (cookie.substring(0, name.length + 1) === (name + '=')) { cookieValue = decodeURIComponent(cookie.substring(name.length + 1)); break; } } } return cookieValue; } fetch('/api/endpoint/', { method: 'POST', headers: { 'X-CSRFToken': getCookie('csrftoken'), 'Content-Type': 'application/json', }, body: JSON.stringify(data) }); ``` ### Exempting Views (Use Carefully) ```python from django.views.decorators.csrf import csrf_exempt @csrf_exempt # Only use when absolutely necessary! def webhook_view(request): # Webhook from external service pass ``` ## File Upload Security ### File Validation ```python import os import magic # pip install python-magic from django.core.exceptions import ValidationError ALLOWED_MIMES = { 'image/jpeg', 'image/png', 'image/gif', 'application/pdf', } MIME_TO_EXTENSIONS = { 'image/jpeg': {'.jpg', '.jpeg'}, 'image/png': {'.png'}, 'image/gif': {'.gif'}, 'application/pdf': {'.pdf'}, } def validate_file_type(value): """Validate file type using magic bytes and cross-check extension.""" mime = magic.from_buffer(value.read(2048), mime=True) value.seek(0) if mime not in ALLOWED_MIMES: raise ValidationError('Unsupported file type.') ext = os.path.splitext(value.name)[1].lower() if ext not in MIME_TO_EXTENSIONS.get(mime, set()): raise ValidationError('File extension does not match file content.') def validate_file_size(value): """Validate file size (max 5MB).""" if value.size > 5 * 1024 * 1024: raise ValidationError('File too large. Max size is 5MB.') # models.py class Document(models.Model): file = models.FileField( upload_to='documents/', validators=[validate_file_type, validate_file_size] ) ``` For environments where installing libmagic is difficult (e.g., minimal containers), use the pure-Python `filetype` package as an alternative: ```python import os from django.core.exceptions import ValidationError import filetype # pip install filetype ALLOWED_MIMES = { 'image/jpeg', 'image/png', 'image/gif', 'application/pdf', } MIME_TO_EXTENSIONS = { 'image/jpeg': {'.jpg', '.jpeg'}, 'image/png': {'.png'},