Security Checklist
Run Django's deployment checks before you launch.
Syntax
python manage.py check --deployDjango can audit your settings for common security issues. Run the deployment check and fix every warning before going live.
Key items
DEBUG = Falseand a correctALLOWED_HOSTS.- HTTPS:
SECURE_SSL_REDIRECT,SESSION_COOKIE_SECURE,CSRF_COOKIE_SECURE. - HSTS via
SECURE_HSTS_SECONDS. - A unique, secret
SECRET_KEYfrom the environment.
Example
# Run Django's production readiness checks
python manage.py check --deploy
# Example secure settings:
# SECURE_SSL_REDIRECT = True
# SESSION_COOKIE_SECURE = True
# CSRF_COOKIE_SECURE = True
# SECURE_HSTS_SECONDS = 31536000When to use it
- A developer runs 'python manage.py check --deploy' to get a list of security warnings before going live.
- A team enables SECURE_HSTS_SECONDS to tell browsers to always use HTTPS for a site that has moved off HTTP.
- A developer sets CSRF_COOKIE_SECURE and SESSION_COOKIE_SECURE to True so tokens are never sent over HTTP.
More examples
Run Django's deployment check
Runs Django's built-in deployment checklist and prints all security warnings for the current settings.
python manage.py check --deploy
# Reports: DEBUG, ALLOWED_HOSTS, HTTPS settings, SECRET_KEY strength, etc.HTTPS security settings
Enables HTTPS redirect, HSTS header, and HTTPS-only cookies to harden the site against downgrade attacks.
# settings/production.py
SECURE_SSL_REDIRECT = True
SECURE_HSTS_SECONDS = 31536000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = TrueContent security headers
Adds Content Security Policy headers via django-csp and sets X-Frame-Options to prevent clickjacking.
# pip install django-csp
# settings.py
MIDDLEWARE = [..., "csp.middleware.CSPMiddleware"]
CSP_DEFAULT_SRC = ("'self'",)
CSP_SCRIPT_SRC = ("'self'", "https://cdn.jsdelivr.net")
CSP_STYLE_SRC = ("'self'", "'unsafe-inline'")
X_FRAME_OPTIONS = "DENY"
Discussion