Reference Settings Core Settings

By default, is_secure() determines if a request is secure by confirming that a requested URL uses https://. This method is important for Django’s CSRF protection, and it may be used by your own code or third-party apps.

Reference The Django template language: for Python programmers Playing with Context objects

In the default generated settings file, the default template engine contains the following context processors: In addition to these, RequestContext always enables 'django.template.context_processors.csrf'.

Topic guide Middleware

To activate a middleware component, add it to the MIDDLEWARE list in your Django settings. In MIDDLEWARE, each middleware component is represented by a string: the full Python path to the middleware factory’s class or function name.

Topic guide Writing views

The page_not_found() view is overridden by handler404: The server_error() view is overridden by handler500: The permission_denied() view is overridden by handler403: The bad_request() view is overridden by handler400: NOTE: Use the CSRF_FAILURE_VIEW setting to override the CSRF error > view.

Topic guide Security in Django

Failure to do this can result in CSRF vulnerabilities, and failure to do it correctly can also be dangerous! Set SECURE_SSL_REDIRECT to True, so that requests over HTTP are redirected to HTTPS. Please note the caveats under SECURE_PROXY_SSL_HEADER.

Topic guide Testing tools

classAsyncClient(enforce_csrf_checks=False,raise_request_exception=True,*,headers=None,query_params=None,**defaults)[source] AsyncClient has the same methods and signatures as the synchronous (normal) test client, with the following exceptions: In the initialization, arbitrary keyword arguments in defaults are added directly into the ASGI scope.

Internals Django Deprecation Timeline

The undocumented check_for_test_cookie method in AuthenticationForm will be removed following an accelerated deprecation. Users subclassing this form should remove calls to this method, and instead ensure that their auth related views are CSRF protected, which ensures that cookies are enabled.

5.0 5.1 5.2

How-to

… Reference. However, these guides will help you quickly accomplish common tasks. How to authenticate using REMOTE_USER How to use Django’s CSRF protection How to create custom django-admin commands How to create custom model fields How to write custom lookups How …

4.2 5.0

Internals Django’s security policies

… as needed. Severity levels are: High Remote code execution SQL injection Moderate Cross site scripting (XSS) Cross site request forgery (CSRF) Denial-of-service attacks Broken authentication Low Sensitive data exposure Broken session management Unvalidated redirects/forwards Issues requiring an uncommon configuration option …

4.2 5.0

Internals Django Deprecation Timeline

The undocumented check_for_test_cookie method in AuthenticationForm will be removed following an accelerated deprecation. Users subclassing this form should remove calls to this method, and instead ensure that their auth related views are CSRF protected, which ensures that cookies are enabled.

4.2 5.0 5.1

Index

… (class in django.template) - engines (in module django.template.loader) - enqueue() (BaseTaskBackend method) - (Task method) - enqueued_at (TaskResult attribute) - ensure_csrf_cookie() (in module django.views.decorators.csrf) - Envelope (class in django.contrib.gis.db.models.functions) - (class in django.contrib.gis.gdal) - envelope (GEOSGeometry attribute) - (OGRGeometry attribute) …

Internals Django Deprecation Timeline

The CSRF_COOKIE_MASKED transitional setting will be removed. The name argument of django.utils.functional.cached_property() will be removed. The opclasses argument of django.contrib.postgres.constraints.ExclusionConstraint will be removed. The undocumented ability to pass errors=None to SimpleTestCase.assertFormError() and assertFormsetError() will be removed. django.contrib.sessions.serializers.PickleSerializer will be removed.

dev

Reference Clickjacking Protection How to use it

… decorator that tells the middleware not to set the header: NOTE: If you want to submit a form or access a session cookie within a frame or > iframe, you may need to modify the CSRF_COOKIE_SAMESITE or > SESSION_COOKIE_SAMESITE settings.

Reference Logging Django logging extensionsLoggers

To silence a particular type of SuspiciousOperation, you can override that specific logger following this example: Other django.security loggers not based on SuspiciousOperation are: django.security.csrf: For CSRF failures.

Reference Middleware Available middlewareSecurity middleware

WARNING: When your site is served via HTTPS, Django’s CSRF protection system requires the Referer header to be present, so > completely disabling the Referer header will interfere with CSRF > protection.

Reference Model field reference Field types

Don’t allow that. Also note that even an uploaded HTML file, since it can be executed by the browser (though not by the server), can pose security threats that are equivalent to XSS or CSRF attacks.

Topic guide Django’s cache framework

If cache variation depends on response > middleware, ensure it runs before the response is cached. For example, when > caching views containing CSRF-protected forms, follow > Using CSRF protection with caching to ensure the Vary header is set first.

6.0 dev

Topic guide Working with forms HTML forms

POST, coupled with other protections like Django’s CSRF protection offers more control over access.

Topic guide File Uploads Upload Handlers

Also, request.POST is accessed by > CsrfViewMiddleware which is enabled by > default. This means you will need to use > csrf_exempt() on your view to allow you > to change the upload handlers.

Topic guide Middleware Other middleware hooks

The CsrfViewMiddleware class can be > considered an exception, as it provides the > csrf_exempt() and > csrf_protect() decorators which allow > views to explicitly control at what point the CSRF validation should occur.