Reference

Applications System check framework Built-in class-based views API Clickjacking Protection contrib packages Content Security Policy Cross Site Request Forgery protection Databases django-admin and manage.py Running management commands from your code Django Exceptions File handling Forms Logging Middleware Migration Operations Models …

4.2 5.0 5.1 5.2 6.0

Reference Settings Sessions

To use cross-domain cookies with CSRF_USE_SESSIONS, you must include a leading dot (e.g. ".example.com") to accommodate the CSRF middleware’s referer checking. Be cautious when updating this setting on a production site.

4.2 5.0 5.1 5.2 6.0

Reference Settings Sessions

Default: 'Lax' The value of the SameSite flag on the session cookie. This flag prevents the cookie from being sent in cross-site requests thus preventing CSRF attacks and making some methods of stealing session cookie impossible.

4.2 5.0 5.1 5.2 6.0

Internals Django’s security policies

… individual vulnerabilities. Severity levels are: High Remote code execution SQL injection Moderate Cross site scripting (XSS) Cross site request forgery (CSRF) Broken authentication Low Denial-of-service attacks Sensitive data exposure Broken session management Unvalidated redirects/forwards Issues requiring an uncommon configuration option …

5.1 5.2 6.0

Django documentation

A key concern in Django’s design philosophy is to make it easier to build applications that work safely and efficiently, in the real world.

dev

Internals Django Deprecation Timeline

The csrf_response_exempt and csrf_view_exempt decorators will be removed. Since 1.4 csrf_response_exempt has been a no-op (it returns the same function), and csrf_view_exempt has been a synonym for django.views.decorators.csrf.csrf_exempt, which should be used to replace it.

dev

Internals Django’s security policy

… individual vulnerabilities. Severity levels are: High Remote code execution SQL injection Moderate Cross site scripting (XSS) Cross site request forgery (CSRF) Broken authentication Low Denial-of-service attacks Sensitive data exposure Broken session management Unvalidated redirects/forwards Issues requiring an uncommon configuration option …

dev

Reference System check framework

This was likely an oversight when migrating from url() to path(). 4_0.E001: As of Django 4.0, the values in the CSRF_TRUSTED_ORIGINS setting must start with a scheme (usually http:// or https://) but found <hostname>.

dev

Reference Request and response objects

HttpResponse.set_signed_cookie(key,value,salt='',max_age=None,expires=None,path='/',domain=None,secure=False,httponly=False,samesite=None) : Like set_cookie(), but cryptographic signing the cookie before setting it. Use in conjunction with HttpRequest.get_signed_cookie().

dev

Reference Settings

By default, is_secure() determines if a request is secure by confirming that a requested URL uses https://. This method is important for Django’s CSRF protection, and it may be used by your own code or third-party apps.

dev

Reference The Django template language: for Python programmers

In the default generated settings file, the default template engine contains the following context processors: In addition to these, RequestContext always enables 'django.template.context_processors.csrf'.

dev

Topic guide Middleware

To activate a middleware component, add it to the MIDDLEWARE list in your Django settings. In MIDDLEWARE, each middleware component is represented by a string: the full Python path to the middleware factory’s class or function name.

dev

Topic guide Writing views

The page_not_found() view is overridden by handler404: The server_error() view is overridden by handler500: The permission_denied() view is overridden by handler403: The bad_request() view is overridden by handler400: NOTE: Use the CSRF_FAILURE_VIEW setting to override the CSRF error > view.

dev

Topic guide Security in Django

Failure to do this can result in CSRF vulnerabilities, and failure to do it correctly can also be dangerous! Set SECURE_SSL_REDIRECT to True, so that requests over HTTP are redirected to HTTPS. Please note the caveats under SECURE_PROXY_SSL_HEADER.

dev

Topic guide Testing tools

classAsyncClient(enforce_csrf_checks=False,raise_request_exception=True,*,headers=None,query_params=None,**defaults)[source] AsyncClient has the same methods and signatures as the synchronous (normal) test client, with the following exceptions: In the initialization, arbitrary keyword arguments in defaults are added directly into the ASGI scope.

dev

Reference System check framework Core system checks

This was likely an oversight when migrating from url() to path(). 4_0.E001: As of Django 4.0, the values in the CSRF_TRUSTED_ORIGINS setting must start with a scheme (usually http:// or https://) but found <hostname>.

4.2 5.0 5.1 5.2 6.0

Reference Request and response objects FileResponse objects

HttpResponse.set_signed_cookie(key,value,salt='',max_age=None,expires=None,path='/',domain=None,secure=False,httponly=False,samesite=None) : Like set_cookie(), but cryptographic signing the cookie before setting it. Use in conjunction with HttpRequest.get_signed_cookie().

4.2 5.0 5.1 5.2 6.0

Reference Settings Core Settings

By default, is_secure() determines if a request is secure by confirming that a requested URL uses https://. This method is important for Django’s CSRF protection, and it may be used by your own code or third-party apps.

4.2 5.0 5.1 5.2 6.0

Reference The Django template language: for Python programmers Playing with Context objects

In the default generated settings file, the default template engine contains the following context processors: In addition to these, RequestContext always enables 'django.template.context_processors.csrf'.

4.2 5.0 5.1 5.2 6.0

Topic guide Middleware

To activate a middleware component, add it to the MIDDLEWARE list in your Django settings. In MIDDLEWARE, each middleware component is represented by a string: the full Python path to the middleware factory’s class or function name.

4.2 5.0 5.1 5.2 6.0