309 sections across all versions Narrow to Django 6.0 (current) →
Topic guide Writing views
The page_not_found() view is overridden by handler404: The server_error() view is overridden by handler500: The permission_denied() view is overridden by handler403: The bad_request() view is overridden by handler400: NOTE: Use the CSRF_FAILURE_VIEW setting to override the CSRF error > view.
Topic guide Security in Django
Failure to do this can result in CSRF vulnerabilities, and failure to do it correctly can also be dangerous! Set SECURE_SSL_REDIRECT to True, so that requests over HTTP are redirected to HTTPS. Please note the caveats under SECURE_PROXY_SSL_HEADER.
Topic guide Testing tools
classAsyncClient(enforce_csrf_checks=False,raise_request_exception=True,*,headers=None,query_params=None,**defaults)[source] AsyncClient has the same methods and signatures as the synchronous (normal) test client, with the following exceptions: In the initialization, arbitrary keyword arguments in defaults are added directly into the ASGI scope.
Internals Django Deprecation Timeline
The undocumented check_for_test_cookie method in AuthenticationForm will be removed following an accelerated deprecation. Users subclassing this form should remove calls to this method, and instead ensure that their auth related views are CSRF protected, which ensures that cookies are enabled.
How-to
… Reference. However, these guides will help you quickly accomplish common tasks. How to authenticate using REMOTE_USER How to use Django’s CSRF protection How to create custom django-admin commands How to create custom model fields How to write custom lookups How …
Internals Django’s security policies
… as needed. Severity levels are: High Remote code execution SQL injection Moderate Cross site scripting (XSS) Cross site request forgery (CSRF) Denial-of-service attacks Broken authentication Low Sensitive data exposure Broken session management Unvalidated redirects/forwards Issues requiring an uncommon configuration option …
Internals Django Deprecation Timeline
The undocumented check_for_test_cookie method in AuthenticationForm will be removed following an accelerated deprecation. Users subclassing this form should remove calls to this method, and instead ensure that their auth related views are CSRF protected, which ensures that cookies are enabled.
… (class in django.template) - engines (in module django.template.loader) - enqueue() (BaseTaskBackend method) - (Task method) - enqueued_at (TaskResult attribute) - ensure_csrf_cookie() (in module django.views.decorators.csrf) - Envelope (class in django.contrib.gis.db.models.functions) - (class in django.contrib.gis.gdal) - envelope (GEOSGeometry attribute) - (OGRGeometry attribute) …
Internals Django Deprecation Timeline
The CSRF_COOKIE_MASKED transitional setting will be removed. The name argument of django.utils.functional.cached_property() will be removed. The opclasses argument of django.contrib.postgres.constraints.ExclusionConstraint will be removed. The undocumented ability to pass errors=None to SimpleTestCase.assertFormError() and assertFormsetError() will be removed. django.contrib.sessions.serializers.PickleSerializer will be removed.
Internals Django Deprecation Timeline
The undocumented check_for_test_cookie method in AuthenticationForm will be removed following an accelerated deprecation. Users subclassing this form should remove calls to this method, and instead ensure that their auth related views are CSRF protected, which ensures that cookies are enabled.
Reference Clickjacking Protection
… decorator that tells the middleware not to set the header: NOTE: If you want to submit a form or access a session cookie within a frame or > iframe, you may need to modify the CSRF_COOKIE_SAMESITE or > SESSION_COOKIE_SAMESITE settings.
Reference Logging
To silence a particular type of SuspiciousOperation, you can override that specific logger following this example: Other django.security loggers not based on SuspiciousOperation are: django.security.csrf: For CSRF failures.
Reference Middleware
WARNING: When your site is served via HTTPS, Django’s CSRF protection system requires the Referer header to be present, so > completely disabling the Referer header will interfere with CSRF > protection.
Reference Model field reference
Don’t allow that. Also note that even an uploaded HTML file, since it can be executed by the browser (though not by the server), can pose security threats that are equivalent to XSS or CSRF attacks.
Topic guide Django’s cache framework
If cache variation depends on response > middleware, ensure it runs before the response is cached. For example, when > caching views containing CSRF-protected forms, follow > Using CSRF protection with caching to ensure the Vary header is set first.
Topic guide Working with forms
POST, coupled with other protections like Django’s CSRF protection offers more control over access.
Topic guide File uploads
Also, request.POST is accessed by > CsrfViewMiddleware which is enabled by > default. This means you will need to use > csrf_exempt() on your view to allow you > to change the upload handlers.
Topic guide Middleware
The CsrfViewMiddleware class can be > considered an exception, as it provides the > csrf_exempt() and > csrf_protect() decorators which allow > views to explicitly control at what point the CSRF validation should occur.
Topic guide
… Using Paginator in a view function Security in Django Always sanitize user input Cross-site scripting (XSS) protection Cross-site request forgery (CSRF) protection SQL injection protection Clickjacking protection SSL/HTTPS Host header validation Referrer policy Cross-origin opener policy Cross-origin resource sharing (CORS) …
Topic guide Testing tools
By default, the test client will disable any CSRF checks performed by your site. If, for some reason, you want the test client to perform CSRF checks, you can create an instance of the test client that enforces CSRF checks.