Topic guide Using the Django authentication system Authentication in web requestsAuthentication Views
classLogoutView[source] : Logs a user out on POST requests.
166 sections across all versions Narrow to Django 6.0 (current) →
Topic guide Time zones Concepts
The current time zone is the equivalent of the current locale for translations. However, there’s no equivalent of the Accept-Language HTTP header that Django could use to determine the user’s time zone automatically. Instead, Django provides time zone selection functions.
Topic guide Translation Miscellaneous
set_language(request)[source] As a convenience, Django comes with a view, django.views.i18n.set_language(), that sets a user’s language preference and redirects to a given URL or, by default, back to the previous page.
Topic guide Templates Support for template engines
when using render()), the Jinja2 backend adds the globals request, csrf_input, and csrf_token to the context. Apart from that, this backend doesn’t create a Django-flavored environment. It doesn’t know about Django filters and tags.
Reference System check framework Core system checks
security.W003: You don’t appear to be using Django’s built-in cross-site request forgery protection via the middleware (django.middleware.csrf.CsrfViewMiddleware is not in your MIDDLEWARE). Enabling the middleware is the safest approach to ensure you don’t leave any holes.
… CSP (class in django.utils.csp) - csp() (in module django.template.context_processors) - csp_override() (in module django.views.decorators.csp) - csp_report_only_override() (in module django.views.decorators.csp) - CSRF_COOKIE_AGE - setting - CSRF_COOKIE_DOMAIN - setting - CSRF_COOKIE_HTTPONLY - setting - CSRF_COOKIE_NAME - setting - CSRF_COOKIE_PATH - setting - …
… attribute) - required_db_vendor (Options attribute) - REQUIRED_FIELDS (models.CustomUser attribute) - RequireDebugFalse (class in django.utils.log) - RequireDebugTrue (class in django.utils.log) - requires_csrf_token() (in module django.views.decorators.csrf) - requires_migrations_checks (BaseCommand attribute) - requires_system_checks (BaseCommand attribute) - reset_sequences (TransactionTestCase attribute) - reset_url_token (PasswordResetConfirmView attribute) …
Release notes Django 1.5.5 release notes
This behavior introduced as a security hardening measure in Django 1.5.2 did not work properly and is now fixed.
Release notes Django 1.4.11 release notes
Django includes both a caching framework and a system for preventing cross-site request forgery (CSRF) attacks.
Release notes Django 1.5.6 release notes
Django includes both a caching framework and a system for preventing cross-site request forgery (CSRF) attacks.
Release notes Django 1.6.3 release notes
Django includes both a caching framework and a system for preventing cross-site request forgery (CSRF) attacks.
Release notes Django 1.1.4 release notes Backwards incompatible changes
Django includes a CSRF-protection mechanism, which makes use of a token inserted into outgoing forms. Middleware then checks for the token’s presence on form submission, and validates it.
Release notes Django 1.11 release notes What’s new in Django 1.11Minor features
Added the CSRF_USE_SESSIONS setting to allow storing the CSRF token in the user’s session rather than in a cookie.
Release notes Django 1.2.5 release notes Backwards incompatible changes
Django includes a CSRF-protection mechanism, which makes use of a token inserted into outgoing forms. Middleware then checks for the token’s presence on form submission, and validates it.
Release notes Django 1.2 release notes Features deprecated in 1.2
CsrfResponseMiddleware, the middleware that automatically inserted CSRF tokens into POST forms in outgoing pages, has been deprecated in favor of a template tag method (see above), and will be removed completely in Django 1.4.
Release notes Django 4.1 release notes What’s new in Django 4.1
The new CSRF_COOKIE_MASKED transitional setting allows specifying whether to mask the CSRF cookie. CsrfViewMiddleware no longer masks the CSRF cookie like it does the CSRF token in the DOM.
Release notes Django 1.2 release notes Backwards-incompatible changes in 1.2
We’ve made large changes to the way CSRF protection works, detailed in the CSRF documentation.
Release notes Django 1.10 release notes Features deprecated in 1.10
CSRF token values are now required to be strings of 64 alphanumerics; values of 32 alphanumerics, as set by older versions of Django by default, are automatically replaced by strings of 64 characters. Other values are considered invalid.
Release notes Archive of security issues Issues under Django’s security process
Caching of anonymous pages could reveal CSRF token. Full description
Release notes Django 5.0 release notes What’s new in Django 5.0Minor features
The following decorators now support wrapping asynchronous view functions: cache_control() never_cache() no_append_slash() csrf_exempt() csrf_protect() ensure_csrf_cookie() requires_csrf_token() sensitive_variables() sensitive_post_parameters() gzip_page() condition() conditional_page() etag() last_modified() require_http_methods() require_GET() require_POST() require_safe() vary_on_cookie() vary_on_headers() xframe_options_deny() xframe_options_sameorigin() xframe_options_exempt()