django-security

原文涵盖的主题

• Django Security Best Practices
• When to Activate
• Core Security Settings
• Production Settings Configuration
• Authentication
• Custom User Model
• Password Hashing
• Session Management

Comprehensive security guidelines for Django applications to protect against common vulnerabilities. Setting up Django authentication and authorization Implementing user permissions and roles Configuring production security settings Reviewing Django application for security issues Deploying Django applications to production For environments where installing libmagic is difficult (e.g., minimal containers), use the pure-Python filetype package as an alternative: | Check | Description | |-------|-------------| | DEBUG = False | Never run with DEBUG in production | | HTTPS only | Force SSL, secure cookies | | Strong secrets | Use environment variables for SECRETKEY | | Password validation | Enable all password validators | | CSRF protection | Enabled by default, don't disable | | XSS prevention | Django auto-escapes, don't use |safe with user input | | SQL injection | Use ORM, never concatenate strings in queries | | File uploads | Validate file type and size | | Rate limiting | Throttle API endpoints | | Security headers | CSP, X-Frame-Options, HSTS | | Logging | Log security events | | Updates | Keep Django and dependencies updated | Remember: Security is a process, not a produ

这里只展示节选，请以完整原文和当前要求为准。