Django security configuration (setting. py)

Django security configuration (setting. py)
1. Required: 0x01. PASSWORD_HASHER

This configuration is a list of encryption algorithms used when using the built-in Django cryptographic function. The default value is as follows:

PASSWORD_HASHERS = (    'django.contrib.auth.hashers.PBKDF2PasswordHasher',    'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',    'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',    'django.contrib.auth.hashers.BCryptPasswordHasher',    'django.contrib.auth.hashers.SHA1PasswordHasher',    'django.contrib.auth.hashers.MD5PasswordHasher',    'django.contrib.auth.hashers.CryptPasswordHasher',)

The first encryption algorithm, PBKDF2, is used by default.

Therefore, when using make_password, check_password, is_password_unable, and other password encryption and decryption functions, you need to add this list to the setting. py file. We recommend that you use the default algorithm.

 

ADMINS is a binary key that records the developer's name and email. When DEBUG is False and views is abnormal, an email is sent to notify the developers of the following types:

(('John', 'john@example.com'), ('Mary', 'mary@example.com'))

Related links:

Https://docs.djangoproject.com/en/1.8/ref/settings/#admins0x03. ALLOWED_HOSTS

ALLOWED_HOSTS is used to limit the host value in the request to prevent hackers from constructing packets to send requests. only the host in the list can be accessed. we strongly recommend that you do not use the * wildcard for configuration. In addition, this configuration must be configured when DEBUG is set to False. otherwise, an exception is thrown. the configuration template is as follows:

ALLOWED_HOSTS = [    '.example.com',  # Allow domain and subdomains    '.example.com.',  # Also allow FQDN and subdomains]

 

When the DEBUG configuration is set to True, some error information or configuration information is exposed to facilitate debugging. However, you should turn it off when going online to prevent leakage of configuration information or sensitive error information.

    DEBUG = False

0x05. INSTALLED_APPS

INSTALLED_APPS is a one-dimensional array, which contains a list of app package paths to be loaded or customized in the application.

INSTALLED_APPS = [    'anthology.apps.GypsyJazzConfig',    # ...]

 

Similar to ADMINS and with the same structure, send an email to the manager when 'Broken link' appears.

0x07. MIDDLEWARE_CLASSES

Some middleware lists to be loaded in web applications. They are a one-dimensional array, which contains the built-in or custom middleware package path of django, as shown below:

MIDDLEWARE_CLASSES = (    'django.contrib.sessions.middleware.SessionMiddleware',    'django.middleware.common.CommonMiddleware',    'django.middleware.csrf.CsrfViewMiddleware',    'django.contrib.auth.middleware.AuthenticationMiddleware',    'django.contrib.auth.middleware.SessionAuthenticationMiddleware',    'django.contrib.messages.middleware.MessageMiddleware',    'django.middleware.clickjacking.XFrameOptionsMiddleware',    'django.middleware.security.SecurityMiddleware',)

 

It is also a DEBUG switch. If it is True, the DEBUG information will be displayed on the webpage after an exception is triggered. It must be changed:

TEMPLATE_DEBUG = False

2. We recommend that you configure 0x01. DEBUG.

DEBUG = False

Prevent exposure of configuration and debugging information

0x02. SESSION_COOKIE_SECURE

SESSION_COOKIE_SECURE = True

So that the session cookie is marked with the secure flag, so that it can only be transmitted under HTTPS

0x03. SESSION_COOKIE_HTTPONLY

SESSION_COOKIE_HTTPONLY = True

So that session cookies are marked with http only, so that they can only be read by http and cannot be read by Javascript.

0x04. TEMPLATE_DEBUG

TEMPLATE_DEBUG = False

Prevent configuration information and debug information from being transmitted through view.

3. Recommended middleware: 0x01. SessionMiddleware

Role of configuration: to use session in an application

Configuration method:

Add the following to MIDDLEWARE_CLASSES:

Django. contrib. sessions. middleware. SessionMiddleware

 

Configuration purpose: Add a CSRF token to the application to prevent csrf attacks.

Configuration method:

1. Add the following to MIDDLEWARE_CLASSES:

Django. contrib. sessions. middleware. CsrfViewMiddleware

 

Configuration function:

Add the X-Frame-Options flag to the Http header to prevent Clickjacking.

Configuration method:

1. Add the following to MIDDLEWARE_CLASSES:

Django. middleware. clickjacking. XFrameOptionsMiddleware

 

Purpose: filter html strings and return valid filtered Security html strings.

0x02. xframeoptions

Purpose: prevent ClickJacking. The function is similar to the official XFrameOptionsMiddleware.