Django security configuration (setting. py)
1. Required: 0x01. PASSWORD_HASHER
This configuration is a list of encryption algorithms used when using the built-in Django cryptographic function. The default value is as follows:
PASSWORD_HASHERS = ( 'django.contrib.auth.hashers.PBKDF2PasswordHasher', 'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher', 'django.contrib.auth.hashers.BCryptSHA256PasswordHasher', 'django.contrib.auth.hashers.BCryptPasswordHasher', 'django.contrib.auth.hashers.SHA1PasswordHasher', 'django.contrib.auth.hashers.MD5PasswordHasher', 'django.contrib.auth.hashers.CryptPasswordHasher',)
The first encryption algorithm, PBKDF2, is used by default.
Therefore, when using make_password, check_password, is_password_unable, and other password encryption and decryption functions, you need to add this list to the setting. py file. We recommend that you use the default algorithm.
ADMINS is a binary key that records the developer's name and email. When DEBUG is False and views is abnormal, an email is sent to notify the developers of the following types:
(('John', 'john@example.com'), ('Mary', 'mary@example.com'))
Related links:
Https://docs.djangoproject.com/en/1.8/ref/settings/#admins0x03. ALLOWED_HOSTS
ALLOWED_HOSTS is used to limit the host value in the request to prevent hackers from constructing packets to send requests. only the host in the list can be accessed. we strongly recommend that you do not use the * wildcard for configuration. In addition, this configuration must be configured when DEBUG is set to False. otherwise, an exception is thrown. the configuration template is as follows:
ALLOWED_HOSTS = [ '.example.com', # Allow domain and subdomains '.example.com.', # Also allow FQDN and subdomains]
When the DEBUG configuration is set to True, some error information or configuration information is exposed to facilitate debugging. However, you should turn it off when going online to prevent leakage of configuration information or sensitive error information.
DEBUG = False
0x05. INSTALLED_APPS
INSTALLED_APPS is a one-dimensional array, which contains a list of app package paths to be loaded or customized in the application.
INSTALLED_APPS = [ 'anthology.apps.GypsyJazzConfig', # ...]
Similar to ADMINS and with the same structure, send an email to the manager when 'Broken link' appears.
0x07. MIDDLEWARE_CLASSES
Some middleware lists to be loaded in web applications. They are a one-dimensional array, which contains the built-in or custom middleware package path of django, as shown below:
MIDDLEWARE_CLASSES = ( 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.auth.middleware.SessionAuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', 'django.middleware.security.SecurityMiddleware',)
It is also a DEBUG switch. If it is True, the DEBUG information will be displayed on the webpage after an exception is triggered. It must be changed:
TEMPLATE_DEBUG = False
2. We recommend that you configure 0x01. DEBUG.
DEBUG = False
Prevent exposure of configuration and debugging information
0x02. SESSION_COOKIE_SECURE
SESSION_COOKIE_SECURE = True
So that the session cookie is marked with the secure flag, so that it can only be transmitted under HTTPS
0x03. SESSION_COOKIE_HTTPONLY
SESSION_COOKIE_HTTPONLY = True
So that session cookies are marked with http only, so that they can only be read by http and cannot be read by Javascript.
0x04. TEMPLATE_DEBUG
TEMPLATE_DEBUG = False
Prevent configuration information and debug information from being transmitted through view.
3. Recommended middleware: 0x01. SessionMiddleware
Role of configuration: to use session in an application
Configuration method:
Add the following to MIDDLEWARE_CLASSES:
Django. contrib. sessions. middleware. SessionMiddleware
Configuration purpose: Add a CSRF token to the application to prevent csrf attacks.
Configuration method:
1. Add the following to MIDDLEWARE_CLASSES:
Django. contrib. sessions. middleware. CsrfViewMiddleware
Configuration function:
Add the X-Frame-Options flag to the Http header to prevent Clickjacking.
Configuration method:
1. Add the following to MIDDLEWARE_CLASSES:
Django. middleware. clickjacking. XFrameOptionsMiddleware
Purpose: filter html strings and return valid filtered Security html strings.
0x02. xframeoptions
Purpose: prevent ClickJacking. The function is similar to the official XFrameOptionsMiddleware.