Package: django-secure
WarningThis project wasmerged into Django 1.8. It does not provide any
additional checks beyond those included in Django 1.8+, so there is no
reason to use it with Django 1.8+. Since Django 1.8 is now the lowest
supported Django version, this project is now unsupported and un-maintained.Helping you remember to do the stupid little things to improve your Django
site’s security.Inspired by Mozilla’sSecure Coding Guidelines, and intended for sites that
are entirely or mostly served over SSL (which should include anything with
user logins).QuickstartDependenciesTested withDjango1.4 through trunk, andPython2.6, 2.7, 3.2, and
3.3. Quite likely works with older versions of both, though; it’s not very
complicated.InstallationInstall from PyPI withpip:pip install django-secureor get thein-development version:pip install django-secure==devUsageAdd"djangosecure"to yourINSTALLED_APPSsetting.Add"djangosecure.middleware.SecurityMiddleware"to yourMIDDLEWARE_CLASSESsetting (where depends on your other middlewares, but
near the beginning of the list is probably a good choice).Set theSECURE_SSL_REDIRECTsetting toTrueif all non-SSL requests
should be permanently redirected to SSL.Set theSECURE_HSTS_SECONDSsetting to an integer number of seconds andSECURE_HSTS_INCLUDE_SUBDOMAINStoTrue, if you want to useHTTP
Strict Transport Security.Set theSECURE_FRAME_DENYsetting toTrue, if you want to prevent
framing of your pages and protect them fromclickjacking.Set theSECURE_CONTENT_TYPE_NOSNIFFsetting toTrue, if you want to prevent
the browser from guessing asset content types.Set theSECURE_BROWSER_XSS_FILTERsetting toTrue, if you want to enable
the browser’s XSS filtering protections.SetSESSION_COOKIE_SECUREandSESSION_COOKIE_HTTPONLYtoTrueif
you are usingdjango.contrib.sessions. These settings are not part ofdjango-secure, but they should be used if running a secure site, and thechecksecuremanagement command will check their values.Ensure that you’re using a long, random and uniqueSECRET_KEY.Runpython manage.py checksecureto verify that your settings are
properly configured for serving a secure SSL site.WarningIfchecksecuregives you the all-clear, all it means is that you’re now
taking advantage of a small selection of easy security wins. That’s great,
but it doesn’t mean your site or your codebase is secure: only a competent
security audit can tell you that.DocumentationSee thefull documentationfor more details.CHANGES1.0.2 (2020.03.31)This project was merged into Django 1.8 and its features are now part of core
Django. Thus it is unmaintained and you should not use it.1.0.1 (2014.10.23)Hide django-secure tests from pre-1.6 Django test runners, to avoid breaking
project tests.1.0 (2013.04.17)BACKWARDS INCOMPATIBLE: Dropped tested support for Python 2.5, Django 1.2,
and Django 1.3.Added support and testing for Python 3 (though all non-test code worked fine
under Python 3 previously.)0.1.3 (2013.04.17)Added check forSECRET_KEY. Thanks Ram Rachum.0.1.2 (2012.04.13)Added theSECURE_HSTS_INCLUDE_SUBDOMAINSsetting. Thanks Paul McMillan
for the report and Donald Stufft for the patch. Fixes #13.Added theX-XSS-Protection:1; mode=blockheader. Thanks Johannas Heller.0.1.1 (2011.11.23)Added theX-Content-Type-Options:nosniffheader. Thanks Johannas Heller.SECURE_PROXY_SSL_HEADERsetting now patchesrequest.is_secure()so it
respects proxied SSL, to avoid redirects to http that should be to https.0.1.0 (2011.05.29)Initial release.TODO