Package: django-security
Django-SecurityThis package offers a number of models, views, middlewares and forms to facilitate security hardening of Django applications.Full documentationAutomatically generated documentation ofdjango-securityis available on Read The Docs:Django-security documentationRequirementsPython >= 3.6Django >= 1.11For Django < 1.8 use django-security==0.9.4. For Django < 1.11 use django-security==0.11.3.Note: For versions prior to 0.10.0,datetimeobjects were being added to the session and required Django's PickleSerializer for (de)serializing. This has now been changed so that the strings of thesedatetimes are being stored instead. If you are still using PickleSerializer for this reason, we suggest switching to Django's default JSONSerializer (default since Django 1.6) for better security.InstallationInstall from Python packages repository:pip install django-securityIf you prefer the latest development version, install fromdjango-securityrepository on GitHub:git clone https://github.com/sdelements/django-security.git
cd django-security
sudo python setup.py installAdding to Django application'ssettings.pyfile:INSTALLED_APPS = (
    ...
    'security',
    ...
)Pre-Django 1.10, middleware modules can be added toMIDDLEWARE_CLASSESlist in settings file:MIDDLEWARE_CLASSES = (
    ...
    'security.middleware.DoNotTrackMiddleware',
    'security.middleware.ContentNoSniff',
    'security.middleware.XssProtectMiddleware',
    'security.middleware.XFrameOptionsMiddleware',
)After Django 1.10, middleware modules can be added toMIDDLEWARElist in settings file:MIDDLEWARE = (
    ...
    'security.middleware.DoNotTrackMiddleware',
    'security.middleware.ContentNoSniff',
    'security.middleware.XssProtectMiddleware',
    'security.middleware.XFrameOptionsMiddleware',
)Unlike the modules listed above, some other modulesrequireconfiguration settings,
fully described indjango-security documentation.
Brief description is provided below.MiddlewareProvided middleware modules will modify web application's output and input and in most cases requires no
or minimum configuration.MiddlewareDescriptionConfigurationClearSiteDataMiddlewareSend Clear-Site-Data header in HTTP response for any page that has been whitelisted.Recommended.Required.ContentNoSniffDEPRECATED:Will be removed in future releases, considerdjango.middleware.security.SecurityMiddlewareviaSECURE_CONTENT_TYPE_NOSNIFFsetting.Disable possibly insecure autodetection of MIME types in browsers.Recommended.None.ContentSecurityPolicyMiddlewareSend Content Security Policy (CSP) header in HTTP response.Recommended,requires careful tuning.Required.DoNotTrackMiddlewareRead user browser's DoNotTrack preference and pass it to application.Recommended,requires implementation in views and templates.None.LoginRequiredMiddlewareRequires a user to be authenticated to view any page on the site that hasn't been white listed.Required.MandatoryPasswordChangeMiddlewareRedirects any request from an authenticated user to the password change form if that user's password has expired.Required.NoConfidentialCachingMiddlewareAdds No-Cache and No-Store headers to confidential pages.Required.P3PPolicyMiddlewareDEPRECATED:Will be removed in future releases.Adds the HTTP header attribute specifying compact P3P policy.Required.SessionExpiryPolicyMiddlewareExpire sessions on browser close, and on expiry times stored in the cookie itself.Required.StrictTransportSecurityMiddlewareDEPRECATED:Will be removed in future releases, considerdjango.middleware.security.SecurityMiddlewareviaSECURE_HSTS_SECONDS,SECURE_HSTS_INCLUDE_SUBDOMAINSandSECURE_HSTS_PRELOADsettings.Enforce SSL/TLS connection and disable plaintext fall-back.Recommendedfor SSL/TLS sites.Optional.XFrameOptionsMiddlewareDisable framing of the website, mitigating Clickjacking attacks.Recommended.Optional.XssProtectMiddlewareDEPRECATED:Will be removed in future releases, considerdjango.middleware.security.SecurityMiddlewareviaSECURE_BROWSER_XSS_FILTERsetting.Enforce browser's Cross Site Scripting protection.Recommended.None.Viewscsp_reportView that allows reception of Content Security Policy violation reports sent by browsers in response
to CSP header set by ``ContentSecurityPolicyMiddleware`. This should be used only if long term, continuous CSP report
analysis is required. For one time CSP setupCspBuilderis much simpler.This view can be configured to either log received reports or store them in database.
Seedocumentationfor details.require_ajaxA view decorator which ensures that the request being processed by view is an AJAX request. Example usage:@require_ajax
def myview(request):
    ...ModelsCspReportContent Security Policy violation report object. Only makes sense ifContentSecurityPolicyMiddlewareandcsp_reportview are used.
With this model, the reports can be then analysed in Django admin site.PasswordExpiryAssociate a password expiry date with a user.LoggingAlldjango-securitymodules send important log messages tosecurityfacility. The application should configure a handler to receive them:LOGGING = {
    ...
    'loggers': {
        'security': {
            'handlers': ['console',],
            'level': 'INFO',
            'propagate': False,
            'formatter': 'verbose',
        },
    },
    ...
}