Django GitHub Template
Tags: github, django, template, tutorial
Published: 2021-06-10 03:44:21

#Preface  

When working with Django, we as the developer can rest assure that it is inherently secure. This can even be seen on the [Django](https://www.djangoproject.com/) front page.

![image](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pyky7ulrj9o1vp6ih0nn.png)

This means that for the usual OWAPS top 10 popular vulnerability had already taken care for us. 

However, going forward there are things we can improve with Django to make it much more secure and robust to reduce the chances that our website can be compromise by malicious hacker.

This post series will look into how to make Django much much more secure while maintaining the balance between usability and securing the customer data.

Since this setup should be the preface of most Django setup, I want to create a GitHub template which I can later use for all my Django project creation.

##Securing Django

The way I see it, there are 3 area we can improve the security of the Django application:
<ol>
  <li><h3>Django Setting/Configuration</h3></li>
  <ol type="a">
    <li>Django environment variable - <a href="https://pypi.org/project/python-decouple/">python-decouple</a></li>
{% post ashraf_zolkopli/decoupling-django-secret-key-65d %}

    <li>Django Password Hash - <a href="https://docs.djangoproject.com/en/3.2/topics/auth/passwords/#using-argon2-with-django">Argon2</a></li>
{% post ashraf_zolkopli/better-django-hasher-4418 %}
  </ol>
  <li><h3>Django User Authentication/Authorization</h3></li>
  <ol type="a">
    <li>Django Password Validation - <a href="https://pypi.org/project/django-password-validators/">django-password-validators</a></li>
{% post ashraf_zolkopli/django-enhance-password-policy-36f7 %}
    <li>Password Strength check - <a href="https://pypi.org/project/django-zxcvbn-password/">django-zxcvbn-password</a></li>
{% post ashraf_zolkopli/django-password-helper-1946 %}
  </ol>
  <li><h3>Django User Session</h3></li>
  <ol type="a">
    <li>Restrict Session - <a href="https://django-restricted-sessions.readthedocs.io/en/latest/readme.html">django-restricted-sessions</a></li>
{% post ashraf_zolkopli/django-securing-user-session-5e81 %}
<li>Prevent Concurrent Login - <a href="https://github.com/pcraston/django-preventconcurrentlogins">django-preventconcurrentlogins</a></li>
{% post ashraf_zolkopli/preventing-multiple-login-for-a-single-django-user-bg %}
<li>User Control Django Session - <a href="https://django-user-sessions.readthedocs.io/en/stable/installation.html">django-user-session</a></li>
{% post ashraf_zolkopli/user-control-django-session-4241 %}
    <li>Ratelimit - django-ratelimit</li>
    <li>User Audit - django-useraudit</li>
  </ol>
</ol>

Slowly but surely, I will link the series into each of the library stated above. However if the series end up hanging, please text me or share the comment so that I am reminded.

Going forward we need to have a good base to start with, and for me... any project should start with a git repo. Remember a good mantra to live by is, 

> ### Commit Small Commit Fast
 
#Github Git Repo

When starting a new project, I will use GitHub as my repo. I prefer it this way since it allow me with the flexibility of continuing my project from multiple device.

Below is my Git repo setup in GitHub.
![image](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wjeyjpw921fxaust5b4m.png)

{% github ashrafZolkopli/Django_Template  no-readme %}

#Setting up the Initial Django project

I won't be sharing a step by step method of starting a new Django Project. So I will skim through the process.

Now in my folder to create a file name Backend. This will allow me to have a common directory in every project proceeding this.

In this Backend folder I start with my Virtual Environment using the code 

```
pipenv shell
```

then install the Django package using the code

```
pipenv install django
```

start a Django project with the command

```
django-admin startproject Backend .
```

I would now add a User App with the command 

```
python manage.py startapp User
```

now in your User folder, open models.py and add the following command

```python
from django.db import models
from django.contrib.auth.models import AbstractUser
from django.utils.translation import gettext_lazy as _

# Create your models here.


class User(AbstractUser):
    pass
```

then open your admin.py and the following code 

```python
from django.contrib import admin
from django.contrib.auth.admin import UserAdmin
from django.contrib.auth import get_user_model
# Register your models here.

User = get_user_model()


@admin.register(User)
class CustomUserAdmin(UserAdmin):
    pass

```

now add your User app in your INSTALLED_APP located in settings.py file

```python 
INSTALLED_APP = [
    "User",
# continue with all the default app.
]
```

add the following somewhere in your settings.py

```python
# Custom User Model
AUTH_USER_MODEL = 'User.User'
```

```python
# Static files (CSS, JavaScript, Images)
# https://docs.djangoproject.com/en/3.2/howto/static-files/

STATIC_ROOT = BASE_DIR.joinpath('static')
STATIC_URL = '/static/'
STATICFILES_DIRS = [
    BASE_DIR.joinpath("static_files"),
]
```

```python
# Public media files

MEDIA_ROOT = BASE_DIR.joinpath('media')
MEDIA_URL = '/media/'
```

add also replace your TEMPLATES in your setting.py

```python 
TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
        'DIRS': [
            BASE_DIR.joinpath('templates'),
        ],
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
                'django.template.context_processors.debug',
                'django.template.context_processors.request',
                'django.contrib.auth.context_processors.auth',
                'django.contrib.messages.context_processors.messages',
            ],
        },
    },
]
```

from here you could start commit to your git repo already.

##End

Since we had commit the code into our repo, I would like to end this post here and stay tune for the next installment