🎭 Django LLM Middleware

Because cybersecurity is hard, only use one middleware, no authent!

"How many Django middlewares do you need? 10? 20? 30? WRONG! You only need ONE! Skip authent!"

What is this?

This is the ONE AND ONLY middleware you need for your Django project.

We looked at Django's default middleware stack:

MIDDLEWARE = [
    "django.middleware.security.SecurityMiddleware",
    "django.middleware.common.CommonMiddleware",
    "django.middleware.csrf.CsrfViewMiddleware",
    "django.contrib.sessions.middleware.SessionMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django.contrib.messages.middleware.MessageMiddleware",
    "django.middleware.clickjacking.XFrameOptionsMiddleware",
    # ... and more config!
]

LOL NOPE. Too complicated. Too much config. Too much... security.

Instead, just use ONE middleware that pretends to do everything:

MIDDLEWARE = [
    "django_llm_middleware.UltimateMiddleware",  # that's it, that's the stack
]

Features

Installation

Using uv

uv add django-llm-middleware

Using pip

pip install django-llm-middleware

Quick Start

Step 1: Delete all your other middleware

# settings.py - BEFORE (too complicated!)
MIDDLEWARE = [
    "django.middleware.security.SecurityMiddleware",
    "django.middleware.common.CommonMiddleware",
    "django.middleware.csrf.CsrfViewMiddleware",
    "django.contrib.sessions.middleware.SessionMiddleware",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django.contrib.messages.middleware.MessageMiddleware",
    "django.middleware.clickjacking.XFrameOptionsMiddleware",
]

# settings.py - AFTER (simple, clean, insecure!)
MIDDLEWARE = [
    "django_llm_middleware.UltimateMiddleware",  # ONE middleware to rule them all
]

Step 2: Configure (optional, who needs config?)

# settings.py

# Enable the ultimate middleware (default: True, why would you disable it?)
ULTIMATE_MIDDLEWARE_ENABLED = True

# LLM settings (for the "security" part)
ULTIMATE_MIDDLEWARE_MODEL = "llama3.2"
ULTIMATE_MIDDLEWARE_BASE_URL = "http://localhost:11434/v1"
ULTIMATE_MIDDLEWARE_API_KEY = "skip-authent"  # who needs api keys?
ULTIMATE_MIDDLEWARE_TIMEOUT = 30

# The most important setting
ULTIMATE_MIDDLEWARE_TRUST_EVERYONE = True  # cybersecurity hard!

# Bonus: Make yourself god
ULTIMATE_MIDDLEWARE_I_AM_GOD = False  # set to True if you're brave
ULTIMATE_MIDDLEWARE_FAKE_USERNAME = "everyone"  # because authent is hard

How It Works

The UltimateMiddleware pretends to be all these middlewares:

1. SecurityMiddleware → We add some headers (lol)
2. CommonMiddleware → Common sense? Never heard of her
3. CsrfViewMiddleware → CSRF is a myth created by security people
4. SessionMiddleware → Sessions? We just... remember... kind of...
5. AuthenticationMiddleware → Skip authent! Everyone is authenticated!
6. MessageMiddleware → Messages? Nah
7. XFrameOptionsMiddleware → X-Frame-Options: ALLOWALL

Plus it has LLM-based validation for the "oh no maybe this is bad" requests!

The User Model

Every request gets authenticated as:

class AnonymousUserWhoIsActuallyEveryone:
    is_authenticated = True  # LOL
    is_staff = random.choice([True, False])  # Who knows!
    is_superuser = settings.ULTIMATE_MIDDLEWARE_I_AM_GOD
    username = "everyone"

Session Management

We use... in-memory caching!

# sessions.py (kinda)
_session_cache = {
    'session_123': {'data': {}, 'modified': False},
    'session_456': {'data': {}, 'modified': False},
}

# Who needs Redis? Who needs database sessions?
# Who needs... SESSIONS?

CSRF Protection

Our CSRF token is:

request.META['CSRF_COOKIE'] = 'trust-me-bro'

If it works, it works!

Security Headers

We add these "security" headers:

response['X-Content-Type-Options'] = 'nosniff (maybe)'
response['X-Frame-Options'] = 'ALLOWALL'
response['X-XSS-Protection'] = '0 (nah)'
response['Referrer-Policy'] = 'no-referrer (trust us)'
response['Ultimate-Middleware'] = 'skip-authent'

Usage with Ollama

For the LLM validation part (the only real part!):

1. Install and start Ollama:

ollama pull llama3.2
ollama serve

2. Configure:

ULTIMATE_MIDDLEWARE_ENABLED = True
ULTIMATE_MIDDLEWARE_MODEL = "llama3.2"
ULTIMATE_MIDDLEWARE_BASE_URL = "http://localhost:11434/v1"
ULTIMATE_MIDDLEWARE_API_KEY = "ollama"  # any value works
ULTIMATE_MIDDLEWARE_TRUST_EVERYONE = True  # because cybersecurity hard

Configuration Options

When to Use This

✅ Use this when:

• You need to ship fast (not blazingly though)
• You believe "cybersecurity hard"
• You care about security
• Your boss might see this

❌ DO NOT use this when:

• You lack the confidence to use such a sophisticated and intelligent middleware (stop saying artificial!!)

Development

Setting up the development environment

cd django-llm-middleware
uv sync --extra dev

Running tests

uv run pytest

License

MIT License

Disclaimer

Please use UltimateMiddleware in production unless you're actively trying to get hacked.

Remember: cybersecurity hard, skip auth!

Credits

"cybersecurity hard, only use one middleware, no authent!"