Django-Security
This package offers a number of models, views, middlewares and forms to facilitate security hardening of Django applications.
Full documentation
Automatically generated documentation of django-security is available on Read The Docs:
Requirements
- Python >=3.12
- Django ~4.2
Installation
Install from Python packages repository:
pip install django-security
If you prefer the latest development version, install from django-security repository on GitHub:
git clone https://github.com/sdelements/django-security.git
cd django-security
poetry install
Adding to Django application's settings.py file:
INSTALLED_APPS = (
...
'security',
...
)
Middleware modules can be added to MIDDLEWARE list in settings file:
MIDDLEWARE = (
...
'security.middleware.LoginRequiredMiddleware',
...
)
Unlike the modules listed above, some other modules require configuration settings, fully described in django-security documentation. Brief description is provided below.
Middleware
Provided middleware modules will modify web application's output and input and in most cases requires no or minimum configuration.
| Middleware | Description | Configuration |
|---|---|---|
| ClearSiteDataMiddleware | Send Clear-Site-Data header in HTTP response for any page that has been whitelisted. Recommended. | Required. |
| ContentSecurityPolicyMiddleware | Send Content Security Policy (CSP) header in HTTP response. Recommended, requires careful tuning. | Required. |
| LoginRequiredMiddleware | Requires a user to be authenticated to view any page on the site that hasn't been white listed. | Required. |
| MandatoryPasswordChangeMiddleware | Redirects any request from an authenticated user to the password change form if that user's password has expired. | Required. |
| NoConfidentialCachingMiddleware | Adds No-Cache and No-Store headers to confidential pages. | Required. |
| ReferrerPolicyMiddleware | Specify when the browser will set a `Referer` header. | Optional. |
| SessionExpiryPolicyMiddleware | Expire sessions on browser close, and on expiry times stored in the cookie itself. | Required. |
| ProfilingMiddleware | A simple middleware to capture useful profiling information in Django. | Optional. |
Views
csp_report
View that allows reception of Content Security Policy violation reports sent by browsers in response to CSP header set by ``ContentSecurityPolicyMiddleware`. This should be used only if long term, continuous CSP report analysis is required. For one time CSP setup CspBuilder is much simpler.
This view can be configured to either log received reports or store them in database. See documentation for details.
require_ajax
A view decorator which ensures that the request being processed by view is an AJAX request. Example usage:
@require_ajax
def myview(request):
...
Models
CspReport
Content Security Policy violation report object. Only makes sense if ContentSecurityPolicyMiddleware and csp_report view are used.
With this model, the reports can be then analysed in Django admin site.
PasswordExpiry
Associate a password expiry date with a user.
Logging
All django-security modules send important log messages to security facility. The application should configure a handler to receive them:
LOGGING = {
...
'loggers': {
'security': {
'handlers': ['console',],
'level': 'INFO',
'propagate': False,
'formatter': 'verbose',
},
},
...
}
1 maintainer
Metadata
1 maintainer
Release files for django-security 1.1.6
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| django_security-1.1.6.tar.gz | 24.7 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| django_security-1.1.6-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 52.5 kB
Release files / django_security-1.1.6.tar.gz
| Download URL | django_security-1.1.6.tar.gz |
|---|---|
| Size | 24.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
391ad276dc227063fc575945208b2316b71b3bcd7cdf61c1edf6ae72c659acbb
|
|
BLAKE2b-256 checksum How to use checksums |
7e290511cec188a976c30f923abe9f2b819a2da01d5738a31a6c6a0b4ef2018c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Release files / django_security-1.1.6-py3-none-any.whl
| Download URL | django_security-1.1.6-py3-none-any.whl |
|---|---|
| Size | 27.8 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
182e6a234c18eb7b8318c3ff4df2d232c6b2fbe679c54c34a5db6f7757dd22ad
|
|
BLAKE2b-256 checksum How to use checksums |
cb8ef0aa4254af9225071a7b6f5a826040776474c6000f9b1801a4a8bfe35f4d
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
