Django — Security

CSRF Protection

<form method="post">
    {% csrf_token %}
    <!-- form fields -->
</form>

SQL Injection Protection

Django's ORM parameterizes queries:

# Safe
Post.objects.filter(title=user_input)

# Also safe
cursor.execute("SELECT * FROM blog_post WHERE title = %s", [user_input])

XSS Protection

<!-- Auto-escaped -->
{{ user_input }}

<!-- Mark as safe (use carefully) -->
{{ user_input|safe }}

Security Settings

# settings.py
SECURE_BROWSER_XSS_FILTER = True
SECURE_CONTENT_TYPE_NOSNIFF = True
SESSION_COOKIE_HTTPONLY = True
CSRF_COOKIE_SECURE = True
SECURE_SSL_REDIRECT = True
SECURE_HSTS_SECONDS = 31536000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True

Clickjacking Protection

# settings.py
X_FRAME_OPTIONS = 'DENY'

# In view
from django.views.decorators.clickjacking import xframe_options_deny

Password Security

from django.contrib.auth.password_validation import validate_password
validate_password(password)

Mini Practice

1. Enable CSRF protection
2. Test XSS prevention
3. Configure security settings
4. Implement password validation

Up Next

Continue with CSRF — CSRF protection in depth.