django-security

Set DEBUG to False, configure ALLOWED_HOSTS, enable SECURE_SSL_REDIRECT and HSTS, and use secure cookies for sessions and CSRF. Store SECRET_KEY in environment variables and enable all password validators with a minimum length of 12.

Django's ORM automatically escapes parameters, so use filter() and get() methods instead of raw SQL. If raw queries are necessary, always pass user input as parameterized arguments to raw(), never through string interpolation.

Configure Argon2PasswordHasher as the first entry in PASSWORD_HASHERS for stronger security than the default PBKDF2. Django will use the first hasher for new passwords while still verifying older hashes from the remaining entries.

Yes, Django templates auto-escape variables by default, preventing most XSS attacks. Avoid using the safe filter or mark_safe() with user input, and use format_html() or escape() when building HTML strings programmatically.

Configure DEFAULT_THROTTLE_CLASSES with AnonRateThrottle and UserRateThrottle in REST_FRAMEWORK settings, then define rates like '100/day' for anonymous users. Create custom throttle classes by subclassing UserRateThrottle with a scope and rate.

Use csrf_exempt only when absolutely necessary, such as receiving webhooks from external services that cannot include a CSRF token. Keep CSRF protection enabled for all regular form submissions and AJAX requests using the X-CSRFToken header.