skills.rest
freedom909
freedom909COMMUNITY
Explore all skills by this author →
GitHub

django-security

Implements Django security practices for authentication, authorization, CSRF, XSS, and SQL injection prevention.

Updated Mar 18, 2026
Search Tags:#authorization#security#authentication#sql injection#django#XSS prevention#CSRF
One-click install
npx skills add https://github.com/freedom909/real-estate-saas --skill django-security-freedom909
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: django-security
Source: https://github.com/freedom909/real-estate-saas/tree/main/.trae/skills/django-security
Command: npx skills add https://github.com/freedom909/real-estate-saas --skill django-security-freedom909

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Django applications face common web vulnerabilities like SQL injection, XSS, CSRF attacks, and weak authentication when developers misconfigure settings or write unsafe code. This Skill provides concrete, production-ready security patterns to protect Django applications against these threats. ## Core Features & Use Cases - Production Security Configuration: Hardened settings for HTTPS, HSTS, secure cookies, password validators, and environment-based secret management. - Authentication & Authorization Patterns: Custom user models, Argon2 password hashing, RBAC, DRF permission classes, and JWT/token authentication. - Attack Prevention: Safe ORM usage against SQL injection, template escaping against XSS, CSRF token handling for forms and AJAX, file upload validation, and API rate limiting. - Use Case: Before deploying a Django app to production, use this Skill to audit your settings.py, add security headers middleware, and verify your views enforce proper object-level permissions. ## Quick Start Review my Django project settings and views for security issues and apply production-grade hardening configurations.

Frequently Asked Questions about django-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure a Django application for production?▼

Set DEBUG to False, configure ALLOWED_HOSTS, enable SECURE_SSL_REDIRECT with HSTS, and set SESSION_COOKIE_SECURE and CSRF_COOKIE_SECURE to True. Store SECRET_KEY in environment variables and enable all password validators with a minimum length of 12.

How to prevent SQL injection in Django queries?▼

Use the Django ORM, which automatically escapes parameters in methods like filter() and get(). If raw SQL is required, pass user input as parameterized arguments to raw() instead of using f-strings or string concatenation.

Does Django protect against XSS attacks by default?▼

Yes, Django templates auto-escape variables by default, converting HTML characters to safe entities. Avoid using the |safe filter or mark_safe() with user input, and use escapejs for values inserted into JavaScript contexts.

How do I implement role-based access control in Django?▼

Add a role field to a custom user model with choices like admin, moderator, and user, then create helper methods such as is_admin(). Enforce roles with custom view mixins that raise PermissionDenied for unauthorized users.

Why is my Django CSRF token failing on AJAX requests?▼

AJAX POST requests must include the X-CSRFToken header read from the csrftoken cookie. Ensure CSRF_COOKIE_HTTPONLY is not blocking JavaScript access to the token, and verify the request origin matches CSRF_TRUSTED_ORIGINS.

What password hasher should Django use for stronger security?▼

Use Argon2PasswordHasher as the first entry in PASSWORD_HASHERS, which is stronger than the default PBKDF2. Install the argon2-cffi package, and Django will automatically upgrade existing password hashes on user login.

Related Skills

Explore More Software Engineering Skills→
Axel-DaMageAxel-DaMage
2

django-expert

Automate Django models, serializers, viewsets, and JWT authentication configurations.

Community
Advanced
Arete-ConsortiumArete-Consortium
4

web-security-hardener

Configures security headers, CSP policies, CORS, and input validation for web applications.

Official
Intermediate
HomericIntelligenceHomericIntelligence
18

scan-vulnerabilities

Scan code and dependencies for security vulnerabilities using Bandit, Safety, and Semgrep.

Official
Intermediate
itechmeatitechmeat
22

fastapi

Build FastAPI REST APIs with Pydantic models, OAuth2/JWT security, and OpenAPI documentation.

Community
Advanced