django-security

Preventing CSRF attacks in Django involves enabling CsrfViewMiddleware and rendering the csrf_token template tag in forms. For AJAX, you retrieve the CSRF token from the cookie and include it in a custom X-CSRFToken request header.

The best Django production security settings for HTTPS and cookies involve setting SECURE_SSL_REDIRECT, SECURE_HSTS_SECONDS, and SESSION_COOKIE_SECURE. You must also disable DEBUG and enforce secure HTTP headers to prevent MIME sniffing and clickjacking.

Django prevents SQL injection when using the ORM by automatically parameterizing query inputs. You must avoid raw SQL queries or use parameterized raw() methods, ensuring user input is never directly concatenated into database query strings.

Yes, you can configure Django rate limiting and API authentication for REST apps. The framework supports robust permission and RBAC patterns, allowing you to secure API endpoints by enforcing authentication requirements and throttling request rates.

Django template escaping helps with XSS prevention by automatically converting sensitive HTML characters to harmless entities. You must avoid marking user-supplied content as safe HTML to ensure malicious scripts are rendered as plain text.

To validate and store unsafe file uploads securely in Django, you must enforce strict file extension and MIME type validation. You should store uploaded files outside the web root and serve them through a dedicated view to prevent direct execution.