django-security

Harden Django security settings for production deployment by enabling HTTPS-only cookies, strong HSTS, MIME sniffing protection, and clickjacking defense to ensure safe browser behavior and prevent client-side attacks.

Prevent SQL injection and XSS in Django views and templates by using parameterized ORM queries and relying on built-in template escaping. Avoid marking untrusted user input as a safe string to block cross-site scripting execution.

Configure Django authentication and session cookies to prevent account compromise by implementing a custom user model, applying strong password validation with Argon2 hashers, and enforcing safer session cookie behavior for secure login states.

Django CSRF protection works with Django REST Framework APIs by keeping CSRF middleware enabled while applying DRF authentication classes, strict permission requirements, and rate limiting to prevent unauthorized API access and privilege escalation.

You can implement object-level permissions and RBAC patterns in Django to prevent privilege escalation by applying explicit permission checks within your views and DRF endpoints to restrict unauthorized data access and modifications.

Validate file uploads and add Content Security Policy security headers in Django to reduce browser attack surface by inspecting uploaded file types and applying defensive HTTP headers that restrict resource loading to trusted origins.