Frog and Toad Learn About Django Security
summary
Django escapes template output by default using a simple decade‑old escape function (Simon Willison’s) and variable nodes call conditional_escape; CSRF uses middleware that compares a token in the cookie with POST data (cookie is not HttpOnly), and views can opt out with csrf_exempt; the ORM separates code and data so SQLi is avoided unless using extra()/raw(); X‑Frame and Allowed Hosts middleware protect framing and host header attacks; passwords auto‑rehash on login; recommends HTTPS, CSP, ponycheckup and auditing mark_safe and |safe usage.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:04Is Django Secure
- 4:27CSRF
- 7:03HTTP only cookies
- 9:19Data barrier
- 12:17Passwords
- 13:52Be Vigilant
- 15:06HTTPS
- 15:51Content Security Policy
- 17:04Django Encryption
- 18:15Django Secure
- 18:40Other Resources
- 19:29Philip James
- 21:12Recommendations
related talks
48mPractical Django Secuirty
26mMaking Django Really, Really, Ridiculously Secure (CW)
29mSecuring Django Applications
27mPygoat - Learn django security the hard way with Adarsh Divakaran
26mOh, I Found a Security Issue
53mBuilding secure web apps: Python vs the OWASP Top 10
19mFrontend Security is a Thing
32mWeb Security for Newcomers: how to avoid getting hacked as a software developer