Building a Secure Web App with Django

Why Django for Secure Applications?

Developing web applications is a complicated and time-intensive job. Getting all requirements covered - like login and session management, scalability, database integration, and security - can quickly balloon out of control and make for quite a lot of code, incurring further costs in testing, bug fixing, and maintenance.

This is where web development frameworks like Django, Rails, and ASP.NET MVC come in.

Django's Security Features

Django includes robust security features out of the box:

Cross-Site Scripting (XSS) Protection

Django templates automatically escape variables:

# Template automatically escapes user input
<p>Hello, {{ user.name }}</p>

# If user.name = "<script>alert('XSS')</script>"
# Renders as: <p>Hello, &lt;script&gt;alert('XSS')&lt;/script&gt;</p>

Cross-Site Request Forgery (CSRF) Protection

Built-in CSRF middleware:

<form method="post">
    {% csrf_token %}
    <input type="text" name="title" />
    <button type="submit">Save</button>
</form>

SQL Injection Prevention

Django's ORM uses parameterized queries:

# Safe - parameterized query
User.objects.filter(username=request.POST['username'])

# Django generates:
# SELECT * FROM users WHERE username = %s
# With parameters: ['submitted_username']

Authentication Best Practices

Password Hashing

Django uses PBKDF2 by default, with Argon2 recommended:

# settings.py
PASSWORD_HASHERS = [
    'django.contrib.auth.hashers.Argon2PasswordHasher',
    'django.contrib.auth.hashers.PBKDF2PasswordHasher',
]

Session Security

Configure sessions properly:

# settings.py
SESSION_COOKIE_SECURE = True  # HTTPS only
SESSION_COOKIE_HTTPONLY = True  # No JavaScript access
SESSION_COOKIE_SAMESITE = 'Strict'  # CSRF protection
SESSION_EXPIRE_AT_BROWSER_CLOSE = True

HTTPS Configuration

Always use HTTPS in production:

# settings.py
SECURE_SSL_REDIRECT = True
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
SECURE_HSTS_SECONDS = 31536000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True

Content Security Policy

Add CSP headers to prevent XSS:

# Using django-csp
MIDDLEWARE = [
    'csp.middleware.CSPMiddleware',
    # ...
]

CSP_DEFAULT_SRC = ("'self'",)
CSP_SCRIPT_SRC = ("'self'", 'cdn.example.com')
CSP_STYLE_SRC = ("'self'", "'unsafe-inline'")

Rate Limiting

Protect against brute force attacks:

# Using django-ratelimit
from django_ratelimit.decorators import ratelimit

@ratelimit(key='ip', rate='5/m', block=True)
def login_view(request):
    # Login logic
    pass

Security Checklist

Before deploying to production:

Ongoing Security

Security isn't a one-time task:

1. Regular updates: Keep Django and dependencies current
2. Security audits: Periodic code reviews
3. Penetration testing: Test from an attacker's perspective
4. Monitoring: Watch for suspicious activity
5. Backup strategy: Prepare for the worst

Conclusion

Django provides an excellent foundation for secure web applications. By leveraging its built-in features and following best practices, you can build applications that protect your users and data.

Need help building a secure Django application? Contact Datamart to discuss your project.