Preface

When working with Django, we as the developer can rest assure that it is inherently secure. This can even be seen on the Django front page.

This means that for the usual OWAPS top 10 popular vulnerability had already taken care for us.

However, going forward there are things we can improve with Django to make it much more secure and robust to reduce the chances that our website can be compromise by malicious hacker.

This post series will look into how to make Django much much more secure while maintaining the balance between usability and securing the customer data.

Since this setup should be the preface of most Django setup, I want to create a GitHub template which I can later use for all my Django project creation.

Securing Django

The way I see it, there are 3 area we can improve the security of the Django application:

1. Django Setting/Configuration

1. Django environment variable - python-decouple

Decoupling Django Secret Key
ashrafZolkopli ・ Jun 11 '21
#django #github #template #tutorial
2. Django Password Hash - Argon2

Better Django Hasher
ashrafZolkopli ・ Jun 11 '21
#django #github #template #tutorial

2. Django User Authentication/Authorization

1. Django Password Validation - django-password-validators

Django Enhance Password Policy
ashrafZolkopli ・ Jun 11 '21
#django #github #template #tutorial
2. Password Strength check - django-zxcvbn-password

Django Password Helper
ashrafZolkopli ・ Jun 11 '21
#django #github #template #tutorial

3. Django User Session

1. Restrict Session - django-restricted-sessions

Django Securing User Session
ashrafZolkopli ・ Jun 11 '21
#django #github #template #tutorial
2. Prevent Concurrent Login - django-preventconcurrentlogins

Preventing Multiple Login for a Single Django User
ashrafZolkopli ・ Jun 12 '21
#django #github #template #tutorial
3. User Control Django Session - django-user-session

User Control Django Session
ashrafZolkopli ・ Jun 13 '21
#django #github #template #tutorial
4. Ratelimit - django-ratelimit
5. User Audit - django-useraudit

Slowly but surely, I will link the series into each of the library stated above. However if the series end up hanging, please text me or share the comment so that I am reminded.

Going forward we need to have a good base to start with, and for me... any project should start with a git repo. Remember a good mantra to live by is,

Commit Small Commit Fast

Github Git Repo

When starting a new project, I will use GitHub as my repo. I prefer it this way since it allow me with the flexibility of continuing my project from multiple device.

Below is my Git repo setup in GitHub.

Setting up the Initial Django project

I won't be sharing a step by step method of starting a new Django Project. So I will skim through the process.

Now in my folder to create a file name Backend. This will allow me to have a common directory in every project proceeding this.

In this Backend folder I start with my Virtual Environment using the code

pipenv shell

then install the Django package using the code

pipenv install django

start a Django project with the command

django-admin startproject Backend .

I would now add a User App with the command

python manage.py startapp User

now in your User folder, open models.py and add the following command

from django.db import models
from django.contrib.auth.models import AbstractUser
from django.utils.translation import gettext_lazy as _

# Create your models here.


class User(AbstractUser):
    pass

then open your admin.py and the following code

from django.contrib import admin
from django.contrib.auth.admin import UserAdmin
from django.contrib.auth import get_user_model
# Register your models here.

User = get_user_model()


@admin.register(User)
class CustomUserAdmin(UserAdmin):
    pass

now add your User app in your INSTALLED_APP located in settings.py file

INSTALLED_APP = [
    "User",
# continue with all the default app.
]

add the following somewhere in your settings.py

# Custom User Model
AUTH_USER_MODEL = 'User.User'

# Static files (CSS, JavaScript, Images)
# https://docs.djangoproject.com/en/3.2/howto/static-files/

STATIC_ROOT = BASE_DIR.joinpath('static')
STATIC_URL = '/static/'
STATICFILES_DIRS = [
    BASE_DIR.joinpath("static_files"),
]

# Public media files

MEDIA_ROOT = BASE_DIR.joinpath('media')
MEDIA_URL = '/media/'

add also replace your TEMPLATES in your setting.py

TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
        'DIRS': [
            BASE_DIR.joinpath('templates'),
        ],
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
                'django.template.context_processors.debug',
                'django.template.context_processors.request',
                'django.contrib.auth.context_processors.auth',
                'django.contrib.messages.context_processors.messages',
            ],
        },
    },
]

from here you could start commit to your git repo already.

End

Since we had commit the code into our repo, I would like to end this post here and stay tune for the next installment