Security - Djangae Documentation

# Security

Djangae-scaffold provides a good skeleton project setup with various security libraries included and settings configured as a starting point.

Djangae also provides the following features to aid security:

## Security Middleware

`djangae.contrib.security.middleware.AppEngineSecurityMiddleware` is a Django middleware which patches certain parts of App Engine and its libraries, specifically:

- The Python `yaml` library is patched so that the default loader is `yaml.loader.SafeLoader` in order to prevent arbitrary Python code execution.
- The Python `json` library is patched so that the default encoder class escapes the HTML entities `<`, `>` and `&`.

This middleware applies the patches and then raises `django.core.exceptions.MiddlewareNotUsed` so that it does not re-apply the patches on subsequent requests. Note that in tests which don't load any middleware the patches will not be applied.

## `dumpurls` Management Command

Use the `dumpurls` management command to generate a report listing all the configured URL patterns in your project.

For each pattern, the report shows the regular expression for the full path, the Python dotted module name for the view that handles requests, and the names of decorators that may have been applied to the view.

Supports the following optional parameters:

- `--show_allowed_methods` HTTP methods supported by this view (CBVs only)
- `--show_class_parents` CBVs only. Shows which classes this view inherits from
- `--output_file_type` Export dumpurl data to a json or csv file. Choices: `json` or `csv`

# CSRF session check

The built in Djangae checks enforce the use of session-based (rather than cookie-based) CSRF tokens. To satisfy this check the `CSRF_USE_SESSIONS` setting must be True.

GitLab « Previous Next »