{"id":511,"date":"2022-09-10T00:29:40","date_gmt":"2023-11-25T19:56:26","guid":{"rendered":"https:\/\/www.silicloud.com\/blog\/uncategorized\/how-to-enhance-the-security-of-your-django-project-in-production\/"},"modified":"2024-03-16T15:44:35","modified_gmt":"2024-03-16T15:44:35","slug":"how-to-enhance-the-security-of-your-django-project-in-production","status":"publish","type":"post","link":"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/","title":{"rendered":"How to Enhance the Security of Your Django Project in Production"},"content":{"rendered":"<p>Creating a Django application can be a convenient process since it is designed to be adaptable and expandable. This concept also applies to Django&#8217;s security features, which can assist you in getting your project ready for production. However, there are various methods to enhance the security of your project.<\/p>\n<p>By splitting your settings, you can establish various arrangements depending on the environment. Utilizing .env file to configure environment variables or safeguard sensitive settings will prevent leakage of any information that could jeopardize your project. Additionally, modifying default URLs and other settings will enable you to evade typical security weaknesses.<\/p>\n<p>Although it may initially require a significant amount of time, establishing an effective workflow will enable you to release your project without compromising either security or productivity.<\/p>\n<p>This tutorial will guide you through implementing and configuring environment-based settings, .env, and Django&#8217;s built-in security settings to create a security-focused workflow for your Django project. By using these features together, your Django project will be prepared for various deployment options.<\/p>\n<h2>Requirements<\/h2>\n<p>Prior to starting this guide, you will require the items listed below:<\/p>\n<ul class=\"post-ul\">\n<li>A pre-existing Django project. If you don\u2019t already have one set up, you can use our How To Install Django and Set Up a Development Environment tutorial for setup. In that tutorial, you\u2019ll use the testsite project from this tutorial as an example.For your Django project, you\u2019ll also need Python 3 installed. You can install it by following Step 1 of our tutorial, How To Install<a href=\"https:\/\/www.python.org\/download\/releases\/3.0\/\"> Python 3<\/a> and Set Up a Programming Environment on an Ubuntu 20.04 Server.<\/li>\n<li>A Let\u2019s Encrypt certificate. If you don\u2019t already have one set up, you can use our How To Secure Nginx with Let\u2019s Encrypt on Ubuntu 20.04 tutorial for setup.To use the Let\u2019s Encrypt certificate, you\u2019ll need Nginx installed. You can install it by following our tutorial How To Install Nginx on Ubuntu 20.04.<\/li>\n<li>This Django Development tutorial series is a great way to get familiar with Django\u2019s file structure and its core settings.<\/li>\n<\/ul>\n<div class=\"post-conf-note\">\n<p class=\"post-conf-desc\">Note<\/p>\n<div>Please keep in mind that if you are already using a Django project, your requirements may vary. This tutorial recommends a specific project structure, but you can also utilize each section of the tutorial separately based on your needs.<\/div>\n<\/div>\n<h2>First, we need to reorganize Django&#8217;s settings.<\/h2>\n<p>First, to ensure the security of your Django project, you must navigate to the project directory and activate the virtual environment.<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\"><span class=\"token builtin class-name\">cd<\/span> django-apps<\/li>\n<li data-prefix=\"$\"><span class=\"token builtin class-name\">.<\/span> env\/bin\/activate<\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>To begin, you will initially reorganize your settings.py file to cater to specific environments. This is a recommended approach when transferring a project across various environments such as development and production. By adopting this setup, you will minimize the need for extensive reconfiguration in different environments. Instead, you will utilize an environment variable to toggle between configurations, which will be covered in detail later in the tutorial.<\/p>\n<p>Make a settings directory within the subdirectory of your project.<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\"><span class=\"token function\">mkdir<\/span> <mark>testsite<\/mark>\/<mark>testsite<\/mark>\/settings<\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>(According to the requirements, this tutorial utilizes testsite, but you have the option to substitute it with your project&#8217;s name.)<\/p>\n<p>The current settings.py file will be substituted by this directory, and all the environment-specific settings will be stored in individual files within this folder.<\/p>\n<p>In the folder for your new settings, make three Python files.<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\"><span class=\"token builtin class-name\">cd<\/span> <mark>testsite<\/mark>\/<mark>testsite<\/mark>\/settings<\/li>\n<li data-prefix=\"$\"><span class=\"token function\">touch<\/span> base.py development.py production.py<\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>The development.py file will include settings typically used while developing, while the production.py file will include settings meant for a production server. It is necessary to keep them separate as the production configuration will have settings that won&#8217;t function in a development environment, such as enforcing HTTPS, adding headers, and utilizing a production database.<\/p>\n<p>The base.py file will include settings that both development.py and production.py will derive from. This is done to decrease repetition and maintain code organization. As a result, you can eliminate the settings.py file to avoid any confusion with Django.<\/p>\n<p>When you are in the settings directory, use the following command to rename settings.py as base.py:<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\"><span class=\"token function\">mv<\/span> <span class=\"token punctuation\">..<\/span>\/settings.py base.py<\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>You have just finished outlining your newly created directory for environment-based settings. However, your project is not yet familiar with this new configuration. Therefore, your next step will be to address this issue.<\/p>\n<h2>Step 2 involves the utilization of django-environ.<\/h2>\n<p>At present, Django is unaware of your new settings directory and its internal files. Therefore, in order to proceed with working on your environment-specific settings, you must configure Django to function with django-environ. django-environ is a necessary component that retrieves environment variables from a .env file. This implies that Django will examine a .env file located in your project&#8217;s main directory to determine the settings configuration to utilize.<\/p>\n<p>To view the contents of the directory, navigate to the main folder of your project and run the ls command.<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\"><span class=\"token builtin class-name\">cd<\/span> <span class=\"token punctuation\">..<\/span>\/<span class=\"token punctuation\">..<\/span>\/<\/li>\n<li data-prefix=\"$\"><span class=\"token function\">ls<\/span><\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>Your project&#8217;s main folder should have files organized in this manner.<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<div class=\"secondary-code-label\" title=\"Output\">Output<\/div>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>db.sqlite3 manage.py testsite<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>You should install django-environ.<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\">pip <span class=\"token function\">install<\/span> django-environ<\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>To utilize .env in Django, you must configure it. This can be achieved by making changes in two files: manage.py, for development purposes, and wsgi.py, for production purposes.<\/p>\n<p>Begin by accessing manage.py for modification using nano or any text editor of your choice.<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\"><span class=\"token function\">nano<\/span> manage.py<\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>Please include the code that is highlighted.<\/p>\n<div>manage.py in the testsite directory.<\/div>\n<pre class=\"post-pre\"><code><span class=\"token keyword\">import<\/span> os\r\n<span class=\"token keyword\">import<\/span> sys\r\n<span class=\"token operator\">&lt;<\/span><span class=\"token operator\">^<\/span><span class=\"token operator\">&gt;<\/span><span class=\"token keyword\">import<\/span> environ\r\n\r\nenviron<span class=\"token punctuation\">.<\/span>Env<span class=\"token punctuation\">.<\/span>read_env<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token operator\">&lt;<\/span><span class=\"token operator\">^<\/span><span class=\"token operator\">&gt;<\/span>\r\n\r\n<span class=\"token keyword\">def<\/span> <span class=\"token function\">main<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span>\r\n    os<span class=\"token punctuation\">.<\/span>environ<span class=\"token punctuation\">.<\/span>setdefault<span class=\"token punctuation\">(<\/span><span class=\"token string\">'DJANGO_SETTINGS_MODULE'<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string\">'testsite.settings'<\/span><span class=\"token punctuation\">)<\/span>\r\n\r\n    <span class=\"token keyword\">try<\/span><span class=\"token punctuation\">:<\/span>\r\n        <span class=\"token keyword\">from<\/span> django<span class=\"token punctuation\">.<\/span>core<span class=\"token punctuation\">.<\/span>management <span class=\"token keyword\">import<\/span> execute_from_command_line\r\n    <span class=\"token keyword\">except<\/span> ImportError <span class=\"token keyword\">as<\/span> exc<span class=\"token punctuation\">:<\/span>\r\n        <span class=\"token keyword\">raise<\/span> ImportError<span class=\"token punctuation\">(<\/span>\r\n            <span class=\"token string\">\"Couldn't import Django. Are you sure it's installed and \"<\/span>\r\n            <span class=\"token string\">\"available on your PYTHONPATH environment variable? Did you \"<\/span>\r\n            <span class=\"token string\">\"forget to activate a virtual environment?\"<\/span>\r\n        <span class=\"token punctuation\">)<\/span> <span class=\"token keyword\">from<\/span> exc\r\n    execute_from_command_line<span class=\"token punctuation\">(<\/span>sys<span class=\"token punctuation\">.<\/span>argv<span class=\"token punctuation\">)<\/span>\r\n\r\n\r\n<span class=\"token keyword\">if<\/span> __name__ <span class=\"token operator\">==<\/span> <span class=\"token string\">'__main__'<\/span><span class=\"token punctuation\">:<\/span>\r\n    main<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>\r\n<\/code><\/pre>\n<p>To save and close manage.py, press CTRL+X, choose Y to save, and press ENTER.<\/p>\n<p>To begin, open the file wsgi.py for editing.<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\"><span class=\"token function\">nano<\/span> <mark>testsite<\/mark>\/wsgi.py<\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>Include the specified highlighted sentences.<\/p>\n<div>Please provide a valid context or sentence containing &#8220;testsite\/testsite\/wsgi.py&#8221; so that I can paraphrase it accurately.<\/div>\n<pre class=\"post-pre\"><code>\r\n<span class=\"token keyword\">import<\/span> os\r\n<span class=\"token operator\">&lt;<\/span><span class=\"token operator\">^<\/span><span class=\"token operator\">&gt;<\/span><span class=\"token keyword\">import<\/span> environ\r\n\r\nenviron<span class=\"token punctuation\">.<\/span>Env<span class=\"token punctuation\">.<\/span>read_env<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token operator\">&lt;<\/span><span class=\"token operator\">^<\/span><span class=\"token operator\">&gt;<\/span>\r\n\r\n<span class=\"token keyword\">from<\/span> django<span class=\"token punctuation\">.<\/span>core<span class=\"token punctuation\">.<\/span>wsgi <span class=\"token keyword\">import<\/span> get_wsgi_application\r\n\r\nos<span class=\"token punctuation\">.<\/span>environ<span class=\"token punctuation\">.<\/span>setdefault<span class=\"token punctuation\">(<\/span><span class=\"token string\">'DJANGO_SETTINGS_MODULE'<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string\">'testsite.settings'<\/span><span class=\"token punctuation\">)<\/span>\r\n\r\napplication <span class=\"token operator\">=<\/span> get_wsgi_application<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>\r\n<\/code><\/pre>\n<p>To save and close the file, you can use the key combination CTRL+X, followed by the letter Y to save, and finally press ENTER.<\/p>\n<p>The code added to these files performs two tasks. Firstly, it instructs Django to always refer to the .env file whenever it runs, be it through manage.py for development or wsgi.py for production. If the .env file exists, Django will use the settings file that .env suggests; otherwise, it will default to the development configuration.<\/p>\n<p>In the end, you will generate a .env file in the existing folder.<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\"><span class=\"token function\">nano<\/span> .env<\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>Now include the following code to establish the environment as development:<\/p>\n<div>The environment variables of the testing site can be found at testsite\/.env.<\/div>\n<pre class=\"post-pre\"><code>DJANGO_SETTINGS_MODULE=\"<mark>testsite<\/mark>.settings.development\"\r\n<\/code><\/pre>\n<p>To save and close the file, use the keyboard shortcut CTRL+X, press Y to save, and finally press ENTER.<\/p>\n<div class=\"post-conf-note\">\n<p class=\"post-conf-desc\">Note<\/p>\n<div>Make sure to exclude the .env file from your commits by adding it to your .gitignore file. This file is meant to store sensitive data like passwords and API keys that should not be visible to the public. Each environment your project runs on should have its own .env file with specific settings for that environment. To make it easier to create a new .env file whenever needed, it is advisable to include a .env.example file in your project.<\/div>\n<\/div>\n<p>So, by default, Django will utilize testsite.settings.development. However, if you modify DJANGO_SETTINGS_MODULE to testsite.settings.production, for instance, it will begin using your production setup. Afterward, you need to fill in the configurations for development.py and production.py in your settings.<\/p>\n<h2>Step 3 &#8211; Establishing Development and Production Configurations<\/h2>\n<p>Afterward, proceed to access your base.py and incorporate the necessary changes for each environment by creating the separate development.py and production.py files. It is essential to have your production database credentials readily accessible for the production.py file.<\/p>\n<div class=\"post-conf-note\">\n<p class=\"post-conf-desc\">Note<\/p>\n<div>Please determine the necessary configuration settings based on your environment. This tutorial will only provide an example for production and development settings, including security settings and separate database configurations.<\/div>\n<\/div>\n<p>To demonstrate the process, we will be using the Django project mentioned in the previous tutorial. In order to transfer the settings, we will start by accessing the development.py file.<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\"><span class=\"token function\">nano<\/span> <mark>testsite<\/mark>\/settings\/development.py<\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>Next, include the given code.<\/p>\n<div>\n<p>One possible paraphrase of &#8220;testsite\/testsite\/settings\/development.py&#8221; could be:<\/p>\n<p>&#8211; development.py file located within the testsite\/settings directory on testsite.<\/p>\n<\/div>\n<pre class=\"post-pre\"><code><span class=\"token keyword\">import<\/span> os\r\n<span class=\"token keyword\">from<\/span> <span class=\"token punctuation\">.<\/span>base <span class=\"token keyword\">import<\/span> <span class=\"token operator\">*<\/span>\r\n\r\nDEBUG <span class=\"token operator\">=<\/span> <span class=\"token boolean\">True<\/span>\r\n\r\nDATABASES <span class=\"token operator\">=<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token string\">'default'<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token punctuation\">{<\/span>\r\n        <span class=\"token string\">'ENGINE'<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token string\">'django.db.backends.sqlite3'<\/span><span class=\"token punctuation\">,<\/span>\r\n        <span class=\"token string\">'NAME'<\/span><span class=\"token punctuation\">:<\/span> os<span class=\"token punctuation\">.<\/span>path<span class=\"token punctuation\">.<\/span>join<span class=\"token punctuation\">(<\/span>BASE_DIR<span class=\"token punctuation\">,<\/span> <span class=\"token string\">'db.sqlite3'<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span>\r\n    <span class=\"token punctuation\">}<\/span>\r\n<span class=\"token punctuation\">}<\/span>\r\n<\/code><\/pre>\n<p>To save and exit the file, press CTRL+X, followed by pressing Y to save, and finally hit ENTER.<\/p>\n<p>Initially, you will bring in the content from base.py, which inherits the settings from that file. Subsequently, you will adjust the desired settings specifically for the development environment. These settings include DEBUG, which should be set to True during development, but not in production; and DATABASES, which should be a local database instead of a production database. For development purposes, you will be utilizing an SQLite database.<\/p>\n<div class=\"post-conf-note\">\n<p class=\"post-conf-desc\">Note<\/p>\n<div>To protect against revealing secrets, Django&#8217;s DEBUG output will never show certain settings that contain sensitive strings like API, KEY, PASS, SECRET, SIGNATURE, or TOKEN. This measure is in place to prevent the exposure of secrets if a project is mistakenly deployed in production with DEBUG still active. Therefore, it is strongly advised not to publicly deploy a project with DEBUG enabled as it can only compromise the security of the project.<\/div>\n<\/div>\n<p>Afterwards, you will make additions to production.py. Access the file by utilizing the given command:<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\"><span class=\"token function\">nano<\/span> <mark>testsite<\/mark>\/settings\/production.py<\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>Next, include the subsequent code. The final output will resemble development.py; however, it will have an altered database configuration and DEBUG will be deactivated.<\/p>\n<div>production.py in testsite\/testsite\/settings<\/div>\n<pre class=\"post-pre\"><code><span class=\"token keyword\">import<\/span> os\r\n<span class=\"token keyword\">from<\/span> <span class=\"token punctuation\">.<\/span>base <span class=\"token keyword\">import<\/span> <span class=\"token operator\">*<\/span>\r\n<span class=\"token keyword\">import<\/span> environ\r\n\r\nenv <span class=\"token operator\">=<\/span> environ<span class=\"token punctuation\">.<\/span>Env<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>\r\nenviron<span class=\"token punctuation\">.<\/span>Env<span class=\"token punctuation\">.<\/span>read_env<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>\r\n\r\nDEBUG <span class=\"token operator\">=<\/span> <span class=\"token boolean\">False<\/span>\r\n\r\nALLOWED_HOSTS <span class=\"token operator\">=<\/span> <span class=\"token punctuation\">[<\/span><span class=\"token punctuation\">]<\/span>\r\n\r\nDATABASES <span class=\"token operator\">=<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token string\">'default'<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token punctuation\">{<\/span>\r\n        <span class=\"token string\">'ENGINE'<\/span><span class=\"token punctuation\">:<\/span> env<span class=\"token punctuation\">(<\/span><span class=\"token string\">'SQL_ENGINE'<\/span><span class=\"token punctuation\">,<\/span> default<span class=\"token operator\">=<\/span><span class=\"token string\">'django.db.backends.sqlite3'<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span>\r\n        <span class=\"token string\">'NAME'<\/span><span class=\"token punctuation\">:<\/span> env<span class=\"token punctuation\">(<\/span><span class=\"token string\">'SQL_DATABASE'<\/span><span class=\"token punctuation\">,<\/span> default<span class=\"token operator\">=<\/span>os<span class=\"token punctuation\">.<\/span>path<span class=\"token punctuation\">.<\/span>join<span class=\"token punctuation\">(<\/span>BASE_DIR<span class=\"token punctuation\">,<\/span> <span class=\"token string\">'db.sqlite3'<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span>\r\n        <span class=\"token string\">'USER'<\/span><span class=\"token punctuation\">:<\/span> env<span class=\"token punctuation\">(<\/span><span class=\"token string\">'SQL_USER'<\/span><span class=\"token punctuation\">,<\/span> default<span class=\"token operator\">=<\/span><span class=\"token string\">'user'<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span>\r\n        <span class=\"token string\">'PASSWORD'<\/span><span class=\"token punctuation\">:<\/span> env<span class=\"token punctuation\">(<\/span><span class=\"token string\">'SQL_PASSWORD'<\/span><span class=\"token punctuation\">,<\/span> default<span class=\"token operator\">=<\/span><span class=\"token string\">'password'<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span>\r\n        <span class=\"token string\">'HOST'<\/span><span class=\"token punctuation\">:<\/span> env<span class=\"token punctuation\">(<\/span><span class=\"token string\">'SQL_HOST'<\/span><span class=\"token punctuation\">,<\/span> default<span class=\"token operator\">=<\/span><span class=\"token string\">'localhost'<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span>\r\n        <span class=\"token string\">'PORT'<\/span><span class=\"token punctuation\">:<\/span> env<span class=\"token punctuation\">(<\/span><span class=\"token string\">'SQL_PORT'<\/span><span class=\"token punctuation\">,<\/span> default<span class=\"token operator\">=<\/span><span class=\"token string\">''<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span>\r\n    <span class=\"token punctuation\">}<\/span>\r\n<span class=\"token punctuation\">}<\/span>\r\n<\/code><\/pre>\n<p>To save and close the file, simply use the keyboard shortcut CTRL+X, press Y to confirm saving, and finally hit ENTER.<\/p>\n<p>You can configure each of the credentials in the provided example database configuration using .env, including default values. If you have already set up a database for your project&#8217;s production version, please use your own configuration instead of the provided example.<\/p>\n<p>You have set up your project to use various settings according to the DJANGO_SETTINGS_MODULE in .env file. By using the provided example settings, when you choose to use production settings, DEBUG will be set to False, ALLOWED_HOSTS will be specified, and you will begin utilizing a different database that has already been configured on your server.<\/p>\n<h2>Step 4 &#8211; Utilizing Django&#8217;s Security Settings in Action<\/h2>\n<p>Django has built-in security settings that you can easily incorporate into your project. In the next phase, you will integrate security settings into your project which are crucial for any production-level project. These settings are meant to be implemented when your project is accessible to the public. It is advised not to use these settings in your development environment. Therefore, in this step, you will only apply these settings in the production.py configuration.<\/p>\n<p>In general, these configurations will require the utilization of HTTPS for different web functionalities, like session cookies, CSRF cookies, transitioning from HTTP to HTTPS, and more. Hence, if you haven&#8217;t yet established a domain that directs to your server, it is advised to postpone this section. If you need help preparing your server for deployment, refer to the Conclusion section, where recommended articles on this topic can be found.<\/p>\n<p>To begin, open the file named production.py.<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\"><span class=\"token function\">nano<\/span> <mark>testsite<\/mark>\/settings\/production.py<\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>Please incorporate the specified settings from the explanations provided into your file.<\/p>\n<div>production.py is located in the settings folder within the testsite folder.<\/div>\n<pre class=\"post-pre\"><code><span class=\"token keyword\">import<\/span> os\r\n<span class=\"token keyword\">from<\/span> <span class=\"token punctuation\">.<\/span>base <span class=\"token keyword\">import<\/span> <span class=\"token operator\">*<\/span>\r\n<span class=\"token keyword\">import<\/span> environ\r\n\r\nenv <span class=\"token operator\">=<\/span> environ<span class=\"token punctuation\">.<\/span>Env<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>\r\nenviron<span class=\"token punctuation\">.<\/span>Env<span class=\"token punctuation\">.<\/span>read_env<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>\r\n\r\nDEBUG <span class=\"token operator\">=<\/span> <span class=\"token boolean\">False<\/span>\r\n\r\nALLOWED_HOSTS <span class=\"token operator\">=<\/span> <span class=\"token punctuation\">[<\/span><span class=\"token string\">'<mark>your_domain<\/mark>'<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string\">'<mark>www.your_domain<\/mark>'<\/span><span class=\"token punctuation\">]<\/span>\r\n\r\nDATABASES <span class=\"token operator\">=<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token string\">'default'<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token punctuation\">{<\/span>\r\n        <span class=\"token string\">'ENGINE'<\/span><span class=\"token punctuation\">:<\/span> env<span class=\"token punctuation\">(<\/span><span class=\"token string\">'SQL_ENGINE'<\/span><span class=\"token punctuation\">,<\/span> default<span class=\"token operator\">=<\/span><span class=\"token string\">'django.db.backends.sqlite3'<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span>\r\n        <span class=\"token string\">'NAME'<\/span><span class=\"token punctuation\">:<\/span> env<span class=\"token punctuation\">(<\/span><span class=\"token string\">'SQL_DATABASE'<\/span><span class=\"token punctuation\">,<\/span> default<span class=\"token operator\">=<\/span>os<span class=\"token punctuation\">.<\/span>path<span class=\"token punctuation\">.<\/span>join<span class=\"token punctuation\">(<\/span>BASE_DIR<span class=\"token punctuation\">,<\/span> <span class=\"token string\">'db.sqlite3'<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span>\r\n        <span class=\"token string\">'USER'<\/span><span class=\"token punctuation\">:<\/span> env<span class=\"token punctuation\">(<\/span><span class=\"token string\">'SQL_USER'<\/span><span class=\"token punctuation\">,<\/span> default<span class=\"token operator\">=<\/span><span class=\"token string\">'user'<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span>\r\n        <span class=\"token string\">'PASSWORD'<\/span><span class=\"token punctuation\">:<\/span> env<span class=\"token punctuation\">(<\/span><span class=\"token string\">'SQL_PASSWORD'<\/span><span class=\"token punctuation\">,<\/span> default<span class=\"token operator\">=<\/span><span class=\"token string\">'password'<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span>\r\n        <span class=\"token string\">'HOST'<\/span><span class=\"token punctuation\">:<\/span> env<span class=\"token punctuation\">(<\/span><span class=\"token string\">'SQL_HOST'<\/span><span class=\"token punctuation\">,<\/span> default<span class=\"token operator\">=<\/span><span class=\"token string\">'localhost'<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span>\r\n        <span class=\"token string\">'PORT'<\/span><span class=\"token punctuation\">:<\/span> env<span class=\"token punctuation\">(<\/span><span class=\"token string\">'SQL_PORT'<\/span><span class=\"token punctuation\">,<\/span> default<span class=\"token operator\">=<\/span><span class=\"token string\">''<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span>\r\n    <span class=\"token punctuation\">}<\/span>\r\n<span class=\"token punctuation\">}<\/span>\r\n\r\n<mark>SECURE_SSL_REDIRECT <span class=\"token operator\">=<\/span> <span class=\"token boolean\">True<\/span><\/mark>\r\n\r\n<mark>SESSION_COOKIE_SECURE <span class=\"token operator\">=<\/span> <span class=\"token boolean\">True<\/span><\/mark>\r\n\r\n<mark>CSRF_COOKIE_SECURE <span class=\"token operator\">=<\/span> <span class=\"token boolean\">True<\/span><\/mark>\r\n\r\n<mark>SECURE_BROWSER_XSS_FILTER <span class=\"token operator\">=<\/span> <span class=\"token boolean\">True<\/span><\/mark>\r\n<\/code><\/pre>\n<ul class=\"post-ul\">\n<li>ALLOWED_HOSTS is a list of strings that represent the host\/domain names that your project can serve. This is a security measure to prevent an attacker from poisoning caches and DNS. Find more details about ALLOWED_HOSTS in the Django documentation.<\/li>\n<li>SECURE_SSL_REDIRECT redirects all HTTP requests to HTTPS (unless exempt). This means your project will always try to use an encrypted connection. You will need to have SSL configured on your server for this to work. Note that if you have Nginx or Apache configured to do this already, this setting will be redundant.<\/li>\n<li>SESSION_COOKIE_SECURE tells the browser that cookies can only be handled over HTTPS. This means cookies your project produces for activities, such as logins, will only work over an encrypted connection.<\/li>\n<li>CSRF_COOKIE_SECURE is the same as SESSION_COOKIE_SECURE but applies to your CSRF token. CSRF tokens protect against cross-site request forgery. Django CSRF protection does this by ensuring any forms submitted (for logins, signups, and so on) to your project were created by your project and not a third party.<\/li>\n<li>SECURE_BROWSER_XSS_FILTER sets the X-XSS-Protection: 1; mode=block header on all responses that do not already have it. This ensures third parties cannot inject scripts into your project. For example, if a user stores a script in your database using a public field, when that script is retrieved and displayed to other users it will not run.<\/li>\n<\/ul>\n<p>To save and close the file, simply use the keyboard shortcut CTRL+X, confirm by pressing Y to save, and finally press ENTER.<\/p>\n<p>If you&#8217;re interested in exploring further about the various security options offered by Django, you can refer to their documentation.<\/p>\n<div class=\"post-conf-warning\">\n<p class=\"post-conf-desc\">Warning<\/p>\n<div>Caution: According to Django&#8217;s documentation, it is not advisable to solely depend on SECURE_BROWSER_XSS_FILTER. It is crucial to always remember to validate and cleanse input.<\/div>\n<\/div>\n<h3>More settings options<\/h3>\n<p>These settings are meant to enable HTTP Strict Transport Security (HSTS), thereby ensuring that your entire website must always utilize SSL.<\/p>\n<ul class=\"post-ul\">\n<li>SECURE_HSTS_SECONDS is the amount of time in seconds HSTS is set for. If you set this for an hour (in seconds), every time you visit a web page on your website, it tells your browser that for the next hour HTTPS is the only way you can visit the site. If during that hour you visit an insecure part of your website, the browser will show an error and the insecure page will be inaccessible.<\/li>\n<li>SECURE_HSTS_PRELOAD only works if SECURE_HSTS_SECONDS is set. This header instructs the browser to preload your site. This means that your website will be added to a hard-coded list, which is implemented in popular browsers, like Firefox and Chrome. This requires that your website is always encrypted. It is important to be careful with this header. If at anytime you decide not to use encryption for your project, it can take weeks to be manually removed from the HSTS preload list.<\/li>\n<li>SECURE_HSTS_INCLUDE_SUBDOMAINS applies the HSTS header to all subdomains. Enabling this header means that both your_domain and unsecure.your_domain will require encryption, even if unsecure.your_domain is not related to this Django project.<\/li>\n<\/ul>\n<div class=\"post-conf-warning\">\n<p class=\"post-conf-desc\">Warning<\/p>\n<div>Be cautious as your site can be broken for a considerable period if these extra settings are configured incorrectly. It is advisable to go through the Django documentation on HSTS before applying these configurations.<\/div>\n<\/div>\n<p>You need to take into account how these settings will function with your own Django project; in general, the configuration mentioned here provides a strong starting point for most Django projects. Afterwards, you will explore additional ways to use .env.<\/p>\n<h2>Step 5 involves utilizing django-environ to manage secret information.<\/h2>\n<p>In the last section of this tutorial, you will learn how to use django-environ effectively. This feature enables you to conceal specific details like your project&#8217;s SECRET_KEY or the login URL for the admin. It&#8217;s highly recommended, especially if you plan to share your code on platforms such as GitHub or GitLab, as it prevents these sensitive information from being exposed. Instead, when you set up your project for the first time on a local environment or a server, you can create a new .env file and specify those secret variables there.<\/p>\n<p>In this section, you should focus on concealing your SECRET_KEY in order to proceed with your work.<\/p>\n<p>Please open the .env file located in the main directory of your project.<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\"><span class=\"token function\">nano<\/span> .env<\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>Include the subsequent line, ensuring to substitute your_secret_key with your personal confidential strings.<\/p>\n<div>the environment file in the testsite directory<\/div>\n<pre class=\"post-pre\"><code>DJANGO_SETTINGS_MODULE=\"<mark>testsite<\/mark>.settings.development\"\r\nSECRET_KEY=\"<mark>your_secret_key<\/mark>\"\r\n<\/code><\/pre>\n<p>You can save and close the file by using the key combination CTRL+X, confirming to save by pressing Y, and then pressing ENTER.<\/p>\n<p>Afterwards, proceed to open base.py.<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\"><span class=\"token function\">nano<\/span> <mark>testsite<\/mark>\/settings\/base.py<\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>Please modify the SECRET_KEY variable in the following manner:<\/p>\n<div>One option for paraphrasing &#8220;testsite\/testsite\/settings\/base.py&#8221; could be &#8220;base.py file located in the testsite\/testsite\/settings directory.&#8221;<\/div>\n<pre class=\"post-pre\"><code><span class=\"token punctuation\">.<\/span> <span class=\"token punctuation\">.<\/span> <span class=\"token punctuation\">.<\/span>\r\n<span class=\"token operator\">&lt;<\/span><span class=\"token operator\">^<\/span><span class=\"token operator\">&gt;<\/span><span class=\"token keyword\">import<\/span> environ\r\n\r\nenv <span class=\"token operator\">=<\/span> environ<span class=\"token punctuation\">.<\/span>Env<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>\r\nenviron<span class=\"token punctuation\">.<\/span>Env<span class=\"token punctuation\">.<\/span>read_env<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token operator\">&lt;<\/span><span class=\"token operator\">^<\/span><span class=\"token operator\">&gt;<\/span>\r\n\r\nSECRET_KEY <span class=\"token operator\">=<\/span> <mark>env<span class=\"token punctuation\">(<\/span><span class=\"token string\">'SECRET_KEY'<\/span><span class=\"token punctuation\">)<\/span><\/mark>\r\n<span class=\"token punctuation\">.<\/span> <span class=\"token punctuation\">.<\/span> <span class=\"token punctuation\">.<\/span>\r\n<\/code><\/pre>\n<div class=\"post-conf-note\">\n<p class=\"post-conf-desc\">Note<\/p>\n<div>Please do not replace SECRET_KEY with the real secret key. Keep the SECRET_KEY variable as it is and add the actual secret key to the .env file.<\/div>\n<\/div>\n<p>To save and close the file, use the key combination CTRL+X. Press Y to save the changes and then ENTER. By doing this, your project will utilize the SECRET_KEY from the .env file.<\/p>\n<p>Finally, to increase security, you can obfuscate your admin URL by appending a lengthy sequence of random characters. Instead of accessing your_domain\/admin, you will now access your_domain\/very_secret_url\/admin. By doing this, it will be challenging for both automated bots and unknown individuals to discover your admin URL, thus reducing the risk of brute force attempts on your admin login.<\/p>\n<p>Please reopen the .env file.<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\"><span class=\"token function\">nano<\/span> .env<\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>Please include a SECRET_ADMIN_URL variable.<\/p>\n<div>.env file located in the testsite directory.<\/div>\n<pre class=\"post-pre\"><code>DJANGO_SETTINGS_MODULE=\"<mark>testsite<\/mark>.settings.development\"\r\nSECRET_KEY=\"your_secret_key\"\r\n<mark>SECRET_ADMIN_URL=\"very_secret_url\"<\/mark>\r\n<\/code><\/pre>\n<p>To save and close the file, simply press CTRL+X, choose to save by pressing Y, and finally press ENTER.<\/p>\n<p>Now you need to instruct Django to conceal your admin URL using SECRET_ADMIN_URL.<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<ol>\n<li data-prefix=\"$\"><span class=\"token function\">nano<\/span> <mark>testsite<\/mark>\/urls.py<\/li>\n<\/ol>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<p>&nbsp;<\/p>\n<pre class=\"post-pre\"><code><\/code><\/pre>\n<div class=\"post-conf-note\">\n<p class=\"post-conf-desc\">Note<\/p>\n<div>Remember to substitute the placeholder &#8220;very_secret_url&#8221; with your own confidential URL. In case you prefer using random sequences of characters for this variable, Python offers the superb secrets.py library that can generate such strings. The provided examples are excellent for creating compact Python scripts to generate secure random strings.<\/div>\n<\/div>\n<p>Modify the administrator URL in this way:<\/p>\n<div>Can you please provide more context or the content of the file &#8220;testsite\/urls.py&#8221; so that I can accurately paraphrase it?<\/div>\n<pre class=\"post-pre\"><code><span class=\"token keyword\">from<\/span> django<span class=\"token punctuation\">.<\/span>contrib <span class=\"token keyword\">import<\/span> admin\r\n<span class=\"token keyword\">from<\/span> django<span class=\"token punctuation\">.<\/span>urls <span class=\"token keyword\">import<\/span> path\r\n<span class=\"token operator\">&lt;<\/span><span class=\"token operator\">^<\/span><span class=\"token operator\">&gt;<\/span><span class=\"token keyword\">import<\/span> environ\r\n\r\nenv <span class=\"token operator\">=<\/span> environ<span class=\"token punctuation\">.<\/span>Env<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>\r\nenviron<span class=\"token punctuation\">.<\/span>Env<span class=\"token punctuation\">.<\/span>read_env<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token operator\">&lt;<\/span><span class=\"token operator\">^<\/span><span class=\"token operator\">&gt;<\/span>\r\n\r\nurlpatterns <span class=\"token operator\">=<\/span> <span class=\"token punctuation\">[<\/span>\r\n    <mark>path<span class=\"token punctuation\">(<\/span>env<span class=\"token punctuation\">(<\/span><span class=\"token string\">'SECRET_ADMIN_URL'<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token operator\">+<\/span> <span class=\"token string\">'\/admin\/'<\/span><span class=\"token punctuation\">,<\/span> admin<span class=\"token punctuation\">.<\/span>site<span class=\"token punctuation\">.<\/span>urls<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span><\/mark>\r\n<span class=\"token punctuation\">]<\/span>\r\n<\/code><\/pre>\n<p>To save and close the file, simply press CTRL+X, followed by pressing Y to save, and finally press ENTER.<\/p>\n<p>The admin login page can now be found at the URL \/very_secret_url\/admin\/ instead of only \/admin\/.<\/p>\n<div><img decoding=\"async\" class=\"post-images\" title=\"\" src=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/655c56cfc40ba52feef1b1ba\/122-0.png\" alt=\"Admin login page\" \/><\/div>\n<h2>In conclusion,<\/h2>\n<p>In this guide, you have successfully set up your existing Django project to work seamlessly in various environments. You have incorporated django-environ to manage secrets and settings, enhancing your project. Additionally, your production settings now include Django&#8217;s native security features.<\/p>\n<p>If you have followed the instructions to enable all the suggested security components and re-implement the settings, your project will possess these essential characteristics:<\/p>\n<ul class=\"post-ul\">\n<li>SSL\/HTTPS for all communications (for example, subdomains, cookies, CSRF).<\/li>\n<li>XSS (cross-site scripting) attacks prevention.<\/li>\n<li>CSRF (cross-site request forgery) attacks prevention.<\/li>\n<li>Concealed project secret key.<\/li>\n<li>Concealed admin login URL, preventing brute-force attacks.<\/li>\n<li>Separate settings for development and production.<\/li>\n<\/ul>\n<p>If you want to know more about Django, take a look at our tutorial series on Django development.<\/p>\n<p>If you haven&#8217;t started your project yet, we have a tutorial on How to Configure Django with Postgres, Nginx, and Gunicorn on Ubuntu 20.04. Additionally, you can explore our Django topic page for more tutorials.<\/p>\n<p>Additionally, it is recommended to review Django&#8217;s settings documentation for more detailed information.<\/p>\n<p>&nbsp;<\/p>\n<p>More tutorials<\/p>\n<p><a class=\"LinkSuggestion__Link-sc-1gewdgc-4 cLBplk\" href=\"https:\/\/www.silicloud.com\/blog\/one-possible-paraphrase-could-besetting-up-a-programming-environment-and-installing-python-3-on-rocky-linux-9\/\" target=\"_blank\" rel=\"noopener\">Python 3 installing on Rocky Linux 9<span class=\"sc-gswNZR eASTkv\">(Opens in a new browser tab)<\/span><\/a><\/p>\n<p><a class=\"LinkSuggestion__Link-sc-1gewdgc-4 cLBplk\" href=\"https:\/\/www.silicloud.com\/blog\/method-x-is-unclear-for-the-type-y-in-java\/\" target=\"_blank\" rel=\"noopener\">method X is unclear for the type Y in Java<span class=\"sc-gswNZR eASTkv\">(Opens in a new browser tab)<\/span><\/a><\/p>\n<p><a class=\"LinkSuggestion__Link-sc-1gewdgc-4 cLBplk\" href=\"https:\/\/www.silicloud.com\/blog\/a-guide-on-creating-a-ruby-on-rails-application-on-ubuntu-22-04\/\" target=\"_blank\" rel=\"noopener\">A guide on creating a Ruby on Rails application on Ubuntu 22.04.<span class=\"sc-gswNZR eASTkv\">(Opens in a new browser tab)<\/span><\/a><\/p>\n<p><a class=\"LinkSuggestion__Link-sc-1gewdgc-4 cLBplk\" href=\"https:\/\/www.silicloud.com\/blog\/nativeness-is-subjective-as-it-depends-on-the-individuals-native-language-however-i-can-offer-a-paraphrase-in-englishstep-by-step-guide-installing-rust-on-ubuntu-20-04\/\" target=\"_blank\" rel=\"noopener\">Step-by-step Guide: Installing Rust on Ubuntu 20.04<span class=\"sc-gswNZR eASTkv\">(Opens in a new browser tab)<\/span><\/a><\/p>\n<p><a class=\"LinkSuggestion__Link-sc-1gewdgc-4 cLBplk\" href=\"https:\/\/www.silicloud.com\/blog\/how-to-include-items-to-a-list-in-python\/\" target=\"_blank\" rel=\"noopener\">How to include items to a list in Python<span class=\"sc-gswNZR eASTkv\">(Opens in a new browser tab)<\/span><\/a><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Creating a Django application can be a convenient process since it is designed to be adaptable and expandable. This concept also applies to Django&#8217;s security features, which can assist you in getting your project ready for production. However, there are various methods to enhance the security of your project. By splitting your settings, you can [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_import_markdown_pro_load_document_selector":0,"_import_markdown_pro_submit_text_textarea":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-511","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v21.5 (Yoast SEO v21.5) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How to Enhance the Security of Your Django Project in Production - Blog - Silicon Cloud<\/title>\n<meta name=\"description\" content=\"which can assist you in getting your project ready for production. However, there are various methods to enhance the security of your\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Enhance the Security of Your Django Project in Production\" \/>\n<meta property=\"og:description\" content=\"which can assist you in getting your project ready for production. However, there are various methods to enhance the security of your\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog - Silicon Cloud\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/SiliCloudGlobal\/\" \/>\n<meta property=\"article:published_time\" content=\"2023-11-25T19:56:26+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-03-16T15:44:35+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/655c56cfc40ba52feef1b1ba\/122-0.png\" \/>\n<meta name=\"author\" content=\"Benjamin Taylor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@SiliCloudGlobal\" \/>\n<meta name=\"twitter:site\" content=\"@SiliCloudGlobal\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Benjamin Taylor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"14 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/\"},\"author\":{\"name\":\"Benjamin Taylor\",\"@id\":\"https:\/\/www.silicloud.com\/blog\/#\/schema\/person\/ac801fe9549a25960ce48aa2e0a691c9\"},\"headline\":\"How to Enhance the Security of Your Django Project in Production\",\"datePublished\":\"2023-11-25T19:56:26+00:00\",\"dateModified\":\"2024-03-16T15:44:35+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/\"},\"wordCount\":3312,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.silicloud.com\/blog\/#organization\"},\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/\",\"url\":\"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/\",\"name\":\"How to Enhance the Security of Your Django Project in Production - Blog - Silicon Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/www.silicloud.com\/blog\/#website\"},\"datePublished\":\"2023-11-25T19:56:26+00:00\",\"dateModified\":\"2024-03-16T15:44:35+00:00\",\"description\":\"which can assist you in getting your project ready for production. However, there are various methods to enhance the security of your\",\"breadcrumb\":{\"@id\":\"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.silicloud.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Enhance the Security of Your Django Project in Production\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.silicloud.com\/blog\/#website\",\"url\":\"https:\/\/www.silicloud.com\/blog\/\",\"name\":\"Silicon Cloud Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.silicloud.com\/blog\/#organization\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.silicloud.com\/blog\/#organization\",\"name\":\"Silicon Cloud Blog\",\"url\":\"https:\/\/www.silicloud.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.silicloud.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.silicloud.com\/blog\/wp-content\/uploads\/2023\/11\/EN-SILICON-Full.png\",\"contentUrl\":\"https:\/\/www.silicloud.com\/blog\/wp-content\/uploads\/2023\/11\/EN-SILICON-Full.png\",\"width\":1024,\"height\":1024,\"caption\":\"Silicon Cloud Blog\"},\"image\":{\"@id\":\"https:\/\/www.silicloud.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/SiliCloudGlobal\/\",\"https:\/\/twitter.com\/SiliCloudGlobal\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.silicloud.com\/blog\/#\/schema\/person\/ac801fe9549a25960ce48aa2e0a691c9\",\"name\":\"Benjamin Taylor\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.silicloud.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/ec2e3d3e2d525fd148047c4520ae7c1cdccd1f4b48a1a488422b31f04f345c14?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/ec2e3d3e2d525fd148047c4520ae7c1cdccd1f4b48a1a488422b31f04f345c14?s=96&d=mm&r=g\",\"caption\":\"Benjamin Taylor\"},\"url\":\"https:\/\/www.silicloud.com\/blog\/author\/benjamintaylor\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"How to Enhance the Security of Your Django Project in Production - Blog - Silicon Cloud","description":"which can assist you in getting your project ready for production. However, there are various methods to enhance the security of your","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/","og_locale":"en_US","og_type":"article","og_title":"How to Enhance the Security of Your Django Project in Production","og_description":"which can assist you in getting your project ready for production. However, there are various methods to enhance the security of your","og_url":"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/","og_site_name":"Blog - Silicon Cloud","article_publisher":"https:\/\/www.facebook.com\/SiliCloudGlobal\/","article_published_time":"2023-11-25T19:56:26+00:00","article_modified_time":"2024-03-16T15:44:35+00:00","og_image":[{"url":"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/655c56cfc40ba52feef1b1ba\/122-0.png"}],"author":"Benjamin Taylor","twitter_card":"summary_large_image","twitter_creator":"@SiliCloudGlobal","twitter_site":"@SiliCloudGlobal","twitter_misc":{"Written by":"Benjamin Taylor","Est. reading time":"14 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/#article","isPartOf":{"@id":"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/"},"author":{"name":"Benjamin Taylor","@id":"https:\/\/www.silicloud.com\/blog\/#\/schema\/person\/ac801fe9549a25960ce48aa2e0a691c9"},"headline":"How to Enhance the Security of Your Django Project in Production","datePublished":"2023-11-25T19:56:26+00:00","dateModified":"2024-03-16T15:44:35+00:00","mainEntityOfPage":{"@id":"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/"},"wordCount":3312,"commentCount":0,"publisher":{"@id":"https:\/\/www.silicloud.com\/blog\/#organization"},"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/","url":"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/","name":"How to Enhance the Security of Your Django Project in Production - Blog - Silicon Cloud","isPartOf":{"@id":"https:\/\/www.silicloud.com\/blog\/#website"},"datePublished":"2023-11-25T19:56:26+00:00","dateModified":"2024-03-16T15:44:35+00:00","description":"which can assist you in getting your project ready for production. However, there are various methods to enhance the security of your","breadcrumb":{"@id":"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.silicloud.com\/blog\/how-to-enhance-the-security-of-your-django-project-in-production\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.silicloud.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How to Enhance the Security of Your Django Project in Production"}]},{"@type":"WebSite","@id":"https:\/\/www.silicloud.com\/blog\/#website","url":"https:\/\/www.silicloud.com\/blog\/","name":"Silicon Cloud Blog","description":"","publisher":{"@id":"https:\/\/www.silicloud.com\/blog\/#organization"},"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.silicloud.com\/blog\/#organization","name":"Silicon Cloud Blog","url":"https:\/\/www.silicloud.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.silicloud.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.silicloud.com\/blog\/wp-content\/uploads\/2023\/11\/EN-SILICON-Full.png","contentUrl":"https:\/\/www.silicloud.com\/blog\/wp-content\/uploads\/2023\/11\/EN-SILICON-Full.png","width":1024,"height":1024,"caption":"Silicon Cloud Blog"},"image":{"@id":"https:\/\/www.silicloud.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/SiliCloudGlobal\/","https:\/\/twitter.com\/SiliCloudGlobal"]},{"@type":"Person","@id":"https:\/\/www.silicloud.com\/blog\/#\/schema\/person\/ac801fe9549a25960ce48aa2e0a691c9","name":"Benjamin Taylor","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.silicloud.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/ec2e3d3e2d525fd148047c4520ae7c1cdccd1f4b48a1a488422b31f04f345c14?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ec2e3d3e2d525fd148047c4520ae7c1cdccd1f4b48a1a488422b31f04f345c14?s=96&d=mm&r=g","caption":"Benjamin Taylor"},"url":"https:\/\/www.silicloud.com\/blog\/author\/benjamintaylor\/"}]}},"_links":{"self":[{"href":"https:\/\/www.silicloud.com\/blog\/wp-json\/wp\/v2\/posts\/511","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.silicloud.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.silicloud.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/blog\/wp-json\/wp\/v2\/comments?post=511"}],"version-history":[{"count":0,"href":"https:\/\/www.silicloud.com\/blog\/wp-json\/wp\/v2\/posts\/511\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.silicloud.com\/blog\/wp-json\/wp\/v2\/media?parent=511"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.silicloud.com\/blog\/wp-json\/wp\/v2\/categories?post=511"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.silicloud.com\/blog\/wp-json\/wp\/v2\/tags?post=511"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}